Difference between revisions of "SEC520 Weekly Schedule"

From CDOT Wiki
Jump to: navigation, search
m (Protected "SEC520 Weekly Schedule": OER transfer ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite)))
 
(102 intermediate revisions by 4 users not shown)
Line 1: Line 1:
 
[[Category:SEC520]]
 
[[Category:SEC520]]
  
 +
=SEC520 Weekly Schedule=
 +
== Winter 2018==
 +
::Instructor:<br />Austin (SAA)<br />Craig Barretto (craig.barretto@senecacollege.ca)
 +
1 credit
 +
::*Quiz and Labs ( 4 Quiz, 7 Labs (15%))
 +
::::'''Logbooks due April 10th, 2018'''
 +
::*Assignments (2) 20%
 +
::::'''Assignment 1 - Due Date March 9''''''
 +
::::'''Assignment 2 - Due Date TBA''''''
 +
::*Tests (2) 30%
 +
::::'''Written Test - March 8''''''
 +
::::'''Lab Test - March 15'''''
 +
::*Final Test 35%
 
{|width="100%" border="1" cellspacing="2"
 
{|width="100%" border="1" cellspacing="2"
 
| style="width: 10%;" |
 
| style="width: 10%;" |
Line 12: Line 25:
 
|- valign="top"
 
|- valign="top"
 
|
 
|
 +
 +
 
:'''Week 1'''
 
:'''Week 1'''
  
Line 25: Line 40:
  
  
−
: '''Developing a "Security Mind":'''
+
 
−
::*4 Virtues of Internet Security
 
−
::*8 Rules of Internet Security
 
−
::*Penetration Testing:
 
−
:::*Reconnaissance:
 
−
::::*Information Gathering
 
−
::::*Foot-printing
 
−
::::*User Information
 
−
::::*Verification
 
  
 
|
 
|
Line 40: Line 47:
 
:'''Slides (Concepts):'''
 
:'''Slides (Concepts):'''
 
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l1.ppt ppt] ] Course Intro / The "Security Mind"
 
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l1.ppt ppt] ] Course Intro / The "Security Mind"
−
::*[ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l2.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l2.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l2.ppt ppt] ] Penetration Testing: Reconnaissance
+
 
  
 
:'''Reading References:'''
 
:'''Reading References:'''
 +
::* [http://lcweb.senecac.on.ca:2053/0596006691 Computer Security Basics (E-book)]<br />(Chapter 1: The New Insecurity)
 
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=86056&recCount=50&recPointer=0&bibId=263746 Inside the Security Mind, Making the Tough Decisions (E-Book)]  (Chapters 1 - 3)
 
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=86056&recCount=50&recPointer=0&bibId=263746 Inside the Security Mind, Making the Tough Decisions (E-Book)]  (Chapters 1 - 3)
 
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=89542&recCount=50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)]<br />(Chapter 2: Reconnaissance)
 
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=89542&recCount=50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)]<br />(Chapter 2: Reconnaissance)
  
−
:'''YouTube Videos:'''
 
−
::*[http://www.youtube.com/watch?v=NDQffaAMLQc Reconnaissance]
 
  
 
:'''Resources:'''
 
:'''Resources:'''
 
::* [http://zenit.senecac.on.ca/wiki/index.php/SEC520  SEC520 WIKI]
 
::* [http://zenit.senecac.on.ca/wiki/index.php/SEC520  SEC520 WIKI]
 
::* [https://scs.senecac.on.ca/course/sec520 Course Outline]
 
::* [https://scs.senecac.on.ca/course/sec520 Course Outline]
−
::* [https://cs.senecac.on.ca/~scs/DonMillsPolicies/policy.html Course Policies]
+
 
−
::* [http://zenit.senecac.on.ca/wiki/index.php/SEC520#Supplies_Checklist_.28Required_for_Second_Class.29 Required Materials]
+
::* Required Materials are listed in your Supplies Checklist. Other materials and references are noted week by week.
 +
 
  
 
|
 
|
Line 62: Line 69:
 
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_1.html Setup Hard Disk Pack for Labs]
 
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_1.html Setup Hard Disk Pack for Labs]
  
−
:'''Lab 2:'''
+
 
−
::Pentration Testing:
 
−
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_2.html Reconnaissance]
 
 
|-  valign="top"
 
|-  valign="top"
 
|
 
|
 +
 +
 
:'''Week 2'''
 
:'''Week 2'''
  
Line 72: Line 79:
  
  
 +
: '''Developing a "Security Mind":'''
 +
::*4 Virtues of Internet Security
 +
::*8 Rules of Internet Security
 +
::*Penetration Testing:
 +
:::*Reconnaissance:
 +
::::*Information Gathering
 +
::::*Foot-printing
 +
::::*User Information
 +
::::*Verification
  
  
Line 78: Line 94:
  
  
 +
:'''Slides (Concepts):'''
 +
::*[ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l2.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l2.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l2.ppt ppt] ] Penetration Testing: Reconnaissance
  
 +
:'''Reading References:'''
 +
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=86056&recCount=50&recPointer=0&bibId=263746 Inside the Security Mind, Making the Tough Decisions (E-Book)]  (Chapters 1 - 3)
 +
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=89542&recCount=50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)]<br />(Chapter 2: Reconnaissance)
  
−
|
+
:'''YouTube Videos:'''
−
 
+
::*[http://www.youtube.com/watch?v=NDQffaAMLQc Reconnaissance]
−
 
 
−
 
 
  
  
−
|-  valign="top"
 
 
|
 
|
−
:'''Week 3'''
 
  
−
|
 
  
 +
:'''Lab 2:'''
 +
::Pentration Testing:
 +
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_2.html Reconnaissance]
  
  
  
 +
|-  valign="top"
 
|
 
|
  
  
 +
:'''Week 3'''
  
 
|
 
|
  
−
 
−
 
−
 
−
 
−
 
−
 
−
|- valign="top"
 
−
|
 
−
:'''Week 4'''
 
−
 
−
 
−
|
 
  
 
:'''Scanning, Enumeration, & Vulnerability Testing:'''
 
:'''Scanning, Enumeration, & Vulnerability Testing:'''
Line 122: Line 131:
  
 
|
 
|
 +
  
 
:'''Slides (Concepts):'''
 
:'''Slides (Concepts):'''
 
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l1.ppt ppt] ]  Scanning & Enumeration
 
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l1.ppt ppt] ]  Scanning & Enumeration
−
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.ppt ppt] ]  Vulnerability Testing
+
 
−
::* [ [http://matrix.senecac.on.ca/~murray.saul/tank-rules.odp odp] ] [ [http://matrix.senecac.on.ca/~murray.saul/tank-rules.pdf pdf] ] [ [http://matrix.senecac.on.ca/~murray.saul/tank-rules.ppt ppt] ]  Interpreting and Respecting the Rules for the Tank Server
 
  
 
:'''Reading References:'''
 
:'''Reading References:'''
Line 134: Line 143:
 
::*[http://www.youtube.com/watch?v=_Ch0RJlHFBo Scanning 1] , [http://www.youtube.com/watch?v=WKLNAAt57Wg Scanning 2]
 
::*[http://www.youtube.com/watch?v=_Ch0RJlHFBo Scanning 1] , [http://www.youtube.com/watch?v=WKLNAAt57Wg Scanning 2]
 
::*[http://www.youtube.com/watch?v=_Ch0RJlHFBo Enumeration]
 
::*[http://www.youtube.com/watch?v=_Ch0RJlHFBo Enumeration]
−
::*[https://www.youtube.com/watch?v=FMgAIfcPsyw Vulnerability Testing - Overview]
+
::*[https://pentest-tools.com/network-vulnerability-scanning/tcp-port-scanner-online-nmap Online Pen-Test Scanner]
−
::*[https://www.youtube.com/watch?v=lNjxwvQT-os Nessus]
+
::*[https://www.youtube.com/watch?v=dR7NTYfmNcA Prep for Metasploit]
−
::*[https://www.youtube.com/watch?v=hRxOW37MRwc Accessing System Via Metasploit (web-browser)]
 
  
 
:'''Resources:'''
 
:'''Resources:'''
 
::*[http://nmap.org/book/man.html Nmap Reference Guide]<br />(How to use '''nmap''' utility to scan ports)
 
::*[http://nmap.org/book/man.html Nmap Reference Guide]<br />(How to use '''nmap''' utility to scan ports)
−
::*[http://www.commonexploits.com/?p=243 Using Armitage] (Metasploit Framework)
+
 
  
 
|
 
|
 +
  
 
:'''Lab 3:'''
 
:'''Lab 3:'''
Line 152: Line 161:
 
<div class="messagebox" style="background-color: #f9f6b7; border: 1px solid #c4c295; color: black; padding: 5px; margin: 1ex 0; min-height: 35px; margin-left:15px; margin-right:10px; padding-left: 20px;">
 
<div class="messagebox" style="background-color: #f9f6b7; border: 1px solid #c4c295; color: black; padding: 5px; margin: 1ex 0; min-height: 35px; margin-left:15px; margin-right:10px; padding-left: 20px;">
 
<div style="float: left; margin-left: -40px;"></div>
 
<div style="float: left; margin-left: -40px;"></div>
−
<div><b>WARNINGS!</b><br /><ol><li>'''Scanning ports must require the permission of Server Owner''' (preferably in writing). Student must either work in Security lab to scan each others' ports, or sign an agreement to scan the Tank server within or outside Seneca College.<br /><br /><li>'''Your instructor will hand-out permission forms to allow students to obtain Tank accounts, and allow students to perform ethical "penetration testing" on that server'''. Students <b><u>must</u></b> sign this form, hand back to the instructor, and await further instructions before proceeding with penetration testing on the tank server</li></ol></div>
+
 
 
</div>
 
</div>
  
Line 159: Line 168:
 
|- valign="top"
 
|- valign="top"
 
|
 
|
−
:'''Week 5'''
+
 
 +
 
 +
:'''Week 4'''
  
  
 
|
 
|
  
−
:'''System Hardening in Linux:'''
+
 
−
::*Purpose
+
:'''Scanning, Enumeration, & Vulnerability Testing:'''
−
::*Rule of Preventative Action
+
::*Vulnerability Testing
−
::*Rule of Separation
 
−
::*Rule of Least Privilege
 
−
:::*AAA Protocol (Authentication):
 
−
::::*PKI
 
−
::::*PAM
 
−
::::*Kerebos
 
  
  
 
|
 
|
 +
  
 
:'''Slides (Concepts):'''
 
:'''Slides (Concepts):'''
−
::*[ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.ppt ppt] ] Linux Hardening (part 1)
+
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.ppt ppt] ] Vulnerability Testing
 +
 
  
 
:'''Reading References:'''
 
:'''Reading References:'''
−
::*[http://lcweb.senecac.on.ca:2063/0596003919 Linux Security Cookbook (E-book)]<br />(Chapter 4 - Pages: )
+
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=89542&recCount=50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)]<br />(Chapter 3)
  
 
:'''YouTube Videos:'''
 
:'''YouTube Videos:'''
−
::*Linux Hardening
+
::*[https://www.youtube.com/watch?v=FMgAIfcPsyw Vulnerability Testing - Overview]
−
:::[http://www.youtube.com/watch?v=GJMKgV8V4FI Part1] | [http://www.youtube.com/watch?v=M9LdGH_AIZo Part 2] | [http://www.youtube.com/watch?v=0tEBXWU6Au4 Part 3]
+
::*[https://www.youtube.com/watch?v=lNjxwvQT-os Nessus]
−
::*[http://www.youtube.com/watch?v=yy1NR74ttAw&feature=results_main&playnext=1&list=PL48E055817B95897B PAM]
+
::*[https://www.youtube.com/watch?v=hRxOW37MRwc Accessing System Via Metasploit (web-browser)]
  
 
:'''Resources:'''
 
:'''Resources:'''
−
::* [http://www.linuxdoc.org/HOWTO/User-Authentication-HOWTO/x115.html Why Use PAM?]
+
::*[https://www.youtube.com/watch?v=r4Qq2eVjiP0 Setting up the Metasploit database]
−
::* [http://www.ibm.com/developerworks/linux/library/l-pam/index.html Understanding and Configuring PAM]
+
::*[https://www.youtube.com/watch?v=x01ZErjNlX0 First Metasploit Payload]
 +
::*[http://www.youtube.com/watch?v=jJd5qg3fkyw Using Armitage] (Metasploit Framework)]
  
  
Line 196: Line 204:
  
  
−
:'''Lab 4:'''
+
:'''Lab 3:'''
−
::System Hardening
+
::Continue Working on '''Lab 3'''
−
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_4.html Linux System Hardening (part 1)]
+
 
  
−
:'''Assignment #1 Posted:'''
 
−
::* [https://scs.senecac.on.ca/~fac/sec520/assignments/SEC520_Assignment_1.html Assignment Submission Instructions]
 
  
 
|- valign="top"
 
|- valign="top"
 
|
 
|
−
:'''Week 6'''
 
−
 
  
 +
 +
:'''Week 5'''
 
|
 
|
  
  
 +
:'''Types of Attacks:'''
 +
::*Client-side Attacks
 +
:::*Phishing
 +
:::*Webbrowser - Malicious Payloads
 +
:::*IP Spoofing (Man in the Middle) / Password
 +
::*Server-side Attacks
 +
:::*Out-dated Software Patches
 +
:::*Database Injection
 +
:::*Password Cracking
  
−
:'''Midterm (Test #1) Review:'''
 
−
::*Complete Labs 1 - 5
 
−
::*Review for Midterm
 
  
  
Line 220: Line 232:
  
  
 +
:'''Slides (Concepts):'''
 +
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.ppt ppt] ]  Types of Attacks
  
−
|
+
:'''YouTube Videos:'''
 +
::*[http://www.youtube.com/watch?v=ZUygX8TBBw0 Phishing]
 +
::*[http://www.youtube.com/watch?v=PqfZM3Lxrmg Malicious Payload]
 +
::*[http://www.youtube.com/watch?v=-hd7XG-b6uk IP Spoofing]
 +
::*[http://www.youtube.com/watch?v=AhTfo6pWBIM Database Injection]
 +
::*[http://www.youtube.com/watch?v=Iyh_w0Ix2bc Password Cracking]
  
 +
:'''Reading References:'''
 +
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=89542&recCount=50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)]<br />(Chapters 4,5,6)
  
−
:'''Lab 4:'''
+
:'''Resources:'''
−
::Continue Working on '''Lab 4'''
 
−
::Work on '''Assignment #1'''
 
  
 +
::*[http://atlas.arbor.net/ ATLAS Web-page] (Active Threat Level Analysis System)
 +
::*[http://www.sans.org/top-cyber-security-risks/summary.php Top Security Risks 2009 (SANS Institute)]
 +
::*[https://github.com/WebGoat/WebGoat/wiki Webgoat]
  
−
|- valign="top"
 
−
|
 
−
 
−
:'''Week 7'''
 
  
  
 
|
 
|
  
−
:'''Midterm (Test #1):'''
 
−
::*Test Details
 
  
 +
:'''Lab 4:'''
 +
:Attack Categories:
 +
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_4.html Types of Attacks]
  
−
|
 
  
 +
<div class="messagebox" style="background-color: #f9f6b7; border: 1px solid #c4c295; color: black; padding: 5px; margin: 1ex 0; min-height: 35px; margin-left:15px; margin-right:10px; padding-left: 20px;">
 +
<div style="float: left; margin-left: -40px;"></div>
 +
<div><b>WARNINGS!</b><br /><ol><li>'''Scanning ports must require the permission of Server Owner''' (preferably in writing). Student must either work in Security lab to scan each others' ports, or sign an agreement to scan any server.<br /><br /></ol></div>
 +
</div>
  
  
  
 +
|- valign="top"
 
|
 
|
  
  
 +
:'''Week 6'''
  
 +
More on mysql injection and Webgoat
  
−
|- valign="center"
 
−
!colspan="4"|'''Study Week'''
 
−
|- valign="top"
 
−
|
 
−
 
−
 
−
:'''Week 8'''
 
 
|
 
|
  
  
−
:'''System Hardening in Linux / Continued:'''
+
::* [[https://www.youtube.com/watch?v=Rqt_BgG5YyI Blind MySQL injection video]]
−
::*AAA Protocol (Authorization):
+
'''Moved until after the break'''
−
:::*ACLs
+
:'''Hardening Windows 7/8/10'''
−
:::*SELinux
 
−
:::*Sudo
 
−
:::*Cron Jobs
 
−
:::*Turning Off Xwindows
 
−
 
 
−
:'''Hardening Windows 2003 Server:'''
 
 
::*Installing and Configuring Security Configuration Wizard
 
::*Installing and Configuring Security Configuration Wizard
 
::*Using New Technology File System (NTSF)
 
::*Using New Technology File System (NTSF)
 
::*Configuring Automatic Updates
 
::*Configuring Automatic Updates
 +
 +
:'''Test #1: Details, March 6th'''
 +
::# Quiz 2 (February  22)
 +
  
 
|
 
|
Line 278: Line 294:
  
 
:'''Slides (Concepts):'''
 
:'''Slides (Concepts):'''
−
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w4_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w4_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w4_l1.ppt ppt] ] Linux Hardening (part 2)
 
  
−
:'''YouTube Videos:'''
+
::*[ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.odp odp] ] [  [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.ppt ppt] ] Hardening - Basic Concepts
−
::*[http://www.youtube.com/watch?v=6piQXXHTmqk ACLs]
+
::* [ [http://cs.senecac.on.ca/~fac/sec520/labs/sec520_lab5.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/labs/sec520_lab5.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/labs/sec520_lab5.pptx pptx] ] Hardening Windows
−
::*[http://www.youtube.com/watch?v=fpXuWhshKVA SELinux]
 
−
::*[http://www.youtube.com/watch?v=imnEUvvDxc4 Sudo]
 
−
::*[http://www.youtube.com/watch?v=4Icg3MYZZqI Cron Jobs]
 
  
 
:'''Reading References:'''
 
:'''Reading References:'''
−
::*[http://lcweb.senecac.on.ca:2063/0596003919 Linux Security Cookbook]<br />(Chapter 5 - Pages: )
+
::*[https://www.sans.org/media/score/checklists/ID-Windows.pdf Intrusion Discovery - Windows]
−
::*[http://lcweb.senecac.on.ca:2063/0131963694?uicode=seneca SELinux by Example]<br />(Chapter x - Pages: )
+
::* [http://lcweb.senecac.on.ca:2052/toc.aspx?site=RYW9D&bookid=12602 Hardening Windows, 2nd Edition]<br />(Chapter 5 - Pages: )
 +
::* [http://old.honeynet.org/papers/enemy/ "Know Your Enemy: The Script Kiddie"]
 +
 
 +
:'''YouTube Videos:'''
 +
::*[]
  
 
:'''Resources:'''
 
:'''Resources:'''
−
::* [http://www.linuxquestions.org/linux/answers/security/acls_extended_filepermissions How to Use ACLs]
+
::*
−
::* SELinux
+
 
−
::* [http://www.sudo.ws/sudo/intro.html Sudo In a Nutshell]
+
 
 +
|
 +
 
 +
 
 +
 
 +
 
 +
 
 +
:'''Assignment #1:'''
 +
::* Assignment Instructions (N/A)
 +
::Continue working on '''Lab 4''' and install Webgoat
 +
 
 +
 
 +
|- valign="top"
 +
|
 +
  
 +
:'''Week 7'''
  
  
 +
|
  
−
:'''Slides (Concepts):'''
 
−
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w8_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w8_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w8_l1.ppt ppt] ]  Hardening Windows
 
  
−
:'''Reading References:'''
+
:'''Midterm (Test #1 March 6th):'''
−
::* [http://lcweb.senecac.on.ca:2052/toc.aspx?site=RYW9D&bookid=12602 Hardening Windows, 2nd Edition]<br />(Chapter 5 - Pages: )
+
::*(Check course announcements for test details)
  
−
:'''YouTube Videos:'''
 
−
::*[http://www.youtube.com/watch?v=df1_yx2fa8g Security Configuration Wizard 2003]
 
  
−
:'''Resources:'''
 
−
::*
 
 
|
 
|
  
−
:'''Lab 5:'''
 
−
::System Hardening
 
−
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_5.html Linux System Hardening (part 2)]
 
  
  
−
:'''Lab 7:'''
 
−
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_7.html Hardening Windows 2003 Server]
 
  
 +
|
 +
 +
 +
:'''Additional Tasks:'''
 +
:'''Lab 5:'''
 +
::*'''Hardening Windows 7/8/10'''
 +
::Work on '''Assignment #1'''
  
−
:'''Assignment #1 Due'''
+
|- valign="center"
 +
!colspan="4"|<br />'''Study Week'''
  
  
Line 326: Line 355:
 
|
 
|
  
−
+
 
−
:'''Week 9'''
+
:'''Week 8'''
 +
 
 +
 
 
|
 
|
  
  
−
:'''Types of Attacks:'''
+
:'''Types of Penetration Testing'''
−
::*Client-side Attacks
+
::*Network
−
:::*Phishing
+
::*Access Control
−
:::*Webbrowser - Malicious Payloads
+
::*Infrastructure / Patching
−
:::*IP Spoofing (Man in the Middle) / Password
+
::*Physical/Building Security
−
::*Server-side Attacks
+
::*Social Engineering
−
:::*Out-dated Software Patches
+
 
−
:::*Database Injection
+
|
−
:::*Password Cracking
 
  
  
 +
:'''Slides (Concepts): See Blackboard'''
  
−
:'''Intrusion Detection:'''
 
−
::*Purpose
 
−
::*Logs
 
−
::*Monitoring
 
−
::*Iptables
 
−
::*Using Tripwire
 
  
  
Line 355: Line 380:
  
  
−
:'''Slides (Concepts):'''
+
:'''Lab 6:'''
−
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.ppt ppt] ]  Types of Attacks
+
::Work on vulnerable Windows 7 VM CTF
 +
 
 +
 
 +
 
  
−
:'''YouTube Videos:'''
 
−
::*[http://www.youtube.com/watch?v=ZUygX8TBBw0 Phishing]
 
−
::*[http://www.youtube.com/watch?v=PqfZM3Lxrmg Malicious Payload]
 
−
::*[http://www.youtube.com/watch?v=-hd7XG-b6uk IP Spoofing]
 
−
::*[http://www.youtube.com/watch?v=AhTfo6pWBIM Database Injection]
 
−
::*[http://www.youtube.com/watch?v=Iyh_w0Ix2bc Password Cracking]
 
  
−
:'''Reading References:'''
+
:'''Assignment #1 Due'''
−
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=89542&recCount=50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)]<br />(Chapters 4,5,6)
 
  
−
:'''Resources:'''
 
  
−
::*[http://atlas.arbor.net/ ATLAS Web-page] (Active Threat Level Analysis System)
+
|- valign="top"
−
::*[http://www.sans.org/top-cyber-security-risks/summary.php Top Security Risks 2009 (SANS Institute)]
+
|
  
 +
 +
:'''Week 9'''
 +
|
  
  
−
:'''Slides (Concepts):'''
+
:'''Passwords, Pwn'ing, & Pillaging'''
−
::*[ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w9_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w9_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w9_l1.ppt ppt] ]  Intrusion Detection / Using Tripwire
 
  
−
:'''Reading References:'''
 
−
::*[http://www.sans.org/score/checklists/ID_Linux.pdf Intrusion Discovery - Linux]
 
  
−
::*[http://lcweb.senecac.on.ca:2063/0596003919 Linux Security Cookbook]<br />(Chapter 1 - Pages: )
 
  
−
:'''YouTube Videos:'''
 
−
::*[http://www.youtube.com/watch?v=kUdCsZpt2ew Iptables]
 
  
−
:'''Additional Resources (for interest):'''
 
−
::*[http://www.sans.org/score/checklists/ID_Windows.pdf Intrusion Discovery - Windows]
 
 
|
 
|
  
  
−
:'''Lab 6:'''
+
:'''Slides (Concepts): See Blackboard'''
−
:Attack Categories:
+
 
−
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_6.html Types of Attacks]
+
 
  
  
−
<div class="messagebox" style="background-color: #f9f6b7; border: 1px solid #c4c295; color: black; padding: 5px; margin: 1ex 0; min-height: 35px; margin-left:15px; margin-right:10px; padding-left: 20px;">
 
−
<div style="float: left; margin-left: -40px;"></div>
 
−
<div><b>WARNINGS!</b><br /><ol><li>'''Scanning ports must require the permission of Server Owner''' (preferably in writing). Student must either work in Security lab to scan each others' ports, or sign an agreement to scan the Tank server within or outside Seneca College.<br /><br /><li>'''Your instructor will hand-out permission forms to allow students to obtain Tank accounts, and allow students to perform ethical "penetration testing" on that server'''. Students <b><u>must</u></b> sign this form, hand back to the instructor, and await further instructions before proceeding with penetration testing on the tank server</li></ol></div>
 
−
</div>
 
  
  
 +
|
  
−
:'''Lab 8:'''
+
:'''Lab 7:'''
−
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_8.html Intrusion Detection]
+
::Continue to work on vulnerable Windows 7 VM CTF
  
  
−
:'''Assignment #2 Posted:'''
 
−
::*Details - N/A
 
  
 
|- valign="top"
 
|- valign="top"
Line 417: Line 427:
  
  
−
:'''Additional Considerations:'''
+
:'''Metasploit and Metasploitable 2'''
−
::*Decoys: Honey-Pots
+
 
−
::*DMZs
+
 
−
::*Disaster Recovery
+
 
−
::*The BIGGER Picture
 
 
|
 
|
  
  
−
:'''Slides:'''
 
−
::* <div style="background:#ffff00">[odp] [pdf] [ppt] Additional Considerations</div>
 
  
−
:'''Reading References:'''
 
−
::*
 
  
−
:'''YouTube Videos:'''
 
−
::*
 
  
−
:'''Resources:'''
+
 
−
::*
 
 
|
 
|
  
 +
 +
:'''Labs:'''
  
  
Line 444: Line 448:
 
|
 
|
 
:'''Week 11'''
 
:'''Week 11'''
−
 
  
 
|
 
|
  
−
 
−
:'''Test #2:'''
 
−
::*Test Details
 
  
  
Line 459: Line 459:
  
  
−
<!-- * SELinux and httpd -->
 
 
|
 
|
 +
 +
 +
 +
:'''Lab 8:'''
  
  
Line 471: Line 474:
  
  
−
:'''Assignment #2 Evaluation:'''
+
:'''Work on Assignment #2'''
−
::*Presentations
+
::*Complete Report
−
::*Evaluate Secured System
+
 
 
|
 
|
  

Latest revision as of 14:57, 21 July 2023


SEC520 Weekly Schedule

Winter 2018

Instructor:
Austin (SAA)
Craig Barretto (craig.barretto@senecacollege.ca)

1 credit

  • Quiz and Labs ( 4 Quiz, 7 Labs (15%))
Logbooks due April 10th, 2018
  • Assignments (2) 20%
Assignment 1 - Due Date March 9'
Assignment 2 - Due Date TBA'
  • Tests (2) 30%
Written Test - March 8'
Lab Test - March 15
  • Final Test 35%
Week
Objectives and Tasks
Course Notes / Assigned Reading
Labs


Week 1


Course Introduction:
  • SEC520 WIKI
  • Course Outline
  • Course Policies
  • Required Materials
  • Lab Setup


Slides (Concepts):
  • [ odp ] [ pdf ] [ ppt ] Course Intro / The "Security Mind"


Reading References:


Resources:
  • Required Materials are listed in your Supplies Checklist. Other materials and references are noted week by week.


Lab 1:
Set-Up for Labs:



Week 2


Developing a "Security Mind":
  • 4 Virtues of Internet Security
  • 8 Rules of Internet Security
  • Penetration Testing:
  • Reconnaissance:
  • Information Gathering
  • Foot-printing
  • User Information
  • Verification


Slides (Concepts):
  • [ odp ] [ pdf ] [ ppt ] Penetration Testing: Reconnaissance
Reading References:
YouTube Videos:



Lab 2:
Pentration Testing:



Week 3


Scanning, Enumeration, & Vulnerability Testing:
  • Penetration Testing (Continued):
  • Scanning
  • Enumeration
  • Vulnerability Testing


Slides (Concepts):
  • [ odp ] [ pdf ] [ ppt ] Scanning & Enumeration


Reading References:
YouTube Videos:
Resources:



Lab 3:
Penetration Testing / Continued:




Week 4


Scanning, Enumeration, & Vulnerability Testing:
  • Vulnerability Testing


Slides (Concepts):
  • [ odp ] [ pdf ] [ ppt ] Vulnerability Testing


Reading References:
YouTube Videos:
Resources:



Lab 3:
Continue Working on Lab 3



Week 5


Types of Attacks:
  • Client-side Attacks
  • Phishing
  • Webbrowser - Malicious Payloads
  • IP Spoofing (Man in the Middle) / Password
  • Server-side Attacks
  • Out-dated Software Patches
  • Database Injection
  • Password Cracking


Slides (Concepts):
YouTube Videos:
Reading References:
Resources:


Lab 4:
Attack Categories:


WARNINGS!
  1. Scanning ports must require the permission of Server Owner (preferably in writing). Student must either work in Security lab to scan each others' ports, or sign an agreement to scan any server.



Week 6

More on mysql injection and Webgoat


Moved until after the break

Hardening Windows 7/8/10
  • Installing and Configuring Security Configuration Wizard
  • Using New Technology File System (NTSF)
  • Configuring Automatic Updates
Test #1: Details, March 6th
  1. Quiz 2 (February 22)


Slides (Concepts):
Reading References:
YouTube Videos:
  • []
Resources:




Assignment #1:
  • Assignment Instructions (N/A)
Continue working on Lab 4 and install Webgoat



Week 7


Midterm (Test #1 March 6th):
  • (Check course announcements for test details)




Additional Tasks:
Lab 5:
  • Hardening Windows 7/8/10
Work on Assignment #1

Study Week



Week 8


Types of Penetration Testing
  • Network
  • Access Control
  • Infrastructure / Patching
  • Physical/Building Security
  • Social Engineering


Slides (Concepts): See Blackboard


Lab 6:
Work on vulnerable Windows 7 VM CTF



Assignment #1 Due



Week 9


Passwords, Pwn'ing, & Pillaging


Slides (Concepts): See Blackboard
Lab 7:
Continue to work on vulnerable Windows 7 VM CTF


Week 10


Metasploit and Metasploitable 2





Labs:


Week 11





Lab 8:


Week 12


Work on Assignment #2
  • Complete Report
Assignment #2 Due:



Week 13


Final Exam Review
  • Details



Exam Week - TBA
Retrieved from "https://wiki.cdot.senecapolytechnic.ca/w/index.php?title=SEC520_Weekly_Schedule&oldid=160563"