By Dr. Keith Morneau, Dean of Computer & Information Science, ECPI University
Network security has become one of the world’s biggest threats, from the Equifax data breach, the ransomware attacks on European governments and hospitals to everyday attempts to block access or damage records of individual citizens, as well as corporations. Our internet infrastructure is under constant attack. Anyone who enters into the field of Networking, Cloud Computing or Network Security has to be prepared not only to defend against tactics being used now, but what hackers can use in the future. Toward that end, the ECPI University’s Charlotte campus is undertaking a multi-pronged approach to give students and the community real-life challenges and the experience to be defenders of our internet infrastructure.
In 2016, the Charlotte campus first began its effort to increase students’ exposure to simulated threats in a live environment. By engaging our Network Security club, Mr. James Clapp developed a live hacker event in April 2016. Several of our network security club members participated in defending their server from Mr. Clapp’s attacks on their system. In this exercise, the instructor attempted a variety of live attacks, utilizing both hardware vulnerabilities and software tools. The students successfully defended against our instructor posing as a Black Hat Hacker and protected the data. This was the first of many exercises like this.
The following month, the campus hosted an additional challenge, with a greater level of difficulty. After educating students that networks can be vulnerable not only through the networking and server vulnerabilities, another area was added—the poorly secured add-on device. Known in the field as “The Internet of Things”, many networks are well secured from access through the internet, routers or servers, but many network vulnerabilities in the near future will be exploited because of under-defended devices, like printers, wireless tablets, phones, payment kiosks, and even wi-fi appliances and other connected devices. In this simulation, the students were given a network to defend that included a poorly secured traffic light. This added another additional layer of complexity and helped students understand the vulnerabilities of networked devices.
Just two weeks later, our Network Security club applied its accumulated skills and competed in a local Capture the Flag event, with the prize of a Security + Certification manual. The stakes were high for Yacob Yirgahaminot, John Marsalis, Terrell Cherry, and Braxton Hubert to protect their servers while trying to exploit vulnerabilities in the other participants’ servers. This tested their skills, and helped them develop multitasking abilities, while learning what a live attack looked like from both the defensive and offensive positions.
These events were a starting point for the campus’ pursuit of greater and more complex challenges for its CIS students, but also an impetus to provide more knowledge in the community of the vulnerabilities of internet infrastructures. The campus’ next event was created to help the local community better understand network security. This past spring, the Charlotte campus hosted students from Olympic High School, and created a Capture the Flag event for their students. They were challenged to find files spread throughout the “globe” and use those files to open additional challenges. Each one completed had a point value, so students could choose to pursue a more difficult, high-point-value challenge, or complete a number of lower-valued challenges to amass points. The four teams were very competitive, and attempted challenges from cloud computing areas and electronic engineering, as well as cyber security hacking. They were also exposed to Kali Linux and Netcat software to read an FTP banner to find resources outside of the network.
Internet infrastructures are under constant attack from all sides, and this will only increase. ECPI University’s Charlotte campus’ commitment to help its students and the community become soldiers to defend our personal and corporate data will only grow as it continues to push students to face real-world problems and devise real-world solutions in live simulations. The growth of the dedicated CyberDefense Lab will give the students a place to apply those skills immediately.