Vol. 2 Issue 3
Editorial
This issue is slightly different than normal. The papers have been selected from those submitted to the Third World Information Security Education Conference held at the Naval Postgraduate School , Monterey , California in late June, 2003. The papers were chosen by the conference organisers – Cynthia Irvine ( Naval Postgraduate School , Monterey , California ) and Helen Armstrong ( Curtin University , Western Australia ), and were re-written for the journal. The theme for this edition of JIW is Information Security Education.
Also two papers that should have been included in the last issue are in this edition, one by Yek and Valli, and another by Belsis et al.
The opinion paper is by Thomas on US Information Warfare theory.
Finally, I would like to welcome Professor Daniel Kuehl of the National Defense University, Washington, onto our esteemed Advisory Board.
I would also like to thank all the authors for their contribution and encourage you all to keep on submitting your papers.
William Hutchinson
August, 2003
Table Of Contents
| Information Security Education Theme Papers |
Paper 1: Teaching Competitive Intelligence and Cyberwarfare in a Business Context
H.L. Armstrong, J. Davey |
| Paper 2: Teaching Hands-On Network Security: Testbeds and Live ExercisesG. Vigna |
| Paper 3: Certification and Accreditation: A Program for Practitioner Education
K.L. Burke, C.W. Rasmussen, C.E. Irvine, G.W. Dinolt, T.E. Levin |
| Paper 4: Security Dimension of IT in Developing Countries: Risks and Challenges
R. Casmir, L. Yngstrom |
| Paper 5: Enhancing Information Warfare Education Through the Use of Virtual and Isolated Networks
D.J. Ragsdale , S.D.Lathrop, R.C. Dodge |
| Paper 6: Design and Implementation of an Information Security Laboratory
V. Padman, N. Memon, P. Frankl, G. Naumovich |
| Paper 7: Teaching Coursework Master – Computer Forensics
C.J. Armstrong |
| Paper 8: A Tutoring System for IT Security Education
M. Schmitt, J. Hu, Ch. Meinel |
| Paper 9: Using Outcomes-based Assessment as an Assurance Tool for Assurance Education
S. Older, S Chin |
| General Papers |
| Paper 10: If You Go Down to the Internet Today – Deceptive Honeypots
S. Yek, C. Valli |
| Paper 11: Accessing Security Incident Information on the Internet
M.A. Belsis, A.N. Godwin, L. Smalov Paper 12: Is the IW Paradigm Outdated? A Discussion of U.S. IW Theory T.L. Thomas About the AuthorsColin J Armstrong is an associate lecturer with the Curtin University School of Information Systems, Western Australia, where he focuses on teaching. His research interests of information security, information warfare and computer forensics. Helen Armstrong is a Senior Lecturer within the School of Information systems at Curtin University , Perth Western Australia . Helen’s work experience includes accounting, programming, systems analysis, project management, IS management, IS auditing, IT consulting and university lecturing. Her interests in the area of security include computer crime, network security, Internet security, information warfare, biometrics and security management. Helen’s doctoral studies related to the security of medical informatics. Helen is the international chair of the IFIP WG11.8 on Information Security Education. Meletis Belsis has been a member of the DKERG research group for the last three years. His main research interests are concentrated on Information Security. Additional interests include internet technologies and database development. Meletis completed his Honours degree at Coventry University in the area of Computer Science in 1998. He continued for a two year Masters by Research degree in Information Systems. After finishing his Masters by Research, he started a PhD degree in the area of Information Security at Coventry University . The main area of interest in his current research is security modelling and the development of an Enterprise Security Model. Karen L. Burke is a Research Associate Professor in the Department of Computer Science at the Naval Postgraduate School . She has 16+ years as an information system security engineer with the US Air Force and in private industry. She has developed Information Assurance policies and guidance, has performed accreditations, and has been a team member on the development of multilevel secure systems. She is currently constructing courses and lectures in certification and accreditation. She is a member of the Armed Forces Communications and Electronics Association. Respickius Casmir is a PhD student at the Department of Computer and Systems Sciences (DSV). He started doing research in Information and Communication Systems Security field in 2001. He recently successfully defended his degree of Licentiate of Philosophy with specialization in IT Security Education. Respickius is also an employee of the University of Dar es Salaam in Tanzania . His other area of specialization is IT Security Management. Before switching to IT security career, he was working as a network engineer. Shiu-Kai Chin is a Professor in the Department of Electrical Engineering and Computer Science at Syracuse University and the Program Director of Computer Engineering. He is Director of the New York State Center of Advanced Technology in Computer Applications and Software Engineering (CASE). His research applies mathematical logic to the engineering of highly assured systems. He has worked closely with the Information Warfare Branch at the Information Directorate of the Air Force Research Lab in Rome , NY . Jack Davey is the Assistant Director, Defence Security Authority for the Australian Department of Defence in Canberra , Australia . Prior to joining the Department of Defence, Jack worked in electronic engineering and communications in the aviation industry. One of Jack’s current areas of responsibility is security education within defence and the training of cyberwarriors. Timothy E. Levin is an Associate Research Professor at the Naval Postgraduate School . He has spent over 17 years working in all aspects of secure computer systems research and development, including the design of security features and formal verification for A1 operating systems and relational database management systems. His current research interests include management and quantification of security in heterogeneous networks, data integrity in distributed systems, and the application of formal methods to secure computer systems. Mr. Levin is a member of the Association for Computing Machinery and International of Electrical and Electronics Engineers. Christoph Meinel studied Mathematics and Computer Science at the Humboldt-University in Berlin from 1974 to 1979. He received his PhD degree in 1981. From 1981 to 1991, he worked at the Department of Mathematics at the Humboldt University and at the Institute of Mathematics of the Academy of Sciences in Berlin as a scientific assistant. In 1988, he received his habilitation degree. In 1992, he became a full professor for computer science at the University of Trier . He is visiting professor at the Luxembourg International Advanced Studies in Information Technology as well as the graduate school of the computer sciences department of the Beijing University of Technology, China. Nasir Memon is an Associate Professor in the Computer Science Department at Polytechnic University , New York . He received his B.E. in Chemical Engineering and M.Sc. in Mathematics from the Birla Institute of Technology, Pilani , India and received his M.S. and Ph.D. degrees from the University of Nebraska , in Computer Science. He has held an assistant professor position at Arkansas State University and at Northern Illinois University . He was also a visiting faculty at Hewlett Packard Laboratories, Palo Alto , California in 1997-98. His research interests include Data Compression, Computer and Network Security, Multimedia Data Security and Multimedia Communications. Gleb Naumovich received a PhD in Computer Science from the University of Massachusetts , Amherst in 1999. His research interests are in the areas of software engineering, programming languages, application security, and intellectual property protection. His current work focuses on optimizing model checking tools for software. He also works on developing static techniques for detection of security bugs in distributed Java programs. Susan Older is an Associate Professor in the Department of Electrical Engineering and Computer Science at Syracuse University , as well as the Education Director for the Systems Assurance Institute. Her research interests include the semantics of programming languages, concurrency theory, logics of programs, formal methods, and their collective use to support reasoning about complex system behavior. Vikram Padman is a graduate student at Polytechnic University in Brooklyn , NY . He received his B.S. degree in Computer Engineering from Polytechnic University in 2002. His current research focuses on developing efficient host intrusion detection systems. Lt. Colonel Ragsdale , Ph.D., has served for over twenty-two years as an officer in the US Army. During this time he served in a variety of important operational, and research and development assignments. Currently he is an Associate Professor and Director of the Information Technology and Operations Center (ITOC) at the US Military Academy. His current research focuses on information security, Information Assurance (IA), and Information Warfare. He is a frequent speaker and panelist at national and international IA conferences and he has published dozens of papers and articles on IA topics. George W. Dinolt is an Associate Professor of Computer Science at the Naval Postgraduate School . Dr. Dinolt has 20+ years as a researcher and developer in the area of computer security in academia and in industry. His principal research focus is mathematical models of security. He has been a security architect on several projects and was part of a team that developed a very high assurance system for the US Department of Defense, where he also developed the mathematical models of security for the system. Major Ronald C. Dodge, Jr. is an Aviation officer in the US Army and is a member of the Army Acquisition Corps. His current assignment is Assistant Professor and Deputy Director of the Information Technology and Operations Center (ITOC) at the U.S. Military Academy. Throughout his service a the Military Academy he has been a forceful proponent of student-centered learning. His innovative research and teaching in Information Assurance and Cybersecurity have brought him national recognition. Phyllis G. Frankl is a Professor of Computer Science at Polytechnic University in Brooklyn , New York , USA and the Director of the Wireless Internet Center for Advanced Technology (WICAT). She received a B.A. degree in mathematics and physics from Brandeis University , an M.A. degree in mathematics from Columbia University , and M.S. and Ph.D. degrees in computer science from New York University ‘s Courant Institute of Mathematical Sciences. Prof. Frankl’s research interests include software engineering, wireless information systems and computer security. Ji Hu received his MS in computer science from the Beijing Polytechnic University . Since October 2001, he is a doctoral candidate at the Institute for Telematics/ Department of Computer Science, University of Trier , Germany . His research interests are information security and security education. Cynthia E. Irvine is an Associate Professor of Computer Science at the Naval Postgraduate School and Director of the Center for Information System Security Studies and Research (CISR). She has spent the past 15 years developing theoretical foundations, design, implementation, and analysis of high assurance secure systems. She has developed security aware applications for high assurance systems and contributed to the development of a Class A1 security kernel. She has authored over 70 papers in the area of trusted computing. Dr. Irvine is a senior member of the International of Electrical and Electronics Engineers, a member of the Association for Computing Machinery and serves on the Senior Advisory Board of the Association of Old Crows. Major Scott Lathrop was commissioned as an Armor officer in 1990 and is now serving as a Systems Automation officer in the US Army. His current assignment is Assistant Professor and Senior Research Scientist in the Information Technology and Operations Center (ITOC) at the United States Military Academy . Major Lathrop was the primary architect for the IWAR/VIAN Laboratory during the period in which this lab gained international notoriety. Without his dedicated efforts the VIAN concept, as it is described in this article, would not have been realized. Major Lathrop’s research interests include: information assurance and cyberwarfare. Craig W. Rasmussen is an Associate Professor in the Department of Applied Mathematics at the Naval Postgraduate School , where he has been since 1991. For most of the intervening years, his principal research interest has been graph theory. He has more recently developed a keen interest in applications of mathematics to information assurance and secure communications. He is a member of the Society for Industrial and Applied Mathematics, the American Mathematical Society, and the Mathematical Association of America. Michael Schmitt studied computer science with focus on computational linguistics at the University of Koblenz, Germany. From 1996 to 2001, he was a research assistant at the Institute for Telematics at the Medical University of Lübeck, Germany. In October 2001, he joined the Institute for Telematics in Trier . In April 2003, he passed his doctoral examination on automatic test generation based on formal specifications at the University of Göttingen . His current research activities focus on information security. Yek Suen is a research student within the School of Computer and Information Science at Edith Cowan University , Perth Western Australia . Suen holds a Bachelor of Science and a Bachelor of Business, and is currently undertaking research incorporating deceptive strategies used in wireless honeypots. Craig Valli is a computer security lecturer and researcher in the School of Computer and Information Science at Edith Cowan University . His research interests are in the areas of network security, defensive network deception, network intrusion detection, firewall, SOHO security and beowulf computer clustering. Craig consults to industry on network management and network security issues and holds several industry level networking certifications. Giovanni Vigna is an Assistant Professor in the Department of Computer Science at the University of California in Santa Barbara . His current research interests include network and computer security, intrusion detection, security of mobile code systems, penetration testing, and distributed systems. In particular, in the last years he worked on STAT, a framework for the modular development of intrusion detection systems. He also published a book on Security and Mobile Agents and he is the Program Chair of the International Symposium on Recent Advances in Intrusion Detection (RAID 2003). Giovanni Vigna received his M.S. with honors and Ph.D. from Politecnico di Milano , Italy , in 1994 and 1998, respectively. Louise Yngström has been engaged in research and education in IT security with her department since 1985. She is a pioneer in interdisciplinary holistic IT security education, Research interests, apart from security curricula and education, are security issues related to society and organisations. Previous research areas were IR- systems and computer aided instruction. She is a member of several IFIP (International Federation for Information Processing) working groups related to her interests and the Swedish national representative to IFIP TC 11. In her department, she is the director of SecLab and the director of PhD studies. |