Brief

Goal is to re-invigorate INST 365, Ethical Hacking, with the following characteristics:

Physical Hands-On based - probably Raspberry Pi, Laptop with VM Ware VM, and Kali Linux. Based in Tinkerspace in College Park; building out a comparable capability in Shady Grove.
Aligned with existing courses and pedagogy
1. of INST 346 (Technologies, Infrastructure, and Architecture, includes RaPi and networking gear) as prerequisite
2. INST 347 (Cloud Computing for Information Science, includes VMWare, Kali, and Arduino Cloud) as compatible elective
3. INST 388X (Internet of Things, includes Arduino Cloud) as compatible elective
4. Cybersecurity and Privacy Cognate Sequence: INST 364, 366, 464, 466, and 467.
Aligned with some external Certification Process (not necessarily earning the Certification in class)
Add a dimension to the Infosci Cybersecurity cognate that Dennis Frezzo, Donal Heidenblad, Charlie Harry, and many semesters of informal student feedback agree is missing.
Low or no cost to students

Example Course

Ethical Hacking (Circa 2021, not sure why this wasn’t offered as 365)

INST 408C

Course description:

Hacking is everywhere. Hacks can be anything from ways to make one’s life easier (“life hacks”) to malicious attacks on networks. The common thread in these hacks is that they involve generating non-obvious solutions to problems or using systems in ways that the designers did not intend. Ethical hacking, then, is using ethical judgment to bound what you can do rather than conforming to the limits of the system.

In this class, you will do small group projects to apply particular concepts in creative and flexible ways. The instructor must approve all hacks before they are executed. The structure of these group projects will follow agile methods, with sprints that occur over a period of approximately two weeks. Groups will be reassigned at the end of each sprint. This structure means that it is vital that you attend each class and participate in your group discussions. When time allows, the end of each class will be set aside for quick group standups. At the end of the semester, there will be a demo day in which students will present the best hacks they have executed.

Despite the similarity of the names, this class will not directly prepare you for the Certified Ethical Hacker exam, which is a penetration testing certification. Some of the concepts we will cover in class are on that exam, however, and some of the skills you learn in class will make it easier for you to prepare for the exam if you choose to.

Learning objectives

Upon completion of this course, students should be able to:

Plan and execute a non-obvious solution to a problem (“a hack”)
Distinguish among hacking, malicious hacking, and ethical hacking
Generate a list of ethical concerns that could arise from a proposed hack
Use an Agile structure to perform group tasks
Perform the steps of a basic penetration test
Explain how a given network operates as a sociotechnical system

Grade composition

15% Online discussion

I will assign discussion questions and short assignments to be completed online. For discussion questions, you are expected to answer the question and provide a response to another student’s answer.

15% In-class participation
I expect you to come to class and participate in discussions.

20% Group participation and contribution

You will work on your projects in groups, and those groups will change with each new project assignment. You will evaluate your peers’ performance and they will evaluate your performance.

30% Sprint hacks

Evaluation of hacks produced during sprints will come from three sources: The instructor, the class, and the other members of your team. Your team will present your hack or documentation of your hack to the class at the end of each sprint.

10% Demo day hacks
Each person will be involved in the presentation of at least one hack at the demo day.

10% Final exam

The final exam for this course will be a structured demonstration of the concepts you have learned over the course of the semester. It will be due at the time of the scheduled final exam.

Academic Integrity and Ethical Conduct

The general policy of this course on academic integrity will follow the UMD Honor Code. For specific assignments, however, alternative requirements may apply as noted in the assignment.

Any hack performed for this class must not break the law, hurt another human being, or damage a system that you do not own. The ethical concerns for any hack you propose are as important and the technical or sociotechnical execution.

Proposed course schedule

Week/Topic

Ethics and hacking
Hacking as creativity
Command line tools
History of hacking
Hacking information search
Malicious hacking
Computer networks
Security threats
Network scanning
Sociotechnical networks
Vulnerability research
Hacking for social good
Penetration testing
Student-chosen topics
Student-chosen topics

final Demo day

Activities Discussion 1 Sprint 1 Sprint 1 Discussion 2 Sprint 2 Sprint 2 Discussion 3 Sprint 3 Sprint 3 Discussion 4 Sprint 4 Sprint 4 Discussion 5 Sprint 5 Sprint 5

Possible Cyberrange Options

Compare and contrast small cyber-range technologies we might host versus external cloud-based cyber-range technologies we might pay for to increase iSchool student access to other modalities of learning technical basics of cybersecurity.