Educational Security Assessment project for Northern Virginia Community College students.

From: Djiali (djiali_at_speakeasy.net)
Date: 01/24/05

  • Next message: contact_at_parosproxy.org: "Paros 3.2.0 beta release" 
    Date: Mon, 24 Jan 2005 06:29:32 -0500
To: pen-test@securityfocus.com

    Good morning list,
    I'm a student enrolled in the Information Systems Security Certification
    program offered at Northern Virginia Community College. This
    certification is considered a specialization for students who already
    have a degree in a network related field and have completed the course
    load required for the InfoSec certification. The final course is an
    independent study supervised by the most senior InfoSec faculty member.
    The goal of this course is to offer students real world experience in
    conducting a security assessment on a real company. The whole course is
    structured to protect both the company and students from any
    harm...we've had to sign an ethics contract with the college, and we
    will have to enter into a contractual agreement with the company we
    would be working with.
    As the team leader, I've decided to proceed using the OSSTMM methodology
    for Information Systems (we're not going to try any war dialing, site
    surveys, or try to enter the company's physical location). From our
    side, we're going to conduct the port scanning, enumeration, and web
    application testing on the live systems, but then take the "proof of
    findings" stage into our test lab where we'll replicate the company's
    production environment and attempt to exploit any holes we find. No harm
    will be done to your production systems.
    Now for the dilemma part. As you can imagine, it's been a little hard
    for us to find someone to work with...companys would rather leave their
    holes undiscovered then have some students do identify them for free!! I
    can't say that I blame them entirely...I don't know what I would do if
    the tables were turned. This is why I'm turning to the list...I'm hoping
    that if we can discuss the project with security folks who understand
    what we're trying to do, we'd have better luck.
    In any event, if you think that you might help out a group of students
    trying to break into the InfoSec world, please email me directly, I have
    some preliminary project plans, the course syllabus which outlines
    everything, and of course, the contact information for our professor if
    you wish to contact him for validation.
    Thanks!!
    Wade

  • Next message: contact_at_parosproxy.org: "Paros 3.2.0 beta release"

    Relevant Pages

    • Re: Loose Cannon-dian
      ... with the same logic we could abolish exams for students. ... legitimate reason for security standards and certification. ...
      (comp.os.vms)
    • What is the best professional Canadian certification for IT Security specialists
      ... > Security Specialist certification program for a Canadian, ... > certification from such groups as the Certifiied Information Systems ... > I would like to learn more about SAP authorizations as part of my IT ...
      (comp.security.misc)
    • Re: The Hacker
      ... Legal flap over Defcon talk exposes divide on disclosing security flaws ... Gag order slapped on MIT students reignites debate on what 'responsible ...
      (uk.legal)
    • RE: Inculcating an interest in Security
      ... Creating interest depends on not just the subject matter alone; ... you don't necessarily have to publish/present a techinical ... Inculcating an interest in Security ... change in attitude in my fellow students. ...
      (Security-Basics)
    • Security Experts: University Shootings Like VA Tech Massacre Arent Totally Preventable
      ... Security Experts: University Shootings Like Virginia Tech Massacre Aren't ... The unprecedented school massacre at Virginia Tech has underscored one ... education about safety procedures for students, ... Harris said that she has 58 sworn officers - meaning all are trained as ...
      (alt.politics)
    • Quantcast