Instruction Module:  Introduction to Information Assurance and Security Policies

The “Introduction to CyberCIEGE” movie describes risk management in terms of threats and vulnerabilities and potential impact of vulnerability mitigation decisions on enterprise productivity.  These concepts are then placed in the context of the game and the choices the player makes.

The "Stop Worms" scenario is an extremely simple scenario (a few minutes) that illustrates risks of email attachments and the need for risk management (i.e., you can’t just ban email attachments).  This scenario can be followed up with the “Life with Macros” scenario which introduces the use of technical mechanisms to aid in the protection of assets.  These scenarios also give the student a brief introduction to the game mechanics.

The “Security Policy” movie describes how computer systems can only be said to be secure with respect to some policy.  It then distinguishes between different modes of access and types of policies.  It briefly introduces differences between mandatory policies and discretionary policies.

The Introduction scenario walks the player through CyberCIEGE mechanics (e.g., buying computers and connecting them to networks), while illustrating selected vulnerabilities such as opening email attachments.  The scenario also highlights the need for user training and introduces physical security.

Instruction Module:  Identification and Authentication

The Passwords scenario illustrates the need for a suitable password policy.  It is a simple scenario that  includes guessable passwords, the need for user training, and use of mechanisms to enforce policies (e.g., automatic screen locks).

The "Down Time" scenario is a simple training and awareness scenario that illustrates potential pitfalls of using an Internet caf? by an industrial spy.

The “User Identification” scenario explores challenges associated with identifying users to computers.  This is the first substantive scenario that requires students to take a broader view of security policy enforcement.  The scenario illustrates the utility of authentication servers and requires the student to make a decision to enable individual accountability.  The latter 2 phases of this scenario begin to address access control, and are covered in the following instruction module.  [TBD: Move web server malware attack to after one-time password.]

Instruction Module:  Access Control and Malicious Software

The malicious software movie describes what malicious software is and how it works.  Discretionary access control enforcement mechanisms (i.e., ACLs) are introduced and the movie illustrates how malicious software can work around the mechanisms thereby defeating user intent.  The movie also illustrates how trap doors can subvert the intent of mandatory access control mechanisms.

The Final phases of the “User Identification” scenario illustrates use of ACL’s to limit the damage done by a rouge application and it includes an example of using a group policy to provide access to authorized users who lack individual system accounts.

The "Physical Security" scenario looks at access control in the context of physical security where some users are not necessarily authorized to view all information processed within a facility.  The scenario re-enforces the concept of security policies by encouraging the student to understand the value of different assets and the authorizations of different users.

Instruction Module:  Basic Network Security

The "Firewalls" movie provides a high level view of the functions of firewalls and intrusion detection mechanisms and it describes some of the limitations of each.  

The "Network Filters" movie describes the basic functions of network filters and illustrates their use within the CyberCIEGE game.

Instruction Module:  System Assurance, certification and accreditation

The assurance movie describes the need to support objective assessment of security policy enforcement mechanisms.  It describes the impact of complexity on the ability to achieve assurance and it illustrates how the amount of assurance needed for a system depends in part on the policies being enforced.

The Genes R Us scenario...

Instruction Module:  Applied Cryptography

The Encryption movie introduces the application of encryption to protect communications over networks.  It provides an overview of the use of encryption at different levels of a protocol stack.

The "Link Encryption" scenario requires the student to deploy simple link encryptors to protect traffic between two sites via a dedicated communications link.  The scenario includes a "key management" decision and illustrates the need to consider assurance when deploying cryptographic solutions.

Instruction Module:  Public Key Infrastructure and Identify Management  (often part of intermediate cyber security courses).

The "PKI" movie describes public key infrastructure use within a simple e-commerce example and illustrates potential pitfalls of PKI implementations.

The "Advanced VPNs" scenario is similar to the "Introductory VPNs" scenario except the student may choose to deploy either symmetric key or PKI based key management.  The scenario requires the student to make a choice related to cross certification and certificate policies to enable e commerce with a business partner.