I am currently helping my teacher create a curriculum around IT Security because it isn't currently implemented. Some previous question had decent responses but I was wondering if there was more. My goal is by the end of the class we can set up a server and have a Red vs. Blue competition to see which team can defend and attack the best. I've looked into Damn Vulnerable Linux and found it might be useful however I'm very sure there are some better resources out there. Has anyone found some?


  • What is your timeline? I am working on a VM image for precisely this, should be ready in a month or two.
    – lynks
    Mar 26 '13 at 17:53
  • What do you mean by timeline? If you mean if I can wait a month or two I can defiantly do that. We are planning on implementing this in a few weeks but that will be a hybrid marking period. The full blown marking period will be the first period of next year. Mar 27 '13 at 15:09
  • I will comment on here with a link to my VM when complete, whether you're still interested or not :P
    – lynks
    Mar 27 '13 at 15:14
  • Sweet! We can be the first people to test it and we'll tell you how we like it. If it's great we'll implement it. Considering how powerful my teacher is in the computer science world it may even be implemented else where so if you do a good job we'll make sure it spreads. Mar 27 '13 at 15:17
  • That sounds great! Looks like I'd better hurry up and finish it :)
    – lynks
    Mar 27 '13 at 15:34

Have you looked into the CyberPatriot program? http://www.uscyberpatriot.org/Pages/default.aspx It's a "secure the platform" high school competition that focuses on defense instead of offense. It's all set up and ready for schools to get involved.

For training, they provide virtual machine images that students can learn on and practice securing. The installations are full of known exploitable flaws, with default passwords, open ports, inappropriate ACLs, guest accounts, extra services, unpatched web servers, all that kind of stuff. Offense takes place from a black box service that attempts to exploit the system, and provides a score to tell you that you secured 15 out of 80 known holes (or whatever).

For the contest, they provide encrypted virtual machine images that you download in advance. At the start of the contest, the teams are given the decryption keys, and then have a set amount of time to secure as many problems as they can find before the scoring agent is set upon them. The different stages of the contest have increasingly difficult tasks: round one might be to secure a Windows XP box, the next to secure a Windows 2008 server, and the final might be to secure a Linux/Windows network consisting of three servers. The competition is nationwide, with the final qualifying teams getting to travel to the national competition.

The black box attacker approach puts the emphasis on defense, and keeps the contest focused on practical application of the knowledge, rather than being a training ground for hacking. You still need to know what a SQL injection attack is, and how it works, but you don't have to practice them, and your team gets no points for being good at them.

It's already over for the 2012-2013 school year, but you can preregister a team or a school for next year.


I have tried to do a quick google search for you. This is what i was able to find

SEED PROJECT Developing Instructional Laboratories for Computer SEcurity EDucation

People learn from mistakes. In security education, we study mistakes that lead to software vulnerabilities. Studying mistakes from the past not only help students understand why systems are vulnerable, why a "seemly-benign" mistake can turn into a disaster, and why many security mechanisms are needed. More importantly, it also helps students learn the common patterns of vulnerabilities, so they can avoid making similar mistakes in the future. Moreover, using vulnerabilities as case studies, students can learn the principles of secure design, secure programming, and security testing.

  • Sorry. If I could choose two answers I would but I just realize John answered first with a good answer. :( Wish I could choose 2. Mar 27 '13 at 15:43

Is this a high school or college environment? Many universities with Established computer science or security/forensics programs may have publicly posted their labs and lectures. In addition, some individual professors or universities may be very willing to build relationships and share their materials. They might even provide instructor guides directly to your professor or teacher.

There are a lot of fundamentals and courses to get to the point where you can actually do an offensive/defensive scenario. If you are trying to have this done between now (End of March) and the end of the school year (between May and June) that might not be a sufficient time frame, especially if people in the class are not already proficient with network tools, programming, etc.

A few good searches you can start with and vary would be:

  • network security lab site:.edu
  • network security lecture notes site:.edu

Check out the universities you find and try to connect with the various professors or labs and see what they will be willing to share or provide. It may also work out well for them as a recruiting tool into their program, which is good for them if they can get people they know are interested.

  • A highschool environment. Mar 26 '13 at 21:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.