The IT security Summer School united the best students from Blekinge Institute of Technology (Karlskrona, Sweden), Wroclaw University of Technology (Wroclaw, Poland), Lviv Polytechnic National University (Lviv, Ukraine), Kharkiv National University of Radio Electronics (Kharkiv, Ukraine), State University of Telecommunication (Kiev, Ukraine) on the basis of Lviv Polytechnic National University (Lviv, Ukraine).
The students arrived to Lviv on weekend when they had possibility to enjoy jazz at Alfa Jazz Fest. These evenings were full of new impressions for students. Lviv is especial city that cherishes Ukrainian traditions and customs. It allowed to summer school students from other countries to become acquainted with country atmosphere. The Premier Hotel “Dnister” was chosen for summer school participants. The hotel is located in the heart of Old Town and very close to Lviv Polytechnic National University. Comfortable hotel rooms for students and teachers allowed to relax after lectures and trainings. The official part of Summer School started on Monday, 27th of June. Anders Carlsson (Blekinge Institute of Technology, Karlskrona, Sweden), Oksana Yevsieieva (Kharkiv National University of Radio Electronics, Ukraine) and Yuriy Lakh (Lviv Polytechnic National University, Ukraine) had a welcome speech to students.
After that the first course “Advanced Network & Cloud security” started. Prof. Kurt Tutschku (Blekinge Institute of Technology, Karlskrona, Sweden) and Oksana Yevsieieva prepared for student interesting and actual lectures and training about Internet of Things, Cloud Computing and Software-Defined Networking paradigm.
All the courses of the Summer School belong to a set of ENGENSEC double Diploma courses that were developed by ENGENSEC partners. They are addressing to current security IT challenges, identified by academia and industry.
The course “Malware analysis” was presented by Aleksandr Adamov (Kharkiv National University of Radio Electronics, Kharkiv, Ukraine), “Secure software development” was presented by Tomasz Surmacz (Wroclaw University of Technology, Wroclaw, Poland), “Web security” was presented by Iryna Sokolianska (Blekinge Institute of Technology, Karlskrona, Sweden) and Sergei Syroezhkin (Kaliningrad State Technical University, Kaliningrad, Russia), “Pentesting and Ethical Hacking” was presented by Andrian Piskozub (Lviv Polytechnic National University, Lviv, Ukraine).
First course “Advanced Network & Cloud security” started on 28 June. Kurt Tutschku (Blekinge Institute of Technology, Karlskrona, Sweden) and Oksana Yevsieieva (Kharkiv National University of Radio Electronics) prepared for student interesting and actual lectures and training about Internet of Things, Cloud Computing and Software-Defined Networking paradigm.
During first two days – 27 and 28 June – students of IT Security Summer School had possibility to dip into Advanced Network and Cloud Security course. The course was lectured by Professor Kurt Tutschku. Thanks to his rich experience in telecommunication industry and educating area Kurt’s lectures were spellbinding. Professor Tutschku pointed at actual network and cloud issues, which are important for IT Security. If we know that should be protected we can protect it much better! Clear understanding of network and cloud architecture is necessary condition for success in Network and Cloud Security. Prof. Kurt Tutschku highlighted following issues:
– main trends and changes in Internet and concept of Future Internet;
– Software Defined Networks and OpenFlow protocol as basis for such networks;
– Virtualization and its role in networks and clouds, different virtualization techniques and their performance, Network Functions Virtualization;
– OpenStack Architecture and OpenClouds;
– Open vSwitch as part of SDN and cloud architecture;
– Security issues in SDN and in clouds.
We thank Kurt for the extremely useful time!
Last two days before the weekend ( 30th of June -1th of Jule) were devoted to “Secure Software Development” course. Tomasz Surmacz from Wroclaw University of Technology (Poland) taught our students the methodologies of proper software development, including assertion-based programming and test-driven development. Typical problems such as buffer overflows have been also presented and explained.
In practical part students got tasks to reverse-engineer the program which was given only in the binary form. This required some basic-level understanding of computer systems architecture and representation of data in memory. It helped students to analyze a various programs at run-time.
This knowledge can be also used in malware analysis and to improve programming skills.
Alexander Adamov from Kharkiv National University of Radio Electronics narrated about phishing, targeted attacks and reverse engineering techniques on June 29-30 during the course “Malware Analysis” .
During these days students had a chance to analyze a phishing attacks, classify malware, and even create their own signatures to detect test virus files with Yara. At the end of the training, Alexander demonstrated a few examples of reversing crypto lockers, which have been rising in popularity during the last years due to usage of the Tor network and Bitcoins to pay a ransom.
The course “Web Security” took place on 4-5 July. The course teachers are Iryna Sokolianska (Blekinge Institute of Technology, Karlskrona, Sweden) and Sergei Syroezhkin (Kaliningrad State Technical University, Kaliningrad, Russia). The course was devoted to analysis of current statement and challenges of modern Web applications. The scope of vulnerabilities treats and attacks to Web application were analyzed. Summer school students focused on such core security problem of web applications as different types of injection, cross site scripting, password hijacking. The participants discussed the defense mechanisms of applications implement.
Students got acquainted with the famous projects and companies in Web security area. The main security vectors and priorities of these organizations were observed. Students focused on the following items:
– Classification of attacks on different versions of the leading organizations in the field of Web security and ways to mitigation the impact of the attacks;
– Secure web application and audit of web applications.
The students investigated the most popular types of attacks between hackers. These types of attacks are connecting with different types of vulnerabilities: sql injections, XSS, CSRF. There was a learning practice on the attack’s anatomy and methods that can block the attacks.
The course “Digital Forensic” took place on 5-6 July. The course teacher is Anders Carlsson (Blekinge Institute of Technology, Karlskrona, Sweden). Digital forensics is the process of uncovering and interpreting electronic data. The goal of the process is to preserve any evidence in its most original form while performing a structured investigation by collecting, identifying and validating the digital information for the purpose of reconstructing past events. Students have learned advanced file systems structure, the methodology and sequence steps to perform forensic analysis.
Anders Carlsson prepared for students interesting “Challenge”. The main goal of challenge is to analyze compromised Web server, used autopsy tools.
Students looked for next scenario: a Linux server was possibly compromised and a forensic analysis is required in order to understand what really happened. Hard disk dumps and memory snapshots of the machine are provided in order to solve the challenge. Students proposed their own solutions, the students from BTH were more close to the right answers.
The course “Pentesting and ethical hacking” took place on 7-8 July. The course teacher is Andrian Piskozub (Lviv Polytechnic National University, Lviv, Ukraine). Students studied the principles and practice of ethical hacking. These items are important for the construction of secure computer systems.
Students focused on the ethical hacking concept, such penetration testing methodology as OSTMM, ISSAF, etc., hacking tools and applicable laws, dealing with third parties, social engineering issues, logging, reporting.
During the practice students used basic configuration of ethical hacker workplace and machine for hacking. Students dealt with Vulnerability Analysis (Types; Manual search and Automated search for vulnerabilities; Vulnerability Analysis tools), also Exploitation, Social engineering and Toolkit project, Exploitation using client-side attacks and Maintaining Access utilities.
A competition for student took place on the last day of IT Summer School in Lviv. The competition was organized by Andrian Piskozub form Lviv Polytechnic National University.
The main goal of competition is to find as much vulnerabilities as possible. The server with OWASP Security Shepherd was used for competition. The modules have been crafted to provide not only a challenge for a security novice, but security professionals as well.
Utilizing the OWASP top ten as a challenge test (top ten vulnerabilities) the student have explored their impact on a system understood. The by-product of this challenge game is the acquired skill to harden a player’s own environment from OWASP top ten security risks.
The score of all students was summarized in a special scoreboard. Students had a possibility to watch the real results of competition. The winners are: 1 place – Markus Erik Engqvist from Blekinge Institute of Technology, 2 place – Vitaliy from Lviv Polytechnic National University, 3 place – Artur Jan Zochniak from Wroclaw University of Technology.
Closing ceremony of ENGENSEC Lviv Summer School was on Friday, July 8. Anders Carlsson, general manager of the ENGENSEC project, and Yuri Lakh, web-security course developer and project coordinator of Lviv Polytechnic National University, congratulated students with successful completion of Summer school and thanked for their participation.
Students from each university participated in the final competition and obtained the official certificates. The certificates are an official confirmation of getting 3 ECTS after studying the ENGENSEC education programs.
Iryna Sokolianska, a member of the evaluation committee (BTH, Sweden), prepared a survey for students. She offered to students to leave feedback about each course of Summer School. Students did it with pleasure.
A gala dinner for students in the evening was great. Students exchanged their impressions with each other and said goodbye to everybody. Students became real friends during Summer School.
A lot of bright and interesting moments about Summer School will live in their hearts and memories!