Training Students in Penetration Testing (Dan Guido)

This is a presentation given by Dan Guido at SOURCE Boston 2009 which documents the lessons learned while teaching the Penetration Testing course at NYU:Poly. We've been posting a lot of videos from his course lately on SecurityTube and would like to thank him for making such excellent material available to everyone.

A small abstract about the video below in Dan's own words: "A course in Penetration Testing has existed at NYU:Poly as far back as 2002, in large part because of a NSA Center of Excellence in Education certification requirement. Professors for the course have come and gone and the course content has changed with them, sometimes for the better, but mostly for the worse <insert sad face/>. In the Summer of 2008, with no instructor in sight for the coming semester and the course material seriously neglected, I offered to teach it and rewrite it from scratch.

I had a vision for a student's course, a practical course, a course that would frighten the CS department. But writing a course is hard! And I didn't have practical experience in a few major topics I wanted to cover. Luckily, I have a few great friends that thought this would be a fun experiment. Less than a month before the class was scheduled to start Stephen Ridley, Dino Dai Zovi, Mike Zusman, Dean De Beer, Erik Cabetas and myself laid out the foundations for the course each taking one major topic for ourselves.

This could have easily turned into a disorganized trainwreck but I guess when you have rockstars like the guys above helping you out, it's hard for things to go wrong! We had close to 30 students in the Fall of 2008, all of whom said it was the best unversity course they had ever taken. Success!

After seeing my updates about the course on Twitter, Chris Eng convinced me to submit a CFP for SOURCE Boston about it. I was accepted and gave my presentation early on in the first day of the conference which, I have to say, was one of the best conferences I've been to. My presentation documented the lessons learned teaching the course so that others might be able to reproduce our success."

You would highly recommend visiting his site for interesting videos and articles on security and penetration testing.

Vivek Ramachandran is a security evangelist and has been working in computer security related fields for the past 7 years. In 2007, Vivek spoke at world renowned conferences Defcon (WEP Cloaking Exposed) and Toorcon (The Caffe Latte Attack). The discovery of the Caffe Latte Attack was covered by CBS5 news, BBC online, Network World etc news agencies.In 2006, Vivek was announced as one of winners of the Microsoft Security Shootout contest held in India among 65,000 participants. He has also been a recipient of a Team Achievement at Cisco Systems for his work on 802.1x and Port Security modules on the Catalyst 6500 switches. Currently he spends all of his time maintaining Security- Freak.Net , SecurityTube.Net and is the co-founder of Axonize. Vivek, is a Bachelor in Electronics and Communications Engineering from the prestigious Indian Institute of Technology, Guwahati.You can contact him at vivek[at]securitytube.net