Joe Jabara doesn’t call his class Hacking 101, but his students do learn how to develop
effective attacks on computer systems.
The course is actually called Applied Computing Intermediate Design Project, and this
past spring its students carried out phishing attempts against a targeted group of
Wichita State faculty, staff and students.
Working in teams, students created emails based on the same principles that hackers
use to get recipients to open an email, click on a link and enter log in credentials.
Student efforts were successful: Out of 128 targets, 40 opened a phishing email, 10
clicked on a link and four entered log in credentials.
“While the exercise didn’t go so far as to infect the network or steal credentials,
it gave the students baseline data as to what type of emails succeed in fooling the
user,” said Jabara, director of the College of Engineering’s Hub for Cybersecurity
Education and Awareness.
“Students typically get taught about phishing attacks through textbooks and lectures,”
said Noah Santry, an applied computing junior in Jabara’s class. “Getting a chance
to actually perform an attack gave us an even deeper understanding on how phishing
attacks choose and pander to a specific target.”
The broader purpose is not to train future hackers but cybersecurity professionals
who can successfully defend private and public institutions against hacks. Students
get the applied learning experience of simulating a “red team attack” that identifies
a computer network’s vulnerabilities – both technical and human -- so that defenses
can be evaluated and improved.
“This was a great real-world type of exercise for the students, who had to develop
a business plan and offer and perform their services as a real cybersecurity risk
assessment/audit firm would,” Jabara said.
The class project was conducted under the cooperation of oversight of Mark Rodee,
Wichita State’s chief information security officer. Rodee said the university computer
system is under attack regularly.
“Wichita State, like almost all organizations, receive a major percentage of its total
emails as spam and phishing,” Rodee said. Recipients of suspicious emails are asked
to avoid clicking any links, forward such emails to spamreport@wichita.edu, and then
delete them.
“We collect this data from user reports and automated systems to help better assess
and act on risks to the institution. This analysis provides direction on safeguards
we implement, where investment dollars are needed, and also how we better train our
user community.”
Rodee said threats often target both technology – like a malicious code – and human
behavior – such as the inclination to trust or the desire to be helpful. Neither Jabara
or Rodee would disclose the nature of the students’ phishing emails, but common strategies
involve emails that claim to be an urgent request from a top administrator or to contain
an invoice for a purchase not actually made.
“The curriculum that Joe Jabara has built for the class not only explains the theory
but provides a real world understanding of the challenges, pitfalls and opportunities
that exist,” Rodee said. “Students that complete this program are ready to become
more effective quicker in their future careers.”
Applied Computing Intermediate Design is a core course in the College of Engineering’s
applied computing bachelor’s degree program. Students particularly interested in learning
about the role of human behavior – often termed social engineering – can purse a Certificate
in Human Factors in Security and Technology as part of the degree.
Wichita State University serves as the Kansas urban-based research university, enrolling
more than 15,000 students from every state in the U.S. and more than 100 countries.
Wichita State and WSU Tech are recognized for being student centered and innovation
driven.
Located in the largest city in the state with one of the highest concentrations in
the United States of jobs involving science, technology, engineering and math (STEM),
Wichita State University provides uniquely distinctive and innovative pathways of
applied learning, applied research and career opportunities for all of our students.
The Innovation Campus, which is a physical extension of the Wichita State University main campus, is one
of the nation’s largest and fastest-growing research/innovation parks, encompassing
over 120 acres and is home to a number of global companies and organizations.
