Enhancing Cybersecurity Education with GCP and Wireshark: A Case Study of Stanford's Hack Lab Course Infrastructure Setup

Stanford University's introduction to cybersecurity, cyberlaw, and cyber policy class, Hack Lab, has always prioritized providing students with hands-on experience in using industry-standard security tools. This fall, as one of the five TAs for the course, I had the opportunity to build much of our course infrastructure on Google Cloud (GCP)’s Compute Engine. In this blog post, we'll explore how we set up our course infrastructure, including why we chose GCP, and how we used it to teach students about incident response and public disclosure.

To start, each machine in the lab has a public IP address attached, making it easier for students to access them using remote desktop or SSH. We also use GCP's DNS support to set up hostnames for each machine, allowing for smoother navigation. In the past, we provided students with preprovisioned Kali Linux virtual machines (VMs) equipped with various security tools, including Burp Suite, Wireshark, and nmap. However, as more students began using M1 Macs that don't support standard x86-64 virtualization, this solution became increasingly difficult to maintain.

That's why we decided to move our Kali VMs to the cloud, simplifying our setup and making it more accessible for all students. GCP's Compute Engine provided us with a scalable and cost-effective solution that met our needs. We were able to create a testing environment that allowed students to work with real-world security tools and scenarios.

Unfortunately, our testing environment was not immune to mistakes. One morning, an EternalBlue-vulnerable machine used for testing was accidentally given a public IP address on Google Cloud. As you might expect, it was quickly compromised and used to launch further EternalBlue scanning against other public web hosts. This incident provided us with a unique opportunity to teach students about incident response and public disclosure.

We immediately sprang into action, discovering the incident and remediating the issue as quickly as possible. We then used this real-world scenario to educate our students on the importance of proper security protocols, incident response, and public disclosure. This hands-on approach allowed them to learn from our mistakes and gain valuable experience in handling similar situations.

In conclusion, our GCP-based infrastructure setup for Stanford's Hack Lab course has been a huge success. By providing students with access to industry-standard security tools like Wireshark, we're able to give them the skills they need to succeed in the cybersecurity field. The incident that occurred also served as a valuable teaching tool, allowing us to demonstrate the importance of proper security protocols and incident response. We're excited to continue using GCP and Wireshark in our course infrastructure setup, providing students with a comprehensive education in cybersecurity.

Wireshark ip lab solutions