Hands on Experience in Security

I wanted to take a moment and discuss the need for hands on experience. The idea that you can learn anything in security, hacking, forensics, or investigation without hands on experience is minimal at best. This goes beyond learning commands, how to load an operating system, or sniffing packets. It gets down to a fundamental mentality. You have to change the way people think to a mixture of critical thinking and problem solving.

As an example, I taught an undergraduate course at my old university. It was very popular and filled every semester. It was a blast getting people with little technical background into the idea of what cybercrime was and how to protect and investigate it. The end of the semester I asked them to write a probable cause affidavit, search warrant, and then run a crime scene. The picture below is very typical of what I received.

As you can tell, these students went all out on their crime scenes. The requirement was whatever was in their crime scene photos had to be in the warrant and evidence seizure report. I made them follow the law and best practices. You can also tell these are dated as to what was going on in the field atthe time (lulsec etc). Although this was an undergraduate course and considered exploratory from a student perspective, familiarity with the mindset was crucial. They would have had a much harder time understanding what each phase was in the investigation, what to investigate, and why had it not been for hands on experience. Tarleton State University describes this process as an Applied Learning Experience. It is absolutely critical to learning and understanding.  

I have a few students still under my wing from that process. They asked me to help them learn. So I give assignments to them outside of class. Things like, install Kali-Linux on a laptop. No guides, no step by step, but they can come to me anytime with questions on how to proceed. The self learning process needs to be assisted along the way. The old days of hackers just learning by doing are almost gone entirely. That is not to say people do not self learn, but the idea that it can all be self-learned is too far fetched now. There is simply too much to learn and too many sources of information not to need a guide. This guidance is where academia must step in and provide service. This can and should be sponsored through direct student interaction, publication, and community outreach.