Erik Moore
email: emoore@regis.edu

Steven Fulton
email: sfulton@regis.edu

Dan Likarish
email: dlikaris@regis.edu

Evaluating a Multi Agency Cyber Security Training Program Using Pre-Post event assessment and Longitudinal Analysis

Keywords: cyber, security, defense, training, agile, multiagency, collaborative, pele, personalized, education, learning, environment, tabletop, si mulation, joint, physical, exercise

This study presents the context and measured results of cyber security joint cyber defense training exercises. Building on previously published work by the authors that introduced AGILE methodologies, this study analyzes the outcomes of that professional development and laboratory-supported environment. Analysis focuses on the development of specific individual skill levels and generally describes desired multi-agency collaborative capabilities. While all training events do not have sufficient pre-post data to isolate the particular causes of a rise in capabilities, competence in progressively harder levels of capabilities is observed over time in relation to the training components. A comprehensive Personalized Education Learning Environment (PELE) aggregate data of individuals is not presented here, indicators suggest that this would enhance outcomes.

Introduction

The purpose of this study is to determine the efficacy of a joint regional cyber defense training exercise using qualitative assessment and quantitative measures. The impetus for developing a joint regional cyber defense training exercises is an acknowledgement of local entities experiencing cyber attacks such as cyber terrorism, hacktivism, and cyber crime in relation to local, regional, and international events. The frequency, motivation, targets, and types of cyber attacks has expanded significantly [1]. In order to respond to that growing range of cyber-based civil disruption, regional response teams will likely become increasingly necessary in order to provide an agile response to disruptive events, to help under-resourced entities achieve business continuity, and to mitigate damage where possible. This is a type of response is in addition to the array of private services, law enforcement agencies, national defense, and security standards bodies.

Regis University (RU), in partnership with the Colorado Army and Air Force National Guard (CONG) and the State of Colorado (SOC), has completed the first phase of a multi-phase project to build essential and immediate cyber security expertise capacity within the CONG and its information technology (IT) citizen workforce. Their intended cyber-attack response role is similar to their response to a natural disaster like firefighters parachuting out of an airplane, known as "smokejumpers" to put out a forest fire. Successful participants in this training program will be the smokejumpers of the cyber security world. The CONG's IT workforce employs approximately 2000 citizen members with a variety of IT skills and work experience verified through commercial certification. The results of our first year study indicate that the training methodology developed utilizing AGILE methods has improved the ability of the CONG and SOC to respond to attacks against Colorado's critical infrastructure. Based on AGILE development lifecycle principles, the approach we proposed for the Phase I study under a United States National Security Agency/Department of Homeland Security Annex II capacity building grant delivered an executable training partnership model facilitated by collaboration between Academia, the National Guard, and Government. The specific application of AGILE methodology is discussed previously by two of the authors with another collaborator [START_REF] Novak | A Cyber Security Multi Agency, Collaboration for Rapid Response that Uses AGILE Methods on an Education Infrastructure[END_REF]. The study presented here conducted pre and post self-assessment surveys and skill tests reflecting the effect of a multi-year program involving multiple training components, communications with industry, and advanced study of SOC policy.

Because this program relies intentionally on broadly available resources like certification programs, other governmental entities should be able to adapt this model to develop response teams. The training included multiple physical exercises (immersive cyber simulations) and tabletop exercises (collaborative verbal scenario walkthroughs) designed to give real-world substance to more abstract cyber security concepts and integrate physical world consequences to actions performed by the participants.

Items not measured in this research but very important in terms of response capabilities include establishing transitive trust between organizations, a framework for incident response interaction, capabilities to self-organize teams within that framework, and the capacity in the relationship to sustain the empathy and open communications necessary to work through difficult situations. Various activities were designed to provide dynamic group interactions and a common body of knowledge to support discourse and collaborative activities. The exercises incrementally ramped up technical and logistical requirements with what we generally call a crawl-walk-run approach, i.e. starting with easier tasks and working to harder. In addition, the collaborative training space was neither Department of Defense, nor the State of Colorado, releasing constraints for participants to self-organize into a skill-based team structure through rapid discourse rather than extant hierarchies internal to the participating organizations. The significance placed on these capabilities is based on the notion that incident response is the wrong time to introduce responders to each other.exchange business cards. Below are the activities in our joint training events intended to develop individual skills and team capabilities.

Table 1. Teaching Activities

Teaching Activities Definition

Simulation A hands-on immersive scenario which permits instant "reset" of computers, networks, etc. to initial conditions, allows for compression of long term activity into short periods, often provides for lower cost than utilizing real computers, networks, software, protocols, etc, permits ease of scalability, creation of scenarios too risky for "real world" testing.

[3] Physical Exercise Scenario Activity employing actual technology to engage in a technical challenge in order to develop skill, increase familiarity, and develop team capabilities in relation to a particular active scenario or specific static situation requiring action. This can be "staged" phases with assistance, or timed with measured performance to clarify capabilities. These are immersive experiences that include various levels of social and psychological components to create increasing degrees of validity in relation to the expected real-world events for which one trains.

Tabletop Exercise

Focuses on a primarily verbal walk through team activity of a scenario [START_REF] Perry | Disaster exercise outcomes for professional emergency personnel and citizen volunteers[END_REF]. Typically, participants role play to review all aspects of a scenario in order to discover challenges to address within the scenario, develop standard operating procedures, identify appropriate team structures, formulate communications plans, and develop default practice. Usually, this does not involve hands-on use of technologies that actual situations would employ.

Lectures

An instructor provides detailed material and students are the receiver of the information. Often, the student is seen as a passive learner, dependent upon the teach to impart what is to be learned. [START_REF] Petress | What is meant by" active learning?[END_REF] A relevant approach to cyber security training includes both simulation and physical exercise represent challenge-based learning [START_REF] Cheung | Challenge based learning in cybersecurity education[END_REF]. This idea of challenge-based learning is a key factor for stakeholders of the training program for validating the capabilities of the participants beyond what is available in certifications, lectures, and other components.

Participant Assessment Methodologies

In assessing individual capabilities, pre and post tests were used in the study where data could be gathered. Unlike methods proposed for forming a perfect case, the trainers were obliged to train all participants, and thus a control group could not be established [START_REF] Bartel | Measuring the Employer's Return on Investments in Training: Evidence from the Literature[END_REF]. Therefore the data is analyzed in relation to the longitudinal progress without fully establishing attribution of progress to specific training components over long periods of time. However, general progress of the population can be established by the tests while understanding that there were several factors in the participants' lives that contributed to their development in capabilities, including requirements for professional certification, continued work activities at their civilian employers, and other National Guard training. The quantitative longitudinal data is therefore represented as general progress of the population and not particularly efficacy of the particular training program. Understanding the professional context of the training clarifies multiple mutually reinforcing technical activities taking place in the lives of the participants.

The analysis presented herein uses what Creswell and Clark refer to as "two phase explanatory design mixed methods research" where quantitative data is used to identify change in a group and qualitative analysis is used to understand that change [START_REF] Creswell | Designing and conducting mixed methods research[END_REF]. The authors conducted pre and post event surveys and interviews characterizing the multi-year regime of physical exercises, lectures and certification exams, all of which advanced the study participants domain knowledge, awareness of SOC policy, and communication level with industry. The joint training leadership included multiple simulation challenges, physical exercise scenarios, and tabletop exercises designed to give real-world substance to more abstract cyber security concepts and integrate physical world consequences to actions performed by the participants.

Experiment Structure

To achieve an increase in cyber defense capabilities, the joint training leadership team planned joint events with a set of activities specifically designed to inform participants, exercise their skills, and also facilitate inter-organizational collaboration to validate working capabilities, described in Table 1. This study focuses on measuring of the exercising of skills of the participants.

During information sessions where vendors or organizations presented exercise related materials, participants were encouraged to be interactive in order to move towards functional understanding of the scenario. During physical exercises, participants split up into teams purposefully composed of members from disparate institutions to increase inter-institutional interaction. In addition to addressing the content areas and application usage, the exercise design required participants to practice selforganizing, to close gaps and resolve issues across institutional boundaries in the face of each new challenge. During tabletop exercises, participant teams involved in interinstitutional activity and technical leads walked through scenarios that would require broad multi-institutional cooperation. Specific cases suggesting the need for interinstitutional cooperation included: response to a persistent intrusion at a public utility company, a recurring denial of service attack at a state agency, or a targeted attack against online government services where the local support team is overwhelmed. Each of these scenarios require that inter-institutional teams jointly address the policies of each institution and develop working relationships and methods to achieve functional capabilities while maintaining local responsibilities and adhering to relevant security and operations policies.

During time between joint events, the supervisors of each participating group encouraged participants to work in three areas: 1) Certifications such as CISSP and GIAC, 2) Security applications and relevant procedures, and 3) Rules of engagement based on jurisdictions and inter-institution policies. This study does not definitively separately attribute the sources of skill growth between these directed areas of study and the actual training events. Table 2 shows the categories of content and concepts, along with specific applications and utilities that were identified as warranting usage during physical exercises at the joint events. The research team further divided these categories into specific questions on surveys and tests.

In order to determine the efficacy of the multi-year training program, the authors formulated an assessment strategy, first identifying content and concept areas, and based on that designing a set of pre and post event surveys and tests for understanding in addition to qualitative interviews gathered during events. To provide differentiation between the impact of a specific joint training exercise event and the overall progress of participants in the multi-component program, the authors gathered pre and post assessment of a single joint training event, and then longitudinal assessments at the beginning of every event. The joint training program leadership team members negotiated for their institutions the specific sequence for the delivery of curricular content incrementally, based on an assessment of readiness at each phase of training, and also considered the progression of enabling layers of skill yielded new levels of capability. Once the new curricular content for each event was determined, the particular event was rapidly formulated into a set of challenge exercises covering the categories in the table above. The first event was a network defense challenge similar to the Collegiate Cyber Defense Challenge, with a framework dividing participants into "IT Consultant Teams" required to take over, fix, and defend a mismanaged IT infrastructure as described in an earlier work [START_REF] Novak | A Cyber Security Multi Agency, Collaboration for Rapid Response that Uses AGILE Methods on an Education Infrastructure[END_REF].

Table 2. Application Categories and Examples

Content area and Concepts

Outcomes and Assessment

The results saw about 10% change from initial population per event (n > 30 for the first two events and n > 13 where participants were in large part the original population for the 3rd). While this definitely affects that relative percentage of any trend within the core population, "skill gap" closure can still be observed in areas discussed below.

The change in population can be explained by invitation of several groups from outside the core Colorado teams to join in the training exercises, including National Guard representatives from another US state and a Jordanian Military security team. Overall, these representative groups integrated rapidly into the self-organizing teams during physical challenges and expressed value in the presentation of new tools, observation of the tabletop exercises, and participation in discussions to exchange challenges and ideas. Initially, the exercises were composed of Colorado state government, Colorado National Guard, and academic institutions, and quickly attracted interest from IT security industry companies and governmental entities outside of Colorado. This suggested that the model for operating this program might have broad value for other regions. A key point of value in these conversations was that the exercises included multiple simulation, physical exercise scenarios, and tabletop exercises designed to give real-world substance to more abstract cyber security concepts and integrate physical world consequences to actions performed by the participants.

Findings

Participants completed evaluation surveys and knowledge tests both at the beginning and at the end of only the first joint event. Longitudinal pre event tests measure variance in capability between the start of each event. One observation was the lack of participants' voluntary participation in the post-event assessment for all events. This could be explained by the fact that participants were tired following the event and did not wish to remain long enough to complete the survey.

The overall trend of data goes upwards over the span of years, while we recorded levels of capability fluctuating up and down within the same event and between events. Interpretation of the pre-post event test data must also take into consideration the compounding nature of the skills introduced over time. This may account for some fluctuation in results. Discrete tracking of particular technical skills suggested that "gap filling" was a stronger aspect of the training events rather than the broad acquisition of skills in new areas.

One possible influencing factor outside of the training events is the study and practice that participants were directed to complete by their respective institutions as part of the overall effort to enhance capabilities. This broader longitudinal acquisition of new skills took place between events, by the efforts of individuals at their jobs, in pursuit of professional certification, and in collaborative study teams. Generally institutional requirements were set with their own program customized for each participant, called here Personalized Experiential Learning Environment (PELE) tracking because it tracks independent professional experience, professional development training, and other related activities. PELE is managed at each these institutions using a spreadsheet for tracking activities against needs. There was no comprehensive system coordinating all related activities across all institutions, except for the annual selfassessment and skill testing data gathered in this study.

The results in Figure 1 suggest that some modest progress was made in most areas with a significant gap being filled in web forensics. The drop in "NMAP -Analysis" score suggests that users became aware of their own skill level as smaller in relation to a larger body of knowledge at this event, likely during the learning challenges.

Tested skills in Figure 2 generally improved over the two-day event, with significant skill gaps improving in relation to a larger body of knowledge. Small changes suggest prior knowledge of the skill at least at the level presented in the challenge event.

Over the span of 2013-2015 as represented in Figure 3, students' perception of skill levels often significantly shifted as a group average. In examples such as "NMAP -Experience" and "Forensic -Storage", relative confidence is often deflated and then rises up over a span the span of years. Other profiles of progress exist within the data, such as areas where there was significant previous experience like "Wireshark" that exhibited consistent skill levels.

While Figure 4 shows some skill gap-filling as identified in areas like backdoors, vulnerabilities, and routers, areas like "ARP poisoning" and "Duplicate DNS entries" suggest that skills emphasized early on may have needed continuing attention to achieve retention. Participants completed the pre event tests using pen and paper individually while proctored in a large classroom.

Conclusion

After multiple iterations of surveys and tests we determined through observation of the National Guard working group that an individualized, PELE would benefit the user and manager. The documents that we examined were after action reports, interviews with the managers responsible for the participating institutional team members and a compilation of reports by observers. Not surprisingly the user and manager requirements were similar provide accurate and real-time situational awareness of strengths and weaknesses The managers were primarily interested in how best to respond to an immediate threat given the available workforce and up to date competency data. This is similar to other observations in separate research [START_REF] Eckerson | Performance dashboards: measuring, monitoring, and managing your business[END_REF].

High variance in skill growth trends can be explained by some underlying causes. While the self-assessment and test topics remained consistent over the years, the event content emphasis was re-negotiated by the joint training program leadership team prior to each event to maintain relevance for all participant institutions in the face of real world events. The program leaders' rapid modification of the content was essential to achieve high levels of institutional engagement by addressing changing priorities of stakeholders. This deemphasized some skills tracked in the assessment design. The stakeholders often became aware of the new priorities upon review of tabletop and other exercises.

The need for additional types of research became apparent upon review of the data in relation to the events. The PELE approach used by the participating institutions between training events was significant, allowing the individual capabilities to rise between events even though post-surveys did not suggest strong technical advancement in single-weekend events. This is reflected in the significant growth from a longitudinal view. Creating a coordinated PELE should enhance the various agencies ability to both consistently cover identified areas and make agile moves in a more structured way. This research did not cover the PELE systems or processes but merely observed the need to track inter-event progress of participants to fairly attribute the source of skill growth. The authors confirmed this in after-action briefings with joint training program leadership. Additionally, there is a need for more detailed study of each component of this general program to determine what value each is contributing. A behavioral study assessing the specific causes of learning outcomes could lead to better rebalancing the portfolio of activities. Finally, this study did identify significant growth in the participants of the program, particularly over the longitudinal span of years. The general method presented could address skill gaps seen in the measured areas for a range of similar collaborative ventures. Future studies of this method would require better tracking of growth related activity or specific behavioral studies of learning activities.

Citations:

1. Kenney, M Cyber-Terrorism in a Post-Stuxnet World, Orbis, Volume 59, Issue 1, Pages 111-128 (2015)

Fig. 1 .

 1 Fig. 1. 2013 User Self Evaluation results plotted an average percentage of self-perceived proficiency across a range of areas (n=30).

Fig. 2 .

 2 Fig. 2. 2013 Participant knowledge tests prior to and after the challenge event (n=30).

Fig. 3 .

 3 Fig. 3. Longitudinal surveys over three years of self-perceived skills where 2013 (n=30), 2014 (n=30), and 2015 (n=13).

Fig. 4 .

 4 Fig. 4. Longitudinal pre-testing knowledge over the span of three years where 2013 (n=30), 2014 (n=30), and 2015 (n=13).


Natalia Miloslavskaya
email: ngmiloslavskaya@mephi.ru

Alexander Tolstoy
email: aitolstoj@mephi.ru

Designing Degree Programmes for Bachelors and Masters in Information Security

Keywords: information security, information security professionals, professional standards, competency, degree programme, Bachelors, Masters, design 1

The effectiveness of ensuring information security (IS) largely depends on the IS specialist's professional level. It is important to design the relevant degree programmes (DPs) for their training within the framework of academic education. This process involves the definition of initial data and the implementation of a certain number of interrelated stages. The peculiarities of national educational systems as well as inadequate coordination of educational activities at the international level are the main reasons for the lack of uniform requirements for the DPs' formation. A DP's design procedure, based on the experience of the international organizations engaged in the accreditation of individual DPs, is considered. The paper defines the typical DP's structure and the basic stages of its design for the example of the Bachelor's and Master's in IS DPs.

INTRODUCTION

The effectiveness of ensuring information security (IS) largely depends on the professional level of specialists in the field. It is important to design the relevant degree programmes (DPs) for their training. A DP refers to a set of educational and methodical documents, which set forth the basic provisions relating to the implementation of the educational process of training professionals of a certain level.

Each educational institution develops its own DPs based on its experience, others' experiences, and various regulations adopted at the national or international level. The peculiarities of the educational systems of different countries as well as an inadequate coordination of educational activities at the international level are the main reasons for the lack of uniform requirements for the DPs' formation.

In this paper, a DP's design procedure, based on the experience of the international organizations engaged in the DP's accreditation, is considered. As a successful example of such activities, we examine the experience of the Agency for Accreditation of the DPs in the field of engineering, informatics, natural sciences and mathematics (ASIIN, www.asiin-ev.de). The Agency proposes and implements quality control at the international level for the DPs. The core of the DP's accreditation criteria, regardless of the country in which an applicant (educational institution) operates, consists of the following:  The orientation of the learning outcomes;  The feasibility of the DP;  The quality features associated with the professional community and labor market;  The applicant's potential, including its quality management maturity;  The accounting of the requirements of the European Association for Quality Assurance in Higher Education (ENQA) (set out in the "European Standards and Guidelines") and the European Quality Assurance Register (EQAR).

Thus, the paper proposes a generalized (typical) description of a DP's structure, based on the formulation of its key implementation goals, objectives and intended learning outcomes with their features, the development of its curriculum and the description of requirements for the education quality control and the resource support of the DP's implementation. The effectiveness of the proposed approach is confirmed by the NRNU MEPhI's experience in designing the DPs for Bachelors and Masters in IS.

TYPICAL DEGREE PROGRAMME STRUCTURE

The shared experience of educational institutions, which successfully passed the procedure of their DPs' accreditation in the organizations like ASIIN (presented at http://www.asiin-ev.de), allow us to describe a typical DP's structure (Fig. 1).

Fig. 1. Typical DP's structure

The educational and methodical documents relating to any DP should clearly describe all these structural elements. The DP's key goals and objectives, as well as the intended learning outcomes formulation should be guided by the requirements set forth by the applicable standards, labor market and professional community (consumers of the educational institutions' graduates, etc.). [To simplify the presentation of our findings and in condition of limited paper size, the requirements resulting from general public interest, IS science itself, etc. are not discussed]. The intended learning outcomes should be described by the relevant features. The DP's curriculum content should be focused on the solution of problems formulated to achieve the key goals and intended learning outcomes. The education quality control should be ensured at all stages of the curriculum implementation. The resources supporting the DP should provide the necessary quality of curriculum implementation. Thus, all the components of a typical DP's structure are interrelated. These relations are causal, allowing the high-quality DP implementation to achieve the key goals of education. In this case, any DP can be regarded as a description of the professional training system with a certain level of operational quality. The optimization of the education quality is associated with an efficiency of management of this system.

PROCEDURE OF A DEGREE PROGRAMME's DESIGN

The DP's structure description and its elements' interrelations determine its design procedure, consisting of the following consequent steps:

1. Analysis of the requirements of the applicable standards, labor market, and professional community. For the quality of the educational process, it is important to embed the DP's design processes into the processes implemented by a professional training system in a particular field. Any educational institution is interested in improving the overall efficiency of these processes. Hence, the using the continuous process improvement model (called the Deming-Shewhart model or the PDCA cycle) is reasonable [START_REF] Shewhart | Statistical Method from the Viewpoint of Quality Control[END_REF][START_REF] Deming | The New Economics[END_REF]. The PDCA cycle is closely connected with quality management [3] where the process control and optimization are especially important. This model assumes a cyclic repetition of four steps. Plan (P): the establishment of objectives and the processes necessary to achieve them, the planning of activities for achieving the objectives and satisfying the customers, and the necessary resource allocation and distribution. Do (D): the planned activities' implementation. Check (C): the collection of information and control of the process implementation results based on the key performance indicators, the identification and analysis of deviations, and their causes. Impact, management, updating (A): the adoption of measures to address the causes of the deviation, and the changes in the planning and allocation of resources.

The application of the first PDCA cycle to the educational process is the first process implementation: P: the DP's design; D: the implementation of the DP's curriculum; C: the educational process's quality control in order to determine the level of the tasks solution set out above and the objectives' achievement degree, detection of abnormalities and their reasons' analysis; and A: the DP's adjustment, which involves the elaboration of measures to change the design process content.

The subsequent PDCA cycles correspond to the continuous improvement of the educational process. In this case, it is important to choose the intervals between the full cycles and to define the control procedures.

Taking into account the educational process's inertia (study duration) and its phasing (semesters, academic years) two options for its improvement are recommended. The tactical improvement is associated with the correction of the curriculum and resource support. This adjustment should occur after the educational year based on the DP's quality self-assessment. The strategic improvement is associated with the correction of all DP's components. This adjustment should occur after the completion of a full cycle of training on the programme (e.g. four years for a Bachelor's DP and two years for a Master's DP) based on the self-assessment and external audit of the DP's implementation quality. It is possible to associate the quality control with the processes of the DP accreditation. We also consider an example of the design procedure for any Bachelor's and Master's DP in the field of IS that takes into account all the specific peculiarities and requirements (national and international) for education in this field. The general (nontechnical) education requirements (e.g. in humanities, social sciences, etc.) are out of scope of this paper.

The requirements of applicable standards, labor market and professional community

The requirements of a separate segment of the labor market and professional community for the qualification of professionals who are capable of fulfilling the kinds of professional activity can be found in various national or international regulations. The documents developed in the USA, Australia, the Russian Federation, the European Community and the International Organization for Standardization (ISO) are the most interesting in the IS field.

The National Cyber Security Division of the U.S. Department of Homeland Security (DHS/NCSD) published the "Information Technology Security Essential Body of Knowledge: A Competency and Functional Framework for IT Security Workforce Development" [START_REF]Model. A Best Practice Model and Framework[END_REF]. NIST prepared the more specialized National Initiative for Cybersecurity Education (NICE) [START_REF] The | National Cybersecurity Workforce Framework[END_REF]. The Australian Government Information Management Office developed "Cyber Security Capability Framework & Mapping of IS Manual Roles" [START_REF]The Cyber Security Capability Framework & Mapping of ISM Roles[END_REF]. The European Commission approved the e-Competence Framework version 3.0 (e-CF 3.0) [START_REF]The European e-Competence Framework 3.0. A common European Framework for ICT Professionals in all industry sectors[END_REF]. ISO has drafts of new standards. ISO/IEC 27021 covers "… [c]ompetence requirements for information security management systems professionals." Three parts of ISO/IEC 19896 describe knowledge, skills, general and effectiveness requirements for ISO/IEC 19790 testers and ISO/IEC 15408 evaluators.

The state-level requirements' formulation features in the documents of the USA, Australia, the European Community and ISO were analyzed in detail in [START_REF] Miloslavskaya | State-Level Views on Professional Competencies in the Field of IoT and Cloud Information Security[END_REF].

In our research, we used the requirements of the generalized Russian labor market in the field of IS, combining government, industry and academia. The Russian Federation has developed a set of IS professional standards [9]. At the beginning of 2017 this includes the following professional standards: "Specialist in automation of information and analytical activity in the sphere of security"; "Specialist in security of computer systems and networks"; "Specialist in IS of automated systems (ASs)"; "Specialist in IS in telecommunication systems and networks" and "Specialist in technical information protection". The "Specialist in IS of ASs" professional standard has been approved at the state level. The remaining standards have a project status.

All these standards have a common methodology for forming the requirements. Each professional standard formulates the name of the professional activity; the key goal of the type of professional activity; the generalized job functions included in the type of professional activity; the specific job functions related to a certain generalized function, etc. In our research, we take all this information from the standard as initial data for the DPs and hence we do not show how key goals, learning outcomes and requirements are derived from one another.

Each job function relates to a specific professional qualification level (PQL). The graduates of the educational institutions on the Bachelor's DPs can fit on their qualification to the 6 th level (PQL=6); the graduates on Master's DPs, to the 7 th level (PQL=7). For each job description, the job activities that a professional with a specific PQL can perform are described and the necessary knowledge and abilities that he/she must possess are identified.

As an example, the main provisions of the "Specialist in IS of ASs" professional standard are considered.

The name of professional activity: IS ensuring for ASs.

The key goal of the type of professional activity: IS ensuring for ASs, which operate under the threats in the information sphere and describe the information and technological resources to be protected.

The generalized job functions, corresponding PQLs, work functions, positions held and the required levels of education: are presented for the Bachelor's and Master's DPs in Table 1 (where HPE means Higher Professional Education). Russia uses a three-tier HPE system: Bachelor (4 years), Master (2 years after Bachelor) or Specialist (5-6 years), Post-graduate school (3-4 years after Master or Specialist)). Bachelor graduates with or without work experience can perform a generalized job function B (PQL=6), occupying one of the positions listed in Table 1. Master or Specialist graduates without work experience can perform a generalized function D (PQL=7), occupying one of the positions listed in Table 1.

An example of job activities that can perform a professional, referred to a specific PQL, and the necessary knowledge and abilities that he/she should possess: Table 2 shows the "Administration of IPSs for ASs" job function (the generalized job function B; at the same time, he/she should complete a Bachelor's DP and have no work experience) and for the "Development of the design decisions for the AS's information protection" job function (the generalized job function D; at the same time, he/she should complete a Master's DP and have no work experience). Our analysis of the "Specialist in IS of ASs" professional standard and its comparison with the results of similar analysis of the regulations of the USA, Australia, European Community and ISO standards' drafts [START_REF]The European e-Competence Framework 3.0. A common European Framework for ICT Professionals in all industry sectors[END_REF] leads us to conclude that all these documents have their own peculiarities, reflecting the experience and specifics of the respective countries, and some terminological inconsistency. However, they have common features: they contain the qualification requirements for IS professionals related to a separate type of work they can perform at a certain position. This information is extremely important for the educational institutions, which are developing and implementing the educational programmes for training IS professionals of a certain level. It allows them to define the key goals and objectives of training and to formulate the requirements for the intended learning outcomes.

Definition of the DP's key goals and objectives

Defining the DP's key goals and objectives must take into account the key goals and objectives set by the standards mentioned above, and the labor market's requirements. In our case, the DP's key goal can meet the needs of professionals who can do the types of professional activity in a particular segment of the labor market. An example of such a segment is the area of IS that requires professionals of a certain level (e.g. Bachelors or Masters). The types of their professional activities may include, but are not limited to: operation of IPTs or protected information processing systems; design of IPTs or protected information processing systems; management of systems ensuring IS or protected information processing systems; research in the field of IS; and pedagogical activities in the field of IS.

As an example, the definition of the Bachelor's and Master's DP's key goals and objectives for the "Specialist in IS of ASs" professional standard of the Russian Federation is considered.

The overall key goal of the Bachelor's and Master's DP: the training of professionals in the field of IS of ASs, which operate under the threats in the information and protect information and technological resources. The particular key goal of the Bachelor's DP: the training of professionals in the field of IS for ASs during their operation (as defined in Table 1, based on a generalized job function B).

The objectives of the Bachelor's DP: the training of professionals for the job functions which are defined in Table 1 (column 3, based on the job functions related to a generalized job function B).

The particular key goal of the Master's DP: the training of professionals in developing IPTs for ASs (as defined in Table 1, based on a generalized job function D).

The objectives of the Master's DP: the training of professionals for the job functions defined in Table 1 (column 3, based on the job functions related to a generalized job function D).

The definition of the DP's key goals and objectives directly influences the intended learning outcomes.

Formulation of the learning outcomes

When determining the requirements for the DP's implementation results, the DP's key goals and objectives should be taken into account, as well as the requirements of the labor market and professional community. These requirements can be found in various regulations of the national or international level.

The modern approach to their definition is based on the establishment of professional competencies of a professional's ability to solve given problems and to perform specific work within his/her sphere of activity [START_REF] Tolstoy | Professional Competencies Level Assessment for Training of Masters in Information Security[END_REF]. As an example, the definition of the intended learning outcomes for the implementation of the Bachelor's and Master's DPs based on the requirements of the "Specialist in IS of ASs" professional standard of the Russian Federation. The professional competencies in this case can be formulated for each job function (Table 1) based on the determination of the job activities relating to this job function (Table 2).

The intended learning outcomes for the Bachelor's DP: the professional competencies that a Bachelor should have to perform for the "Administration of IPSs for ASs" job function (a generalized job function B). The Bachelor must be able to demonstrate (according to the job activities defined in Table 2) the ability to install AS's software updates; secure information, taking into account the requirements of the efficient functioning of the AS; manage the AS's user rights; inform the users about the rules of AS operation, taking into account the IS requirements; train personnel to work with the AS's IPS, including workshops with staff on models or in a test area; and change the operational, organizational, and administrative documents for the AS's IPS.

The intended learning outcomes for the Master's DP: the professional competencies, that a Master should have to perform for the "Development of the design decisions for AS's information protection" job function (a generalized job function D). The Master must be able to demonstrate (according to the job activities, which are defined in Table 2) the ability to develop the IS threats' and intruders' models for the ASs; the models of the ASs and the ASs' protection subsystems; the regulation drafts regulating the information protection activities; and proposals for improveing the AS's IS management system.

If a DP trains professionals to perform multiple job functions, then a set of professional competencies should be formulated for each job function.

The DP may also include general professional competencies, the formation of which is necessary as a basis for the subsequent formation of the professional competencies. This is especially true for the Bachelor's DPs.

Definition of the intended learning outcomes' features

Characterization of the intended learning outcomes is traditionally associated with a specific competency by combining observable and measurable knowledge (K), skills (S), and abilities (A) [START_REF] Tolstoy | Professional Competencies Level Assessment for Training of Masters in Information Security[END_REF]. Knowledge is the cognizance of facts, truths and principles gained from formal training and/or experience. A skill is a developed proficiency or dexterity in mental operations or physical processes that is often acquired through specialized training; using these skills results in successful performance. Ability is the power or aptitude to perform physical or mental activities that are often affiliated with a particular profession.

In accordance with the recommendations of the "The European Qualifications Framework for Lifelong Learning" (EQF) [START_REF]The European Qualifications Framework for Lifelong Learning[END_REF], the definition of the learning outcomes' features in the form of requirements to the level of K, S and A depends on the DP's level: EQF level 5 for Bachelors and EQF level 7 for Masters in IS. When defining their features, the "Specialist in IS of ASs" professional standard for Bachelors and Masters (Table 2) were used. The EQF's recommendations were also considered.

The features of Bachelor's and Master's DP intended learning outcomes: The K, S and A are shown in Table 2, where job activities are equal to S.

All these data should be taken into account in the design of appropriate DPs' curricula.

3.5

Development of the DP's curriculum

The curriculum contains a list of training activities for the entire period of study. These activities include classes (C) and students' independent work (IW). As a rule, these activities are implemented within the framework of different curriculum elements: academic disciplines, internships, implementation, and protection of a Final Qualifying Work (FQW). The workload for each element is assessed in conventional units (CUs) or credits (Cs) correlated with the training hours (THs). For example, 1 credit is equal to 36 THs in Russia. The workload is distributed by semesters and study weeks. Each semester covers 18 weeks. Each curriculum element has its own knowledge progress testing (KPT): Exam (E) or Test (T).

The curriculum implementation workload for the Bachelor's DPs is more oftenusually valued at 240 credits. It corresponds to 8640 THs and 4 years (8 semesters) of study.

The curriculum implementation workload for the Master's DPs is usually valued at 120 credits. It corresponds to 4320 THs and 2 years (4 semesters) of study.

An example curriculum structure for a Master's DP is shown in Table 3. It is necessary to identify a list of disciplines, as well as KPT forms, workload (in credits and THs) and the distribution of THs by study weeks for each curriculum element. A programme for each curriculum element, the implementation of which is focused on the formation of specific competencies and intended learning outcomes, should be designed. A certain professional competence is formed by several disciplines [START_REF] Tolstoy | Professional Competencies Level Assessment for Training of Masters in Information Security[END_REF]. In that case, all the curriculum elements should be combined into the separate training modules. For example, a Bachelor's DP curriculum can be designed based on four modules: General Educational, General Professional, Professional, Internship & FQW's Protection. The General Educational Module combines elements of the discipline; mastering it will create a basis for the students' mastering of disciplines to be included in the General Professional Module. It, in turn, combines elements of the discipline; mastering it will create a basis for the students' mastering of disciplines from the Professional Module. A Master's DP curriculum can be designed similarly based on three modules: General Professional, Professional, Internship & FQW.

The given structure separates the requirements for the intended learning outcomes for each module and expands the range of competencies that should have been formed at the end of the educational process. Another positive effect of modular curriculum structure is the ability to support the mobility of students in passing their training, when the students can study the individual modules in different educational institutions (this is typical of the dual-diploma DPs).

The ASIIN's recommendations [START_REF]Criteria for the Accreditation of Degree Programmes (ASIIN)[END_REF] can be used to describe a training module.

Selection of resource support for the DP's implementation

To implement any DP, the following resources are required: human resources, laboratories, educational and methodical resources, and financial resources. The faculty (their quantity and quality) forms the human resources. The required number of instructors depends on the workload and the number of students enrolled. The faculty's quality depends on the instructors' experience and professionalism (their educational titles, academic degrees, publication activity, etc.). Laboratory support is determined by the number and level of equipment of educational and scientific laboratories. Educational and methodological support is determined by the educational institution's library capacity, accessibility to different information sources, availability of textbooks and training manuals, design of a separate DP's implementation, etc. Financial support for the DP's implementation is based on the funds received from the students (paid training), from various organizations and funds (targeted training), and from the state (budget training).

The resource requirements for the provision of the educational process in the Russian Federation are formulated in the educational standards, and are developed and approved at the state level for each training direction (including that of IS).

Selection of the education quality control measures

Any educational institution implementing a DP for Bachelors/Masters should be a guarantor of the education quality based on continuous multilevel education in order to best meet the learning outcomes of all stakeholders. For that purpose, a Quality Management System should exist with the appropriate control measures in place. Their formation and development are based on global trends focused on the concept of Total Quality Management, the requirements of ISO 9001:2015 [3], the guidelines for Quality Assurance Agencies in Higher Education, etc.

CONCLUSION

The above design procedure has been tested at the Institute of Cyber Intelligence Systems of the National Research Nuclear University MEPhI in the development and implementation of the following DPs in IS: for Bachelors: "Automated Systems Security"; for Masters: "Cryptographic Methods for Cybersecurity", "Information Security of Crucial Objects" and "Information Security and Intelligence Analysis for Financial Monitoring". All these DPs have been successfully accredited in Russia, proving the consistency of our approach. In addition, these DPs are currently passing the international accreditation by ASIIN. Using our approach, we prepared the DPs' self-assessment report as an initial data for this procedure. During this self-assessment, we found a few ASIIN requirements were not met (for example, in dividing DPs in training modules, the distribution of disciplines within the modules for the Bachelors' DP). We corrected the curricula to satisfy those requirements. One lesson we learned is that we needed to pay more attention to consumer's demand for graduates of our DPs and their expectations of graduates' knowledge, skills and abilities. Currently, the third generation of students is being trained with a total enrollment of 105 students (15 Bachelors + 90 Masters). After every graduation year we reviewed and adjusted the curriculum of each DP due to the changes in the requirements and educational content.

ACKNOWLEDGEMENT

2 .

 2 Selection of the DP type (for Bachelors/Masters). 3. Definition of the DP's key goals and objectives. 4. Formulation of the DP's intended learning outcomes. 5. Definition of the intended learning outcomes' features. 6. Development of the DP's curriculum. 7. Selection of resource support for the DP's implementation. 8. Selection of the education quality control measures.

Table 1 .

 1 The generalized job functions, corresponding PQLs, positions held and required levels of education from the "Specialist in IS of ASs" professional standard

	Generalized job functions	Work functions	Position held	Required level of
	Code	Name	Name		education
			Diagnosis of information
			protection systems (IPSs) for	Information
			ASs	Protection Engineer
	B (PQL =6	Ensuring IS for ASs during their operation	Administration of IPSs for ASs Monitoring of information IS management for ASs Providing IPSs functioning in emergency situations	Information Information Protection Specialist Software Engineer for Technical	HPE, Bachelor
			protection in ASs	Protection
			Audit of information protection	Software Engineer
			in ASs
	D (PQL =7)	Design of IPSs for ASs	Testing of IPSs for ASs Design decision development for the AS's information protection Development of the maintenance documentation for hardware IPSs for ASs Development of software and IPS for ASs	Leading IPSs' Development Engineer Head IPS's Department Project Head Leading Information Protection Specialist IPS's Development	HPE, Master, Specialist

Table 2 .

 2 An example of job activities and the necessary knowledge and abilities from the "Specialist in IS of ASs" professional standard

		Basic education -Bachelor's DP	Basic education -a Master's DP
		Installing AS's software updates	Developing the IS threats' models of and
		Protecting information, taking into	the intruders' models for ASs
		account the requirements of the	Developing the models of ASs and ASs'
		efficient AS's functioning	protection subsystems
		Managing AS's users authorities	Developing the regulation drafts,
		Informing users about AS's	regulating the information protection
		operation rules, accounting the IS	activities
	Job	requirements	Developing	the	proposals	on
	activities	Conducting training of personnel to	improvement of AS's IS management
		work with AS's IPS, including the	system
		workshops with staff on models or in
		a test area
		Changing of operational
		documentation and organizational
		and administrative documents for
		AS's IPS
		The formation principles for IS	The guidelines and methodological
	Necessary	policy for ASs	documents of the authorized executive
	knowledge	Hardware and software IPSs for ASs	bodies on information protection
		The key cryptographic methods,	The regulations and national standards for

Table 3 .

 3 A curriculum structure's sample for a Master's DP

							Distribution by years,
	Curriculum elements	KPT	Credits,	Workload Training hours	Hours per week (C/IW) 1 st year 2 nd year 1 st 2 nd 3 rd 4 th
			CUs	Total	C	IW	sem	sem	sem	sem
	Discipline 1	T	2	72	36	36	2/2
	Discipline 2	T	…	…	…	…	…	…	…	…
	Discipline N	E	5	144	72	72		4/4
	Internship	3 Es	30	360	0	360	0/6	0/7	0/7
	FQW	E	30	360	0	360				0/20
	Total		120	4320

This work was supported by Competitiveness Growth Program of the Federal Autonomous Educational Institution of Higher Education National Research Nuclear University MEPhI (Moscow Engineering Physics Institute).


Natalia Miloslavskaya
email: ngmiloslavskaya@mephi.ru

Alexander Tolstoy
email: aitolstoj@mephi.ru

Anton Migalin
email: asmigalin@mephi.ru

"Network Security Intelligence" Educational and Research Center

Keywords: Network Security Intelligence, Educational and Research Center, NGFW, DLP, information security

The paper presents a recent experience (since 2016) in establishing and running the "Network Security Intelligence" educational and research center (NSIC) in the framework of the new NRNU MEPhI's Institute of Cyber Intelligence Systems (ICIS). The created center is designed to provide training and research on effective network security management based on intelligent approaches and applications, the use of Big Data technologies for processing information security information, the study of the compatibility between different network protection tools, as well as the evaluation of network security. The educational NSIC's basis currently consists of two laboratories with Next-Generation Firewall (NGFW) and Data Loss Prevention (DLP) systems at their cores respectively. Here we discuss the use of the first one. The main areas of further work in expanding NSIC's operation for training and research conclude the paper.

INTRODUCTION

Intensive development and use of modern information and communication technologies (ICT) has led to serious qualitative changes in the economic, socio-political and spiritual spheres of public life. Nowadays we witness dramatic changes in ICT that are driving current information security (IS) trends and require sophisticated structures and adequate approaches to manage IS on different scales: for individuals, for organizations, for countries and for the entire world. The wide range of new and evergrowing IS threats, especially those related to new ICT, network technologies, services and devices, are all around us.

The "e-Skills for the 21st Century: Fostering Competitiveness, Growth and Jobs" Communication from the Commission to the Council, the European Parliament, the European Economic and Social Committee and the Committee of the Regions says that "There is an important need to address ICT-related skills (e-skills) issues in order to respond to the growing demand for highly-skilled ICT practitioners and users, meet the fast-changing requirements of industry… Shortages of ICT practitioner skills have been endemic due to technological innovation and the fast growth of ICT activity in comparison with the relatively low supply and availability of new employees and entrepreneurs with relevant educational qualifications " [START_REF]Skills for the 21st Century: Fostering Competitiveness, Growth and Jobs[END_REF].

In 2015 the World Summit on the Information Society (WSIS) noted that it should explicitly recognize ICT Professionalism because the implementation of WSIS action lines and Sustainable Development Goals requires the services of a skilled, competent, ethical, accountable, and trustworthy ICT workforce [START_REF]World Summit on the Information Society at the regional and international levels. Report of the Secretary-General. United Nations. General Assembly. Economic and Social Council[END_REF].

In its 2016 Cybersecurity Skills Gap graphics [START_REF]Cybersecurity Skills Gap[END_REF], ISACA has shown that more than 1 in 4 organizations have experienced an APT attack and by 2020 the average cost of a data breach is estimated to be $150 million, while 53% of organizations experience delays as long as 6 months in finding qualified security candidates. A global shortage of 2 million cybersecurity professionals is expected in 2019.

Hence the demand for highly-skilled ICT practitioners ready to act in modern heterogeneous ICT systems, which are vulnerable to various sophisticated attacks, is more obvious than ever before. To meet this challenge, to achieve business objectives, to stay competitive and to operate legally, organizations of all types (e.g. commercial or non-profit organizations, government agencies), sizes and spheres of activity need to have a unified, inclusive, scalable, effective security system with proper security intelligence services in place and "best-in-breed" information protection tools (IPTs), measures, and staff to truly manage IS for their sensitive assets.

The paper describes our experience with the recently established (in 2016) educational and research center for intelligent network security management, called the "Network Security Intelligence Center" (NSIC), within the framework of the new NRNU MEPhI's Strategic Academic Unit called the Institute of Cyber Intelligence Systems (ICIS). At present we only consider educational purposes (because the hardware and software base of the center is still not fully developed for research purposes). Prof. Bart Preneel from the Catholic University of Leuven is NSIC's Scientific Leader.

Our current work is aimed at developing the NSIC concept in general, and our own NSIC in particular, as a world-class educational and research center. The goal of this work is to present a model of NSIC for its study and continuous improvement, taking into account the characteristics of today's networks and the forecast for networks in the not so distant future. For our purposes, our NSIC will be based on three bearing laboratories with Next-Generation Firewalls (NGWFs), Data Loss Prevention (DLP), and Security Information and Event Management (SIEM) systems at their cores respectively. The NSIC can be reasonably used as a basis for creating a trusted educational environment for blended learning with many e-learning components.

Our paper is organized as follows. Section 2 provides a brief review of related work. The general NSIC's description is given in Section 3. The use of NGFWs for educational purposes is presented in Section 4. The main areas of further work in expanding the NSIC's operation for training and research conclude the paper.

RELATED WORK

The world's leading IT research and advisory firm, the Gartner Company, identified the top 10 strategic technology trends that organizations of different sizes and spheres of activities cannot afford to ignore in the next three years (up to 2018) [START_REF]Gartner's Top 10 Strategic Technology Trends for[END_REF]. Gartner highlighted the advent of intelligence everywhere, meaning three wide-spreading trends. First, "Advanced, Pervasive and Invisible Analytics" will take center stage as the volume of data generated by embedded systems increases, and data lakes of structured, semi-structured and unstructured data [START_REF] Miloslavskaya | Application of Big Data, Fast Data and Data Lake Concepts to Information Security Issues[END_REF] inside and outside the organization should be analyzed for more informed decision-making. Second, embedded intelligence combined with deep analytics will drive the development of "Context-Rich (and context-aware) Systems" that monitor their rapidly changing surroundings and respond appropriately. And last, but not least, "Deep Analytics" applied to an understanding of context provide the preconditions for a world of smart machines that learn for themselves and act autonomously. Our key task is to teach them to act constructively, not destructively.

Most publications discuss centralized network security management in terms of first generation SIEM systems run from a Security Operations Center (SOC) (e.g. [START_REF] Bidou | Security operation center concepts & implementation[END_REF], with more detailed analysis in [START_REF] Miloslavskaya | Security Operations Centers for Information Security Incident Management[END_REF]). Cisco Systems in particular contributed to the SOC idea [START_REF]Security operations center: building, operating, and maintaining your SOC[END_REF]. Subsequent publications focus on either tools for computer network defense [START_REF] Sanders | Applied network security monitoring: collection, detection, and analysis[END_REF][START_REF] Bejtlich | Practice of network security monitoring[END_REF][START_REF]Insights on governance, risk and compliance[END_REF] or on people and processes.

Then people began to talk about a Security Intelligence Center (SIC) with an integrated IS architecture and a 2 nd generation SIEM system, providing full visibility and control and context-driven security intelligence in one place to temporarily deal with network-level and more important higher-level IS events. SIC as a separate term exists since 2011 [START_REF] Burnham | What is Security Intelligence and why does it matter today?[END_REF], with a few papers on the topic [START_REF] Hutchins | Intelligence-driven computer network defense informed by analysis of adversary campaigns and Intrusion Kill Chains[END_REF][START_REF]Threat intelligence platforms[END_REF][START_REF]Prevent fraud. Achieve compliance. Preserve security[END_REF]. In [START_REF] Soc Vs | SIC: the difference of an Intelligence Driven Defense® Solution[END_REF] a short comparison of SOC and SIC is given which was a starting point for our research.

To empower the autonomy of network security management within one organization and to deepen its knowledge of the computing environment, our research is aimed at uniting all the advantages of a SIC and a Network Operations Center (NOC) [START_REF]What is a Network Operations Center (NOC)[END_REF] with their unique and joint toolkits and techniques in a unified NSIC. NSIC changes the security model from reactive to proactive, supports more effective responses to IS incidents, enhances communications between the network and security teams, management and board members, drives IS investment strategies, and more directly connects IS priorities with business risk management priorities. The research in this area has just begun.

As for the work about laboratory support of IS education, we mention only the pioneers like [START_REF] White | Developing an Undergraduate Lab for Information Warfare and Computer Security[END_REF][START_REF] Armstrong | The Virtual Campus[END_REF][START_REF] Gritzalis | Action Learning in Practice: Pilot delivery of an INFOSEC University laboratory course[END_REF][START_REF] Hoffman | Information assurance laboratory innovations[END_REF], followed by many lab descriptions worldwide in the next years. These works provide useful instructions in designing labs and developing an education process based on them. The authors also have their own experience in starting the "Network Security" laboratory in 2000 [START_REF] Miloslavskaya | Network Security Scientific and Research Laboratory[END_REF], and continuing through the present [START_REF] Ismukhamedova | Practical Studying of Wi-Fi Network Vulnerabilities|[END_REF]. Subsequent publications show how to use virtualization technologies in the education process (like [START_REF] Dodge | Using Virtualization to Create and Deploy Computer Security Lab Exercises[END_REF]). These technologies are very useful as they have the necessary tools to build complicated virtual networks on virtual machines and show all the IPTs' functionality.

GENERAL NSIC DESCRIPTION

Automating all routine operations and IS incident response that do not require expert decision-making is an urgent need for any modern organization. It should set up a more advanced IS management center than a traditional SOC. The so-called SIC with an integrated attack defense architecture provides full visibility, control and contextdriven security intelligence (SI) in one place to temporarily deal with higher-level IS events. By implementing SICs, organizations get a holistic, in-depth view of their "IS health" and can not only detect and recognize attacks, but also effectively predict, prevent, and address IS incidents before they cause harm, thus constantly gathering data and producing new IS-related knowledge. The SI concept emphasizes the need to not just collect data but also learn from it in order to continually stay ahead of intruders. Viewing time-stamped historical data or logs is very important for IS incident investigation. But stopping IS incidents is possible only when you have a real-time view in a concrete context of what is happening right now so you can find something unusual, across the entire network. Any delay, and only reactive actions, put an organization's assets at risk. Hence, the goal of SI is to provide proactive, predictive (forward-looking), actionable and comprehensive protection and insight into IS that reduces the IS risks and operational effort through advanced analytics. All information that SI deals with is processed, sorted, aggregated from reliable sources, crosscorrelated for accuracy, assessed for relevancy, evaluated and interpreted by analysts at the final stage if needed.

The NOC's aim is to support a centralized place from which network administrators can remotely supervise, maintain and monitor their telecommunications networks using appropriate management software, and visualize their detailed status with all devices that are being monitored. The NOC can be considered the focal point for the following typical activities: network discovery, assessments and management; optimization and quality of service management and reporting; domain name management; constant research of anomalies and problems (troubleshooting) to make adjustments, marshal resources and respond to emergency situations; application software installations, distribution, troubleshooting and updating; performance monitoring, reporting and improvement recommendations; backup and storage management; email management services; voice and video traffic management; basic (elementary) IS controls like authentication and authorization, IP-and MAC-address filtering, etc. The NSIC's key objective is to move SI to organizations' NOCs, allowing them to stay ahead of IS challenges while being fully integrated around their main business processes. To implement this idea of migration to the NSIC is possible because both the SIC and NOC operation functions are frequently organized in a similar way, which is based on a tiered approach with similar roles, and share some tools. Their union would be very beneficial in the long-term as the NOC's primarily concern is serving the business, while the SIC's main focus is to ensure its security. When an outage is detected, the NOC's staff is likely to attribute the disruption to device malfunction or system issues and attempt to address it through hardware replacement or configuration adjustment. But the SIC's personnel are likely to attribute the problem to malicious activity and will thus prompt an investigation before initiating IS event response actions.

While designing the NSIC, we have focused first on its self-protection. For that purpose, we defined all information resources that are to be protected within the NSIC (using the common approaches of asset inventory and categorization as the initial steps of IS risk assessment [START_REF]Information technology --Security techniques --Information security risk management[END_REF]). It is typically sensitive data used in a typical network of an educational institution, for example proprietary information of limited propagation, sensitive information related to the NSIC's activities, personally identifying information (PII) of its staff and trainees, learning and testing materials protected by copyright, keys, credentials and passwords, etc.

Then, based on a comprehensive analysis of the security level of our department network (investigating logs, using security scanners, for example), we worked out two generalized IS models for the given network, presented in documents of many pages. The first onean IS threat modelincluded a formalized description of IS threat sources [START_REF] Malyuk | Information Security Theory for the Future Internet[END_REF], vulnerabilities exploited by them, objects suitable for the threats' realization, threats implementation techniques (actual attacks), types of possible loss, extent of the potential damage and some additional information such as likelihood of threats implementation; destructive impact (including interconnecting); damage elimination/limitation; impact frequency and duration, etc. The second model (an IS intruder model) contained a formalized intruders' classification and description of their experience, knowledge, available resources for IS threats implementation, possible motivation of their actions and IS threats implementation techniques.

After that, we developed an IS policy for the NSIC that ensured meeting the key goal of its IS, namely achieving adequate protection of NSIC's information assets and business processes, and allowing its continuous operation under IS threats. Among the most important IS policy requirements are the following:

 Usage of all applicable IPTs and IS controls;  Establishing monitoring and auditing policies and procedures;  IS event and incident processing;  Vulnerability management;  Configuration and changes management;  User' s activity registration;  Filtering of incoming and outgoing traffic;  Protection against computer viruses and unauthorized software modification and insertion;  Control over all NSIC's computer port usage;  Protection against DoS attacks and unauthorized scanning; and  Setting responsibilities for IS policy violation, etc.

NGFW STUDY

Now, the most common IPTs are hardware and software firewalls (FWs), which provide network traffic control based on packet filtering in accordance with the rules of organization's IS policy. As a result of their evolutionary development, the first specialized solution with Deep Packet Inspection (DPI) and detailed and customizable control at the application level appeared in 2007. NGFW unites on one platform multiple IPTs such as FW, IPS (Intrusion Prevention System) and Web security gateway.

Policies for applications, users and sessions are defined in a NGFW within certain contexts, not just for ports and IP addresses. User identification, which allows integration with various organization's directory services, is implemented in a NGFW. A NGFW can work with encrypted SSL-traffic on all ports. This IPT can receive black and white address lists from trusted external sources and apply them to the relevant filtering rules. Indeed, NGFWs work faster and support more complex rule sets than their predecessors. According to a Gartner survey [START_REF]Magic Quadrant for Organization Network Firewalls[END_REF], 40% of companies use NGFWs to protect their intranets, and by 2018, 85% of all FWs will be NGFWs.

Based on the analysis of the leading vendors for NGFW, as well as NGFW functionality, we concluded that the Palo Alto Networks NGFW [http://www.paloaltonetworks.com] meets the requirements of our NSIC. It also can be implemented in the VMware environment (as a virtualized NGFW) that is well suited for carrying out laboratory work with NGFWs. Due to our collaboration with Palo Alto Networks, we obtained this solution for our educational purposes.

To develop students' skills in configuring NGFW settings and customizations and taking into account its capabilities, we created a laboratory bench. The laboratory bench is designed to test all basic NGFW functionality (Fig. 1) in the form of a oneway gate. One student uses one computer with VMWare Player and one image of the VM-300 (Palo Alto Networks) virtual machine. All computers in the classroom are connected in a single local network and receive their IP addresses using DHCP from the 192.168.1.0/24 network. The students run a virtual machine image, configure NAT and routing for the virtual 172.168.1.0/24 network. When they are trying to connect to the Internet, the traffic generated passes through the NGFW.

Fig. 1. The scheme of a one-way gate

This laboratory bench meets the following requirements:  Flexibility, as its structure should be easily reconfigurable: different lab tasks require specific network topologies and host configurations,  Scalability, for simultaneous task performance by 16 students in the NGFW laboratory and two others (with DLP and SIEM systems); the main resources are located on each computer, and we have a distributed network which does not depend on a centralized server;  Profitability, as the cost of NGFW installation and maintenance in the laboratory is significantly less than the cost in the real intranet, taking into account that the lab should effectively simulate the processes in real networks;  Reliability, as the laboratory should be able to easily recover from accidental damage by the students, as well as be able to quickly restore the default settings and network configurations; and  Isolation, as it should be isolated from the remaining part of the NSIC and not affect its operation; the internal LAN is isolated from the outside NSIC's network. Each student works within the same LAN. The work task implementation will not cause any inconvenience to other NSIC users. Thus, the laboratory bench allows each student to test the NGFW functionality by himself.

On the basis of the rules of the IS policy (Section 3), the following context for laboratory work was defined:

1. To prohibit all traffic between some subnetworks, except for that authorized by a network administrator; 2. To use the NGFW only in a router mode; 3. To allow all hosts from 192.168.2.0/ 24, 192.168.20.0/24, 192.168.21.0/24, 192.168.200.0/24 networks to access the Internet; 4. To identify the applications at OSI layer 7 by signatures; 5. To decrypt all SSL traffic from the 192.168.200.0/24 network, and if that fails, then block this traffic; 6. To allow access to the DMZ servers from the internal network; 7. To permit only those web-mail applications that use MEPhI's email; 8. To block access to phishing and malicious URL-addresses from the 192.168.200.0/24 network; 9. To analyze the frequency of HTTP, TCP, UDP, ICMP packets to web and DNS servers; 10. To analyze .exe, .dll, .bat, .sys, .flash, .jar, .doc, and .pdf files for malware using behavioral anti-virus mechanisms; and 11. To block encrypted documents and files downloaded to the 192.168.200.0/24 network, etc.

To start with, we created 5 laboratory exercises, and will be adding more to these in the future. Each lab is designed for 4 academic hours (with all controls and tests).

Lab #1 "First NGFW installation and configuration".

Objective: to get skills in installing a NGFW, configuring routing rules, and defining user accounts and security certificates (create, import, and export).

Student assignment: to configure the static routing rules (e.g., all incoming traffic is redirected to the next router at 192.168.1.1); to configure the network address trans-lation (NAT) rules (for example, translate dynamic IP and port type, interface address type, Ethernet ½ interface, etc.); to create a trusted client's connection to the NGFW; to create a user with administrator privileges; and to set up two-factor authentication for the NGFW administrator.

To confirm the successful task execution, it is necessary to demonstrate to an instructor the following features (controls): the ability to connect to the Internet from the 172.16.1.0/24 network; a trusted connection to the Palo Alto Networks Web interface; multiple users authenticated as administrators; two-factor authentication of an administrator, using a password and a client certificate.

2. Lab #2 "SSL/SSH traffic decryption" (Fig. 2).

Fig. 2. SSL traffic decrypting scheme

Objective: to gain skills in installing a security certificate, decrypting SSL/SSH traffic, and intercepting and analyzing packets captured with the Wireshark traffic analyzer software.

Student assignment: to create a self-signed certificate; to configure SSL decrypting rules; to capture packets using the Packet Capture technology; to analyze packages using Wireshark.

Controls: interception and decryption of https traffic from the student's computer; filled-in data from an authentication form (such as https://accounts.google.com/) found by the Wireshark.

Lab #3 "User identification (User-ID)".

The authentication profiles define the configuration of a local database, RADIUS, LDAP and Kerberos, and can be assigned to administrative accounts and provide VPN access. The NGFW checks the authentication profile assigned to the account and authenticates the user based on the specified settings.

Objective: to gain skills in identifying the users who have requested access to the Internet, configuring the authentication profiles, creating a local user database, configuring LDAP server settings, and using security certificates for authentication.

Student assignment: to configure user authentication rules; to set up forwarding to a Web form to enter a login name and password; to set up a security policy based on user ID. Controls: redirection to a web form and user network authentication; the use of various filtering rules depending on the user authenticated in the network.

Lab #4 "Identification of applications (App-ID) and data control (Content-ID)".

Creating and managing security policies based on application and user identification, regardless of device or location, is more effective for network security than making a decision based solely on ports and IP addresses. Integration with enterprise user directories allows the users of Microsoft Windows, Mac OS X, Linux, Android, and iOS, who are accessing the applications, to be identified. The combination of application usage monitoring and control means that the protected usage of Oracle, Bit-Torrent, Gmail or any applications used in the network, regardless of where and how the user accesses it, can be ensured.

Objective: to gain skills in identifying applications (regardless of port, protocol, encryption or masking techniques used), traffic analysis, limiting unauthorized transfer of files and data traffic, filtering by URL addresses, and blocking unknown or targeted malware.

Student assignment: to add new URL filtering rule; to set the time interval following the Continue action of the user; to set the time interval after the user enters the admin override password; to apply different filtering rules to the URL categories; to select different filtering rules for all the proposed file extension types; and to apply the filtering rules created in the policies section.

Controls: the use of different filtering rules depending on the application, for example, to block all Tor connections; the use of different filtering rules depending on the extensions of transmitted files, for example, to block downloading executable files; the use of different filtering rules depending on the web page category or URL, for example, to block all anonymizer sites; the application of any method of traffic masking, such as TCP over DNS tunneling; and a demonstration of the ability to protect different applications used in the network.

Lab #5 "Prevention of threats and vulnerabilities".

An NGFW with an Intrusion Prevention System (IPS) inside neutralizes the threats associated with network blocking, application level vulnerabilities exploitation, buffer overflows, DoS attacks, port scanning, etc. Antivirus and antispyware software blocks malware, as well as command and control traffic generated by malware, viruses in PDF files and malware hidden in compressed files or web traffic. Based on security policies, the decryption of SSL traffic for all applications and ports provides protection against malware that attempts to gain access through applications using the secure SSL protocol.

Objective: to gain skills in protecting networks against computer viruses, worms, spyware and other malicious traffic using security profiles; detecting and eliminating vulnerabilities of network applications inside the LAN; identifying hosts infected with bots; and detecting and preventing known attacks.

Student assignment: to set the rules for signature-based anti-virus tools; to set the rules for behavioral anti-virus tools; to set the rules to detect attacks such as HTTP, ICMP, UDP and SYN flooding.

Controls: blocking malicious files by the signature-based anti-virus tools; blocking computer virus (obtained from the instructor) by the behavioral anti-virus tools; any method known to the student to conduct HTTP, ICMP, UDP and SYN flooding and its detection and prevention using the NGFW.

We make one short note on the current context, in which the students carry out their exercises: all of them are given the lab descriptions (30 pages in total) in advance, to provide the opportunity to be better prepared to work and demonstrate their knowledge on the progress test after it. In order to complete the labs successfully, the students must pass tests consisting of 30 questions.

Another note concerns privacy. It is a separate issue that requires special study in the framework of different disciplines (not only technical network security). That is why it is not been considered in this paper.

The labs have been successfully tested within the "Information Security of Open Systems" course for the 5 th year Specialists (2 groups, 40 students) and the "Objects' Information Security Maintenance Technologies" course for the 2 nd year Masters (5 groups, 60 students).

CONCLUSION

All scientific studies facilitate new learning and vice versasome interesting issues that require additional investigation can be found during practical work. An NSIC can be regarded as expanding knowledge and skills through creative research and discovery. Consequently, the NSIC's project relevance is determined by the urgent needs to create a scientific, methodical and material base for network security professional training through the use of modern and advanced ICT and educational technologies, as well as the conditions necessary for MEPhI to compete successfully among world educational centers. The vision of the center is to be recognized at national and international levels for excellence in advanced network security management and professional training. We shared our short-tem experience in starting the development and use of our NSIC in the framework of the MEPhI ICIS. As can be seen, it is a work in progress and there is still much to do. Our future work is intended to finalize the creation of the second and third NSIC's DLP and SIEM laboratories. After that, all three core IPTs (NGFW, DLP and SIEM systems) for the NSIC will be deployed.

We presented the NSIC's usage only in term of educational process improvement, in particular for studying NGFWs. Our ambitious plans in this direction include but are not limited to the following: development and subsequent implementation of educational standards; new programs (curricula) and competency models for different educational levels for specialized professional training in the field of network security; supervising PhD students carrying out their research within the NSIC's topics; conducting summer schools with intensive network security programs, etc. NSIC can be reasonably used to create a trusted educational environment for blended learning with a set of e-learning courses on network security management.

The created center is also expected to carry out research on the NSIC's design, effective network security management practices based on intelligent approaches and applications, the use of Big Data technologies for IS-related data processing, and the study of the compatibility between different IPTs and make recommendations to address arising issues, as well as evaluating network security.

To publicize the NSIC's activities and to post its news and offers in education and joint research, we are creating a secure web site for it.

6

ACKNOWLEDGEMENT

This work was supported by Competitiveness Growth Program of the Federal Autonomous Educational Institution of Higher Education National Research Nuclear University MEPhI (Moscow Engineering Physics Institute).