Teaching students to hack

Abstract

Teaching "hacking" as a legitimate means of training students in how to protect a future employer's data assets has been introduced into courses with increasing frequency. The introduction of "red teaming" and attack-based exercises into information security courses presents a potential ethical problem. This paper explores the issues involved in designing an information security course with lab components that involve destructive actions.