GitLab PubSec & Regulated Industries, 25 Sep 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Commit Virtual 2020: How the U.S. Army Cyber School Created ‘Courseware as Code’ with GitLab

Description

Speaker: Ben Allison

While the information security space is constantly changing, the United States Army training enterprise operates on a three-year curriculum update cycle. At its inception, the U.S. Army Cyber School recognized this challenge and created a streamlined courseware process using Git to track all instructional material as code. Rather than office documents and static virtual machine snapshots, the school uses markup languages to define instructor and student material, slide decks, and facilitation guides linked to code-driven frameworks to define all training networks, workstations, and activities.

Learn how the Cyber School reduces effort and increases efficiency and transparency necessary to maintain their curriculum relevance and currency.

Get in touch with Sales: http://bit.ly/2IygR7z

A

When you think of innovation, you don't necessarily think of the department of defense, but captain ben allison with the u.s army. Cyber school is here to talk to us about how the u.s army cyber school created coresource code with git lab. They were able to streamline their courseware process using git to track all their instructional material as code. This enabled them to reduce effort and increase efficiency and transparency necessary to maintain their curriculum, relevance and.

A

B

Hello, my name is ben allison.

B

Today, I'm going to be talking about how the united states army cyber school is using git lab to track and manage our curriculum and courseware as code to briefly introduce myself, I'm an army captain I've been in the army for about six years. I studied computer science at my in my undergrad, and I've been at the cyber school for the past two years, working on building a new pipeline for officers who are going to join the army.

B

As software engineering and a new specialty of the army is creating, the cyber school itself was founded in 2014.

B

The first students came less than a year later in 2015 and when students graduate they primarily work in the severe mission force. The cyber mission force is a joint force that works under united states cyber command, and so when they go to cyber mission force, they work in a joint environment with the air force, the navy submarines and then, of course, the army. Additionally, we have soldiers who now are are going out to the broader army beyond the cyber mission force, so they'll go to regular army units.

B

As well so when we talk about the cyber branch in the army, this this memo was drafted and published in august of 2014. So the time kind of shows how young this hover branch is in the army. When you say the term branch everyone's familiar with many people are familiar with. The dod has the air force, the navy, the army and and the marine corps, which falls under the navy technically, but then within the armor.

B

We also use this term branch to just to talk about how we group specialties within the army, so you have branches like armor or infantry, so those are more familiar, combat arms roles that the army associates or people associate with the army. uh Other things like field artillery aviation, so they fly helicopters would be aviation, armor tanks, field artillery they manage the artillery, the mortars things like that, uh then you have more technical specialties, such as the signal core. So the signal core is what enables the army to communicate.

B

So all the soldiers who focus on telecommunications and more I.t centric communication, now that we have uh the 21st century with actual computers that all falls under the signal core. However, the army created the cyber branch, it's similar to the signal core, but rather than being I.t centric. The cyber branch is focused on what they say.

B

What the phrase is creating offensive and defensive effects in cyber space, so when say affects we're thinking the ability to create an outcome so degrade deny so we're trying to deny enemy the ability to create effects in our own equipment and we're trying to support uh army forces in a state of war to create effects against our enemies and, when I say, cyberspace, they're talking about primarily in this context, ipcentric computing and rf based computing, so so that entire space is kind of what we group under cyberspace within that, which is, of course, cyber is used everywhere.

B

But but that's kind of a more more specific term when we use cyber in the army.

B

So, in that context, when the army is building a new schoolhouse and a new training pipeline for for a whole new specialty, normally when the army has training, they focus on things like what we see in the lower left-hand corner. You have that's the abrams tank. It was created in the 80s, it's approx about 40 years old now in 2020, and not much has changed over that time.

B

There are improvements and upgrades and so on, but if you're trying to teach someone how to operate this vehicle generally, there's not many changes and when they do change, they're very controlled changes. So you'll get a list of hey, there's a new upgrade to this new system and here's how it changes, how you teach it, which then feeds into a very slow, controlled process for how the army is going to update its curriculum and generally.

B

This is okay, and this is more what you want, because tactics are not changing very often, maybe over decades, technology might change things or different types of warfare might change how you would teach things in your curriculum, but you want to be controlled and you want to be able to monitor it and make sure you're not changing things in a way, that's harmful, uh and that ties back to what we see here as a checklist mentality and that's where, if there, if there's a maintenance, you need to do in this vehicle, there's a checklist of maintenance.

B

You need to do or if there's a task. You're doing you want to follow this procedure. I did in the same way every time to ensure everyone knows how to do it and you train it and it becomes muscle memory that way when you're in stressful situations, the muscle memory takes over and so that ties into what we see next to this picture of the tank. It's a web interface called training development capability. So the army uses this this web interface in the backend database to train all of its curriculum.

B

So they they map essential tasks which are things that units have to perform at the individual and collective level to prove that they're ready for for their mission, and they tie those back to lesson plans at school houses for their respective specialties for how they train their soldiers, and so this process is very uh labor intensive. There's a when you create a lesson plan, there's several different clicks: the typing and manual entry use with a mouse and a computer and someone who's trained and has access to the system.

B

Another point is: it doesn't have api access so, if you're trying to update something you wanted to automate and update. Unfortunately, this entire process has to be done manually by a human service at the cyber school when we're creating the cyber branch and creating the school to go with it. uh The individuals who are here when they were first standing up.

B

They wanted to find a way to be more agile in how they manage things, because the information security space is much different than than the traditional army apparatus that supports training, for example, where things don't change very often in typical warfare training. The information security space changes very often a three-year cycle would mean that we're always behind the curve, because things constantly change in information security something three years ago, is not necessarily true. Now and then tactics and proceed techniques, change operating systems update.

B

All of that those type of changes we want to be able to capture so that we're not stale and three years behind whenever we're teaching curriculum. Likewise, where the operational force, typically in the army, is focused on checklists and a very defined definition of what it means to be ready for their mission in cyber, that's not really the case in information security. The problems are not as concrete that you can follow with the checklist.

B

Instead, we want people to be able to absorb and understand poorly defined problems and then break it down into technical steps and apply what they've learned and learn how to find out what they don't know to teach themselves to solve problems, so we're very focused on outcomes that are focused on problem solving rather than solving checklists and then, additionally, when we look at how the government has approached us before we're, not the first course in the army or in the dod, that has technical courses.

B

But one thing that that we saw in other places is that many times when they have technical environments, they they build virtual labs that might be manually configured, and so someone would go in. Who knows what they're doing they configure an environment for to teach students and they might save it as a snapshot? And then, if you want to give it to every student, you would snapshot it multiple times or copy that snapshot across the board.

B

Other some very well known uh industry, certification courses that distribute their their course material and thumb drives to students and virtual machines that you copy over. While this can work, it's very difficult to scale and it creates a very high cost to develop new curriculum, and so, if you want to maintain your your curriculum or update it, there's a lot of labor, that's involved. So at the cyber school uh we we decided to apply software engineering principles when we're developing and managing our courser instead.

B

So when we talk about courseware, this is all the instructor material, the student material and the lesson plans that support training development capability that come out of our our curriculum in our for that support, a lesson outcome, and then, additionally, it is the the environment. The virtual ranges that students practice activities to demonstrate their skills and learn uh that all support that outcome.

B

So for us, the coursework, primarily we use ascii, doctor and markdown for all products that would be as a replacement to powerpoint or word or things like that, and then we track it in version control using git and gate lab, and that provides us by line version control and we can receive feedback for that versus a powerpoint, which is a binary blob that you can't really drop it. You could you could store it in gitlab or in git, but you wouldn't be able to see changes by line in between uh new commits and then.

B

Finally, once we have all the coursework managed, we build pipelines that support different end users. So if the students, if we want to take this product and build for our students, we write it once and in the pipeline, we'll pull out anything that's restricted to the instructor, and then the students will get a view of their content. Likewise, for uh for instructors, they would get their own view with all the products that have to go with them to help them teach that way.

B

The people who are teaching don't have to actually go into git and view products that way they can actually just pull up in the web interface, which we store on gitlab pages, to view their products and so and so as a quick example. Here we see on the screen, we have a a. This is a byline change that was very cosmetic, so it didn't need to go up to a serious process.

B

They just wanted to add syntax highlighting, so we can track to say hey, who made a change to this facilitation guide for the instructor and we can see what was changed and when it was changed, and then there was a reason why and so what this builds for us is a web interface. So this is a static page hosted in gitlab pages, so gitlab pages also gives us the access control.

B

So we can say some repositories have a list of users who can access this and then the second repository can have a list of users who are students and students can only access, maybe guest access to this project, and they can see all the pages that go with it. So this one is using asciidoctor and antora, which is limited to ascii doctor, so it provides all the material necessary for the summon cyber common technical core, which is one of our our primary technical courses.

B

So here's a different view using hugo, so this supports ascii, doctor and markdown, and so this builds again. This is a student view, so this would show the the slides and the student guides and all of that in a web format and any additional files or handouts that would go with it to support an outcome for our lesson.

B

Finally, the next piece that goes with this is, as we have the coursework for the actual the guides for instructors and students, which are the slide decks in in books and all of that material. We also have the infrastructure, so the infrastructure we we apply the concept of infrastructure as code, which means you define your networks, your virtual machines, your servers, all of that in code, using a we use, yaml, which is a simple markup language, uh to define an entire template for a network for classroom activity or for an entire module.

B

In some cases, and in those templates they have what's called user data for virtual machine, and that is where we put all the configuration scripts that get fed into the virtual machine after boots. So what happens? Is we have a single standardized set of windows and linux, virtual machines or other different architectures and operating systems as necessary?

B

And they are stored as a we store that once we manage those once but then when we want to deploy it for a class. We use these heat templates, which are those yaml templates to get fed into openstack, which is our private cloud. And then the user data feeds into cloud init, post boot and custom configurations can be applied across all those virtual machines. So one individual or one instructor can build an exercise for a student once and then we can scale it across the board as many times as we want.

B

So every student can get their own identical range, which gives us then the guarantee that everyone's getting the same experience from their testing when they're, when they're completing exercises and testing additionally allows us to take advantage of get lab, ci pipelines. So when we make changes and then say, we want to update it for the next class and there was a cosmetic change we just make.

B

All of our changes in code make the newest commit, and then we have a manual ci pipeline that can then deploy all of our infrastructure into openstack automatically through gitlab, and so we can see again here. Here's an example of the byline version control for this. So here when someone's fixing a typo and that's one of those, this is examples of that granular control we get from it, and so once this deploys we have. uh This is here's an example of the ci pipeline, for that course we saw earlier cctc.

B

This is a security module for that it's one of the sub modules, and so they have they deploy. Every student gets one deployment for their entire class, so the ci pipeline runs and it it clones all the repositories it needs it uploads any objects uh to open stacks direct object stores. It builds all.

B

The templates into openstack saves the output from those templates, which are you can configure heat temperature to return variables like public iop ranges and ip addresses that get assigned, and then it builds a capture, the flag framework using ctfd, which is an open source project to manage capture flags and it builds custom activities for the students with guides and prompts, and all of that, tailored to that specific deployment.

B

And, finally, it's able to validate all of that to ensure that all the stacks deployed so that every every student's uh environment we know that more or less it actually deployed the way we wanted it to and someone's not going to get into class and be in the middle of an activity, and we find out. Oh this didn't deploy. Writing we have to go back and manually do it, while students are in class. The goal is to get that done before ahead of time in case something fails.

B

So in the product that we see here. This is a student range. This is a single identical range deployed twice so on the left.

B

You see in the lower left hand, corner, there's the same environment and then the top it's the same thing deployed- and this is this- is a security module of cctc deployed by the framework, and this is what it looks like in openstack when it's deployed, and that was all done through a pipeline, so we only had to do it once and then we were able to repeat it across for the entire class in the rest of the screenshots.

B

It's cropped out, but you can see the entire class is in this project and all of their ranges are built at the same time in the same fashion. So this has done for us. We've gone from a three-year process.

B

What is what the army provides us before, and now we have the ability to support instant feedback, and then we can tailor how we change our curriculum based on the nature of that feedback. If it's a small cosmetic change- and we can make it immediately if it's a outcome, altering change, it has to go up a more formal process, but we can tailor that based on the need of the the change, we now have version control, that's by line versus no version control.

B

We now have automated builds versus manual infrastructure deployment, so we can automatically build it after we have it set and ready to go, and then we have interactive tests so, rather than having a paper test which was before in the early days of the course uh schools. Rather now we have interactive tests, especially in like courses like cctc, where the entire capstone is a several hour test in an interactive environment in the future.

B

We'd like to do standardization so become cloud agnostic with technologies like terraform, standardize how we're doing it across all classes, rather than every class implementing its own on its own and then implement gamification as code uh to make ctfd really standardize. We'd also like to collaborate with other partners in the joint environment, so other service branches, like the air force, we're working with to help build a to work towards it and how come?

B

We have a standardized technical curriculum across the board that we can share downstream and not repeat ourselves, and then finally, we'd like to apply these standardized formats in the future, to create make technical curriculum available to people in high schools who may not otherwise have access to technical curriculum by reducing the cost by employing courseworkers code across the board.

B

This concludes my talk. I'd like to say thank you to gitlab for the opportunity for the cyber school to tell our stories, and thank you for your time for.

B