Virtualization Technologies in Information Systems Education

1. INTRODUCTION Information systems educators often encounter control and management issues with regard to shared computers in university laboratories; when students use computers in laboratories, they are using equipment that must be available and operational for the next student (Hu, Cordel, and Meinel, 2004). In many cases, the transition time between users is short as is the case between class sessions. As a result, there is a need to regulate the use of these computers to ensure availability. Often, the solution is to lock the computer down so that students are unable to make changes to settings or the computer rolls back to a stable state after a reboot; for example, products such as Faronics Deep Freeze (http://www.faronics.com) prevent permanent changes to desktop configurations. At the same time, problems arise when the restrictions placed on the use of a computer in a laboratory interfere with the instructional objectives of the course. Information systems curriculums address a wide range of topics. Students work with personal productivity applications such as word processors, spreadsheets, presentation graphics, and database management systems. These applications generally do not pose a threat to availability of shared computers. Students taking more advanced information systems courses often need access to sophisticated tools as well as the capability to install and configure applications. For example, to understand fully the issues associated with information assurance and the implementation of appropriate security controls, students need to work with tools that may pose a threat to the stability of systems. In some settings, students, especially upper-level students, need exposure to information access controls, password-auditing tools, firewalls, encryption, and similar tools, as well as the tools used by attackers to compromise the security of systems and information. Students may also need to work with system settings and otherwise manipulate their computers. This is something network administrators work hard to prevent. Kroeker (2009) describes uses of virtualization by hardware and software vendors, including as a tool for distributing software, enabling cloud computing, and enhancing security. Virtualization technologies offer similar benefits to IS educators and students. Using virtualization technologies, students may work with systems in ways that would otherwise be undesirable because of the threat to the stability and availability of computers in shared laboratories. Additionally, virtualization enables a student's changes to remain persistent between sessions so that the student can engage in extended projects and projects that build on one another. This allows faculty to extend the range of topics covered in information systems courses, as well as integrate more risky, hands-on activities. At the same time, since the student is working in a virtual environment, the host computer remains unaffected. This paper describes the use of virtualization in a business-oriented information systems security course focusing on the formulation and implementation of policies for information assurance, desktop security, and the examination of security measures. This paper consists of four major sections. The first section is an overview of virtualization and virtualization technologies. The second section reports on the use of virtualization in an information systems security course. The third section discusses potential limitations and challenges when using virtualization in the classroom. The fourth section describes additional applications of virtual technologies in educational settings. 2. VIRTUALIZATION TECHNOLOGIES Organizations are adopting virtualization, in a variety of forms, to address challenges in computing (Brandel, 2005). Drews defines virtualization as follows: In a nutshell, virtualization means abstracting a computer's physical resources into virtual ones with the help of specialized software. …