An Internet$-$based information security lab, or lab, is a collection of systems and software used for teaching information security. Laboratory exercises give students practical experience with security vulnerabilities, security testing, and defenses. The students are not physically in the laboratory, but access it through the Internet. The lab comprises four kinds of entities: servers, sources, targets, and exercises. The first three are specially configured host systems in the lab. Servers provide presence for the students in the lab; servers do not participate in the exercises. Sources and targets participate in the exercises, with at least one source and target for each exercise. The exercises are either exploits or defenses, from the students point of view. Each exercise has two parts: documentation and implementation. The documentation is provided by the instructor and usually consists of files and code samples that explain the exercise. Students are allowed to access the documentation for an exercise and are expected to construct and demonstrate an implementation. The instructor also provides a model solution which is not given to the students until the exercise is completed. Before each exercise, the lab is configured by an administrator. After the exercise is complete, the administrator restores the lab to an appropriate configuration.