Information Security education benefits greatly from hands-on laboratory oriented exercises. Campus students often have access to security lab equipment. However, remote students, who never visit the campus, often have no laboratory access at all. While previous literature describing designs for information security laboratories are seldom based on specified pedagogical approaches or systematic design theories, this paper contributes by outlining a design theory of online InfoSec labs based on the “Personalized system of instruction” (PSI). We also illustrate the PSI-oriented approach to on-line information security education with help of design suggestions and general level evaluation measures.