PSA 547 Information Security and Technology

PSA 547

Information Security and Technology

Professor: Dr. Tina Ebenger Office: 510

Office Phone: 219-473-4392 Home Phone: 219-365-9024 E-mail: [email protected] (office)

Course Time: Thursday, 8:30 – 12:30 Thursday, 6:00 – 10:00

Room 204 – CCSJ and Room 419 – CCSJ (computer lab)

Professor Background: Dr. Ebenger received her Ph.D. in Political Science from the University of Cincinnati. Her dissertation title was “Privacy, Technology and Public Policy: The Case of Electronic Mail.” Her research and teaching interests include: the Internet, technology, public policy and privacy; civil rights and civil liberties; corruption in politics, and voter participation.

Course Description: This course focuses on the personnel, legal, regulatory and privacy issues that constitute many of the basic management areas that must be considered in developing and implementing an effective information security program. The course examines the legal basis for privacy and security of information and related technologies. Students study the USA PATRIOT ACT, GASSP (Generally Accepted System Security Practices), security best practices, and appropriate organizational responses to risk associated with the integrity of information. Presents methods and procedures for the assessment of risk, and examines strategies for mitigation of risk involving operational procedures, political issues in the organization, and the implementation of an enterprise wide security strategy.

Learning Objectives:

At the end of the course, the student will

• know and comprehend the fundamental principles and concepts of

information security including the Common Body of Knowledge

• develop a basic knowledge of computer hardware, Internet and security

architecture, and related security software

• recognize and distinguish between risks, threats and vulnerabilities on/to

information systems

• understand the legal and ethical aspects of information systems security • be able to analyze and evaluate the effectiveness of security

strategies/plans of information systems

• oversee the development and implementation of practical strategies/plans

to secure information systems

Textbooks:

Security: Information Security: Principles and Practices, Mark Merkow and Jim Breithaupt, 2006.

Information Security: Contemporary Cases, Marie Wright and John Kakalik, 2007

The Art of Deception, Kevin Mitnick, 2002

Dictionary of Computer and Internet Terms, Barron’s Business Guides, 11th edition, 2013.

Assessment:

Exercises/Projects (5, 3pts. each) 15% of grade Group Project/Presentation 30% of grade Three Papers (15pt. each) 45% of grade Class Participation 10% of grade

___________________ 100%

Class Policy for Assignments: Exercise/Project Assignments:

Each week, there will be a set of exercises or projects assigned for that reading assignment (see Schedule of Readings, pp. 5-7). Note that each chapter has Exercises and Projects but you will only be assigned one or the other. Make sure you are doing the right assignment. If an exercise is assigned, it should beone-half page, at a minimum, and the projects should be one page, at a minimum. Each paper should be typed, double-spaced, 12 pt. font, and are DUE the date they are discussed in class.

There are several in-class assignments noted on the syllabus. They are exactly what they say they are: we will complete the assignments in the computer lab here at CCSJ. You do not need to do anything prior to the assignment other than look it over and ask any questions you have about them in class.

There are also three papers due for this class. The questions to be answered in these papers are:

Paper #1 – The CIA triad - confidentiality, integrity and availability - are goals for information security. Discuss each one and give instances where one goal would be more important than the other. How would you guarantee confidentiality, integrity or availability in your examples? DUE May 14. Paper #2 – Create a fictitious company and create a complete business continuity plan (BCP) and a disaster recovery plan (DRP). Project 6.1, p. 138 DUE May 28.

Paper #3 – Of the 10 domains of common body of knowledge for Information Security, which do you believe is the most significant? Give reasons for your answer, as well as summarize that particular domain. DUE June 11.

These papers should be 3-5 pages in length. They must be typed, 12 pt. font, and double-spaced. Also, THEY MUST BE IN YOUR OWN WORDS. DO NOT CUT AND PASTE, OR COPY FROM THE BOOK WITHOUT PROPER

CITATION. ANY PAPER CONTAINING SOMEONE ELSE’S WORDS

WITHOUT PROPER CITATION (PLAGIARISM) WILL BE RETURNED WITH AN “F” GRADE.

If any student is caught plagiarizing any assignment, they will receive an “F” for that assignment and will receive no higher than a “C” for the course.

Also, it is advised that students complete the self-test at the end of each chapter. It will not be graded but it is a good way to review the material in the chapter and to make sure you have grasped the main points.

Group Project/Presentation: Students will be divided into groups of four (4) and will be assigned a project. The project will consist of a case study of a company, school, retail establishment, public library, or a place of your choosing. The name of the establishment where you are doing your case study is due the second week of class, Thursday, May 14, 2015.

The case study should include: the size (the physical location as well as number employees); the products made/sold or the services provided; what information is stored and how; the methods by which the information is secured; the problems they have been faced with and how they have dealt with them. (A handout with specific questions will be provided the first day of class so you have a template to work from.) You will conclude with an evaluation of the security procedures in place, any problems you foresee, and suggestions to address these problems. Each group will present their project to the class during the last class of the course (Thursday, June 18, 2015) and submit a paper (7-10 pages, and no less than 7 pages) regarding their findings.

Class Policy on Attendance:

As this is an accelerated course, attendance is crucial. Therefore, one excused absence will be accepted; however, two absences, regardless of it being work-related, excused, etc., will result in a grade of no higher than a B for the course. It is suggested that if you cannot attend the full amount of classes at this time, you withdraw from the program and re-enroll when you can commit more time and effort to your studies.

Statement of Plagiarism:

If an instructor or other Calumet College of St. Joseph personnel find that a student has plagiarized or been involved in another form of academic dishonesty, the instructor or other personnel may elect to bring the matter up for judicial review. The maximum penalty for any form of academic dishonesty is dismissal from the College. The procedures for judicial review are listed under the section of CCSJ handbook that addresses student grievances.

Grading Scale:

A: 100-93 B+: 89-87 C+: 79-77 D+: 69-67 A-: 92-90 B: 86-83 C: 76-73 D: 66-63

SCHEDULE OF READINGS:

P&P –

Security: Information Security: Principles and Practices

Cases

– Information Security: Contemporary Cases

Mitnick –

The Art of Deception

Month/Week Class Date Topics and Assignments January

1st _{Thursday, May}

7

P&P – Chapter 1 “Why Study Information Security?” P&P – Chapter 2 “Information Security Principles of

Success”

Cases – Chapter 1 “Protecting Employee Data” ASSIGNMENT – Exercise 2.5 (p. 37)

In class assignment – Exercise 2.1 and Project 2.1 (pgs. 36-37)

P&P – Chapter 3 “Certification Programs and the Common Body of Knowledge”

Groups Assigned 2nd Thursday, May

14 P&P – Chapter 4 “Security Management” ASSIGNMENT– CHOOSE

ONE

OR

4.2

OR

P&P – Chapter 5 “Security Architecture and Models” Group Project Locations Due

Month/Week Class Date Topics and Assignments January

3rd Thursday, May 21

P&P – Chapter 6 “Business Continuity Planning and Disaster Recovery Planning Security”

YouTube Video -

http://www.youtube.com/watch?v=z8i3nTg-zxw

Cases – Chapter 3 “Contingency Planning” P&P – Chapter 7 “Law, Investigations, and Ethics”

ASSIGNMENT – Exercise 7. 5 (p. 162) Guest Speaker – Sgt. James Washburn, retired

CPD, OCD 4th Thursday, May

28 P&P – Chapter 8 “Physical Security Control” Cases – Chapter 2 “Integrating IT and Physical

Security”

ASSIGNMENT – Project 8.3 (p. 186) P&P – Chapter 9 “Operations Security”

IN CLASS ASSIGNMENT - Exercise 9.1 and 9.3

P&P – Chapter 10 “Access Control Systems and Methodology” IN CLASS ASSIGNMENT – Password Cracking Paper #2 DUE February 5th _{Thursday, June} 4

Mitnick (read Part I, skim Part II, read Part III and Part IV)

P&P – Chapter 11 “Cryptography”

Cases – Chapter 6 “Tracking a Computer Intruder” ASSIGNMENT – Exercise 11.1 and 11.6 (p. 253 and

Month/Week Class Date Topics and Assignments February

6th Thursday, June 11

P&P – Chapter 12 “Telecommunications, Network, and Internet Security”

Cases – Chapter 7 “Developing and Implementing a Successful Information Security Awareness Program” P&P Chapter 13 “Application Development Security”

P&P – Chapter 14 “Securing the Future” Paper #3 DUE

7th _{Thursday, June} 18