ITIA 1200 - Introduction to Information Systems Security

Credit Hours: 3.00

Objectives:

1. Recognize network vulnerabilities. (Example: routers, switches and wireless access points.)
2. Recognize application vulnerabilities. (Example: Microsoft Office, web browsers, shareware.)
3. Recognize operating system vulnerabilities.
4. Recognize hardware vulnerabilities.
5. Recognize physical security vulnerabilities.
6. Recognize communication vulnerabilities in transmitting information across the network.

Outcome 2: Upon completion of this course, students will recommend resolution strategies.

Objectives:

1. Propose changes to remediate network vulnerabilities.
2. Propose changes to remediate application vulnerabilities.
3. Propose changes to remediate operating system vulnerabilities.
4. Propose changes to remediate hardware vulnerabilities.
5. Propose changes to remediate physical security vulnerabilities.
6. Propose cryptographic solutions to protect communications across a network.

Outcome 3: Upon completion of this course, students will identify security management practices.

Objectives:

1. Distinguish between access control methods.
2. Distinguish between authentication methods.
3. Identify the components of a disaster recovery plan.
4. Identify potential legal issues regarding information systems security. (Example: software piracy.)

1. Access Control Systems and Methodology
   1. Access control security models
   2. Identification and authentication technologies and techniques
   3. Access control administration
   4. Data ownership
   5. Attack methods
2. Telecommunications and Network Security
   1. OSI model and layers
   2. LAN, MAN, WAN technologies
   3. Internet, intranet, extranet issues
   4. Virtual Private Networks, firewalls, routers, other devices
   5. Network topologies and cabling
   6. Attack methods
3. Security Management Practices
   1. Data classification
   2. Policies, procedures, standards, guidelines
   3. Risk assessment and management
   4. Personnel security, training, and awareness
4. Cryptography
   1. Symmetric versus asymmetric algorithms and uses
   2. Public key infrastructure (PKI) and hashing functions
   3. Encryption protocols and implementation
   4. Attack methods
5. Security Architecture and Models
   1. Security models
   2. Evaluation criteria
   3. Common flaws in applications and systems
6. Business Continuity Planning and Disaster Recovery Planning
   1. Business resource identification and value assignment
   2. Business impact analysis and prediction of possible losses
   3. Unit priorities and crisis management
   4. Plan development, implementation, and maintenance
7. Laws, Investigations, and Ethics
   1. Laws, regulations, and crimes
   2. Licensing and software piracy
   3. Export and import laws and issues
   4. Evidence types and admissibility into court
   5. Incident handling
8. Physical Security
   1. Restricted areas, authorization methods, and controls
   2. Motion detectors, sensors, and alarms
   3. Intrusion Detection
   4. Fire detection, prevention, and suppression
   5. Fencing, security guards