ITIA 1200 - Introduction to Information Systems Security

Credit Hours: 3.00

Objectives:

1. Recognize network vulnerabilities. (Example: routers, switches and wireless access points.)
2. Recognize application vulnerabilities. (Example: Microsoft Office, web browsers, shareware.)
3. Recognize operating system vulnerabilities.
4. Recognize hardware vulnerabilities.
5. Recognize physical security vulnerabilities.
6. Recognize communication vulnerabilities in transmitting information across the network.

Outcome 2: Upon completion of this course, students will recommend resolution strategies.

Objectives:

1. Propose changes to remediate network vulnerabilities.
2. Propose changes to remediate application vulnerabilities.
3. Propose changes to remediate operating system vulnerabilities.
4. Propose changes to remediate hardware vulnerabilities.
5. Propose changes to remediate physical security vulnerabilities.
6. Propose cryptographic solutions to protect communications across a network.

Outcome 3: Upon completion of this course, students will identify security management practices.

Objectives:

1. Distinguish between access control methods.
2. Distinguish between authentication methods.
3. Identify the components of a disaster recovery plan.
4. Identify potential legal issues regarding information systems security. (Example: software piracy.)

• Communication: The graduate can communicate effectively for the intended purpose and audience.
• Critical Thinking: The graduate can make informed decisions after analyzing information or evidence related to the issue.
• Global Literacy: The graduate can analyze human behavior or experiences through cultural, social, political, or economic perspectives.
• Information Literacy: The graduate can responsibly use information gathered from a variety of formats in order to complete a task.
• Quantitative Reasoning: The graduate can apply quantitative methods or evidence to solve problems or make judgments.
• Scientific Literacy: The graduate can produce or interpret scientific information presented in a variety of formats.

1. Access Control Systems and Methodology
   1. Access control security models
   2. Identification and authentication technologies and techniques
   3. Access control administration
   4. Data ownership
   5. Attack methods
2. Telecommunications and Network Security
   1. OSI model and layers
   2. LAN, MAN, WAN technologies
   3. Internet, intranet, extranet issues
   4. Virtual Private Networks, firewalls, routers, other devices
   5. Network topologies and cabling
   6. Attack methods
3. Security Management Practices
   1. Data classification
   2. Policies, procedures, standards, guidelines
   3. Risk assessment and management
   4. Personnel security, training, and awareness
4. Cryptography
   1. Symmetric versus asymmetric algorithms and uses
   2. Public key infrastructure (PKI) and hashing functions
   3. Encryption protocols and implementation
   4. Attack methods
5. Security Architecture and Models
   1. Security models
   2. Evaluation criteria
   3. Common flaws in applications and systems
6. Business Continuity Planning and Disaster Recovery Planning
   1. Business resource identification and value assignment
   2. Business impact analysis and prediction of possible losses
   3. Unit priorities and crisis management
   4. Plan development, implementation, and maintenance
7. Laws, Investigations, and Ethics
   1. Laws, regulations, and crimes
   2. Licensing and software piracy
   3. Export and import laws and issues
   4. Evidence types and admissibility into court
   5. Incident handling
8. Physical Security
   1. Restricted areas, authorization methods, and controls
   2. Motion detectors, sensors, and alarms
   3. Intrusion Detection
   4. Fire detection, prevention, and suppression
   5. Fencing, security guards