Questions? Consult the FAQs!
Course Question & Answer
Information Security
Purpose of Course showclose
This course focuses on the fundamentals of information security that are used in protecting both the information present in computer storage as well as information traveling over computer networks. Interest in information security has been spurred by the pervasive use of computer-based applications such as information systems, databases, and the Internet. Information security has also emerged as a national goal in the United States and in other countries with national defense and homeland security implications. Information security is enabled through securing data, computers, and networks. In this course, we will look into such topics as fundamentals of information security, computer security technology and principles, access control mechanisms, cryptography algorithms, software security, physical security, and security management and risk assessment. By the end of this course, you will be able to describe major information security issues and trends, and advise an individual seeking to protect his or her data.
Course Information showclose
Course Designer: Dr. Bhanu Kapoor
Primary Resources: This course is composed of a range of different free, online materials. However, the course makes primary use of the following materials:
- YouTube: IIT Kharagpur Lecture Series on Internet Technologies: Dr. Indranil Sengupta’s Lecture Series
- Naval Postgraduate School: CyberCiege: “Cryptography Basics”
- Gary C. Kessler’s An Overview of Cryptography
- CGISecurity: The Open Web Application Security Project’s A Guide to Building Secure Web Applications
- Ross Anderson: Security Engineering
Note that you will only receive an official grade on your Final Exam. However, in order to adequately prepare for this exam, you will need to work through the materials in each unit.
In order to pass this course, you will need to earn a 70% or higher on the Final Exam. Your score on the exam will be tabulated as soon as you complete it. If you do not pass the exam, you may take it again following a 14-day waiting period.
Time Commitment: This course should take you a total of approximately 76 hours to complete. Each unit includes a time advisory that lists the amount of time you are expected to spend on each subunit. These advisories should help you plan your time accordingly. It may be useful to take a look at these time advisories and to determine how much time you have over the next few weeks to complete each unit, and then to set goals for yourself. For example, Unit 1 should take you 6.5 hours. Perhaps you can sit down with your calendar and decide to complete subunits 1.1 and 1.2 (a total of 2.5 hours) on Monday night; subunits 1.3 and 1.4 (a total of 2.5 hours) on Tuesday night; etc.
Tips/Suggestions: Please follow the directions in each unit of the Course Outline section to navigate through the course materials. Please see the pre-requisite and required courses in the Course Requirements section above. If you are struggling with a concept, it may help to refer back to these courses for a refresher of Computer Science and Discrete Mathematics information. It may help to take careful notes as you work through the readings, video lectures, and other resources. These notes will be useful to study from as you prepare for the Final Exam.
Learning Outcomes showclose
- explain the challenges and scope of information security;
- explain such basic security concepts as confidentiality, integrity, and availability, which are used frequently in the field of information security;
- explain the importance of cryptographic algorithms used in information security in the context of the overall information technology (IT) industry;
- identify and explain symmetric algorithms for encryption-based security of information;
- identify and explain public-key based asymmetric algorithms for encryption-based security of information;
- describe the access control mechanism used for user authentication and authorization;
- describe Secure Sockets Layer (SSL) as a common solution enabling security of many applications, including all Internet-based commerce;
- describe securing Internet Protocol (IP) communications by using Internet Protocol Security (IPSec);
- explain the importance of physical security and discuss ways to improve physical security of an enterprise;
- explain the use of such security tools as firewalls and intrusion prevention systems;
- explain malicious software issues such as those introduced by software-based viruses and worms;
- explain common software security issues such as buffer overflow; and
- describe the basic process of risk assessment in the context of overall IT security management.
Course Requirements showclose
√ have access to a computer;
√ have continuous broadband Internet access;
√ have the ability/permission to install plug-ins or software (e.g., Adobe Reader or Flash);
√ have the ability to download and save files and documents to a computer;
√ have the ability to open Microsoft files and documents (.doc, .ppt, .xls, etc.);
√ have competency in the English language;
√ have knowledge about the basics of computer programming by using a high-level language, such as C/C++, and have completed the Introduction to Computer Science I (CS101) and Introduction to Computer Science II courses (CS102) in the Core Program of the computer science discipline;
√ feel comfortable in writing, compiling, and executing your own programs; and
√ have knowledge about the basics of discrete mathematics concepts from the Discrete Structures (CS202) course and the course on Algorithms (CS303).
Unit Outline show close
Expand All Resources Collapse All Resources
-
Unit 1: Computer Security Concepts
This unit provides an overview of information security. First, we look at the basic concepts of confidentiality, integrity, and availability as discussed in the National Institute of Standards and Technology (NIST) standard Federal Information Processing Standards (FIPS) 199. We will discuss threats, attacks, and assets in the overall context of a security management model. We will also learn about the challenges of information security and its overall scope.
Unit 1 Time Advisory show close
Unit 1 Learning Outcomes show close
-
1.1 Introduction to Information Security
- Reading: The Open University’s An Introduction to Information Security: “Why Is Information Security Important?”, “What Is Information?”, “What Is Information Security?”, and “What Is Information Security Management?”
Link: The Open University’s An Introduction to Information Security: “Why Is Information Security Important?” (HTML), “What Is Information?” (HTML), “What Is Information Security?” (HTML), and “What Is Information Security Management?” (HTML)
Instructions: Please read this webpage for an overview and definition of information security and information security management, and reasons why it is important. Please note that working on the activities is not required at this time. You will have separate assignments to work on later in the course.
Reading these webpages should take approximately 1 hour and 30 minutes.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: The Open University’s An Introduction to Information Security: “Why Is Information Security Important?”, “What Is Information?”, “What Is Information Security?”, and “What Is Information Security Management?”
-
1.2 Introduction to Data and Network Security
- Lecture: YouTube: George Mason University: Professor Paul A. Strassman’s “Information Assurance for Defense Security”
Link: YouTube: George Mason University: Professor Paul A. Strassman’s “Information Assurance for Defense Security” (YouTube)
Instructions: Please watch this video to learn about the methods for managing risks to information assets. IT practitioners seek to protect the confidentiality, integrity, and availability of data and their delivery systems – whether the data are in storage, in processing, or in transit, and whether threatened by malice or accident.
Watching this video and pausing to take notes should take approximately 1 hour.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Lecture: YouTube: George Mason University: Professor Paul A. Strassman’s “Information Assurance for Defense Security”
-
1.3 Confidentiality, Integrity, and Availability
- Reading: University of Miami, Miller School of Medicine: Privacy/Data Protection Project: “Confidentiality, Integrity, and Availability”
Link: University of Miami, Miller School of Medicine: Privacy/Data Protection Project: “Confidentiality, Integrity, and Availability” (HTML)
Instructions: Please read this webpage for an overview of the basic security concepts of confidentiality, integrity, and availability.
Reading this webpage should take approximately 1 hour.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: University of Miami, Miller School of Medicine: Privacy/Data Protection Project: “Confidentiality, Integrity, and Availability”
-
1.4 NIST FIPS 199 Standard
- Reading: National Institute of Standards and Technology: Federal Information Processing Standards Publications: “Standards for Security Categorization of Federal Information and Information Systems”
Link: National Institute of Standards and Technology: Federal Information Processing Standards Publications: “Standards for Security Categorization of Federal Information and Information Systems” (PDF)
Instructions: Please scroll down to FIPS 199, and click the link to FIPS-Pub-199-Final.pdf. Read this document to gain a better understanding of the security objectives of confidentiality, integrity, and availability.
Reading this document should take approximately 1 hour and 30 minutes.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: National Institute of Standards and Technology: Federal Information Processing Standards Publications: “Standards for Security Categorization of Federal Information and Information Systems”
-
1.5 Assets and Threats
- Reading: WindowSecurity.com: Robert J. Shimonski’s “Threats and Your Assets: What Is Really at Risk?”
Link: WindowSecurity.com: Robert J. Shimonski’s “Threats and Your Assets: What Is Really at Risk?” (HTML)
Instructions: Please read this webpage for an introduction to the types of information assets and associated threats.
Reading this webpage should take approximately 1 hour and 30 minutes.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: WindowSecurity.com: Robert J. Shimonski’s “Threats and Your Assets: What Is Really at Risk?”
-
Unit 2: Basic Cryptographic Concepts
Encryption and decryption of data form the basis of information security. Cryptography is the science of encrypting data. In this unit, we will explore basic cryptography concepts and the purpose of cryptography. Also, we will look into the details of symmetric key encryption techniques. In particular, we will discuss the symmetric key algorithms called Data Encryption Standard (DES), Triple DES, and Advanced Encryption Standard (AES). DES is a block-cipher employing a 56-bit key that operates on 64-bit blocks. Triple-DES is a variant of DES that employs up to three 56-bit keys and makes three encryption/decryption passes over the block. In 1997, NIST initiated a very public, four-and-a-half-year process to develop a new secure cryptosystem for U.S. government applications. The result, the Advanced Encryption Standard, became the official successor to DES in December 2001.
Unit 2 Time Advisory show close
Unit 2 Learning Outcomes show close
-
2.1 Basic Cryptography Concepts: Symmetric Encryption Algorithms
- Lecture: YouTube: Google TechTalks: Steve Weis’ “Theory and Practice of Cryptography”
Link: YouTube: Google TechTalks: Steve Weis’ “Theory and Practice of Cryptography” (YouTube)
Instructions: Please watch this video to gain an understanding of the basics of information security and a detailed discussion of cryptographic concepts related to such symmetric encryption algorithms as DES, Triple DES, and AES.
Watching this video and pausing to take note sshould take approximately 1 hour.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Lecture: YouTube: Google TechTalks: Steve Weis’ “Theory and Practice of Cryptography”
-
2.2 Purpose of Cryptography
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “The Purpose of Cryptography”
Link: Dr. Gary C. Kessler’s An Overview of Cryptography: “The Purpose of Cryptography” (HTML)
Instructions: Please read this section to gain an understanding of basic cryptographic concepts.
Reading this webpage should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “The Purpose of Cryptography”
-
2.3 Data Encryption Standard (DES)
- Reading: Dr. Gary Kessler’s An Overview of Cryptography: “Some of the Finer Details of DES, Breaking DES, and DES Variants”
Link: Dr. Gary Kessler’s An Overview of Cryptography: “Some of the Finer Details of DES, Breaking DES, and DES Variants” (HTML)
Instructions: Please read this section to gain understanding of DES symmetric key cryptography algorithm.
Reading this section should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Dr. Gary Kessler’s An Overview of Cryptography: “Some of the Finer Details of DES, Breaking DES, and DES Variants”
-
2.4 Triple DES
- Reading: Tropical Software: “Triple DES Encryption”
Link: Tropical Software: “Triple DES Encryption” (HTML)
Instructions: Please read this webpage to gain a good understanding of how Triple DES makes use of DES to improve on encryption-based security.
Reading this webpage should take approximately 30 minutes.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Tropical Software: “Triple DES Encryption”
-
2.5 Advanced Encryption Standard (AES)
- Reading: Dr. Gary Kessler’s An Overview of Cryptography: “The Advanced Encryption Standard and Rijndael”
Link: Dr. Gary Kessler’s An Overview of Cryptography: “The Advanced Encryption Standard and Rijndael” (HTML)
Instructions: Please read this section to gain a good understanding of the advanced encryption standard (AES) algorithm.
Reading this webpage should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Dr. Gary Kessler’s An Overview of Cryptography: “The Advanced Encryption Standard and Rijndael”
-
Unit 3: Public-Key Encryption
In this unit, we explore basic cryptography concepts and look into the details of asymmetric key encryption techniques based on the concepts of a public-key. You will be able to compare and contrast public-key algorithms and symmetric algorithms discussed in Unit 2. In particular, we will discuss the public-key algorithms by Rivest, Shamir, and Adelman (RSA) and another algorithm by Diffie and Hellman.
Unit 3 Time Advisory show close
Unit 3 Learning Outcomes show close
-
3.1 Introduction to Public-Key Cryptography
- Lecture: YouTube: Computer History Museum: Whitfield Diffie’s “Before, During, and After Public-Key Cryptography”Link: YouTube: Computer History Museum: Whitfield Diffie’s “Before, During, and After Public-Key Cryptography” (YouTube)
Instructions: Please click the link above, and watch this video to gain an understanding of origins of cryptographic concepts. Whitfield Diffie, a key figure in the discovery of public-key cryptography, traces the growth of information security through the 20th century and into the 21st. In the 1970s, the world of information security was transformed by public-key cryptography, the radical revision of cryptographic thinking that allowed people with no prior contact to communicate securely. Public-key solved security problems born of the revolution in information technology that characterized the 20th century and made Internet commerce possible. Security problems rarely stay solved, however. Continuing growth in computing, networking, and wireless applications have given rise to new security problems that are already confronting us.
Watching this video should take approximately 1 hour.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Lecture: YouTube: Computer History Museum: Whitfield Diffie’s “Before, During, and After Public-Key Cryptography”
-
3.2 Public-Key Encryption Algorithms
- Lecture: Naval Postgraduate School: CyberCiege: “Cryptography Basics”, “Symmetric and Public Key Cryptography”, “Network Authentication Through Cryptography”, “PKI”
Link: Naval Postgraduate School: CyberCiege: “Cryptography Basics” (Flash), “Symmetric and Public Key Cryptography” (Flash), “Network Authentication Through Cryptography” (Flash), “PKI” (Flash)
Instructions: Please click the links above, and watch these videos to gain an understanding of cryptographic concepts related to public-key algorithms, such as the RSA algorithm and the Diffie-Hellman algorithm and how they are used in network security.
Watching this video should take approximately 1 hour.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Lecture: Naval Postgraduate School: CyberCiege: “Cryptography Basics”, “Symmetric and Public Key Cryptography”, “Network Authentication Through Cryptography”, “PKI”
-
3.3 Public-Key Cryptography
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “Public-Key Cryptography”
Link: Dr. Gary C. Kessler’s An Overview of Cryptography: “Public-Key Cryptography” (HTML)
Instructions: Please read this section to get a good understanding of the key concepts behind public-key cryptography. After reading this section, explain the history of public-key cryptography, the factorization problem, and describe how RSA works.
Reading this webpage should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “Public-Key Cryptography”
-
3.4 RSA Public-Key Algorithm
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “Some of the Finer Details of RSA Public-Key Cryptography”
Link: Dr. Gary C. Kessler’s An Overview of Cryptography: “Some of the Finer Details of RSA Public-Key Cryptography” (HTML)
Instructions: Please read this section to gain understanding of the steps in the RSA Public-Key Algorithm. After reading, you should be able to describe a simple example of generating public/private keys for RSA systems and describe the process of encrypting and decrypting a message.
Reading this section should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “Some of the Finer Details of RSA Public-Key Cryptography”
-
3.5 Diffie-Hellman Algorithm
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “Some of the Finer Details of Diffie-Hellman”
Link: Dr. Gary C. Kessler’s An Overview of Cryptography: “Some of the Finer Details of Diffie-Hellman” (HTML)
Instructions: Please read this section to gain understanding of the steps in the Diffie-Hellman Public-Key Algorithm.
Reading this webpage should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “Some of the Finer Details of Diffie-Hellman”
-
3.6 Cryptography in Practice
- Activity: CrypTool: http://www.cryptool.org/
Link: CrypTool: http://www.cryptool.org/ (HTML)
Instructions: Download the software at this site, try to use different methods to encrypt messages, and then try to use the analysis tools to analyze the entropy such as floating frequency, histogram, N-Gram, autocorrelation, and periodicity, etc. Also try to use symmetric key ciphers such as DES and asymmetric ciphers such as RSA, DH, etc.
Downloading and experimenting with this software should take approximately 4 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Activity: CrypTool: http://www.cryptool.org/
-
Unit 4: Access Control Mechanisms
Access control is a system that enables an authority to control access to areas and resources in a given physical facility or computer-based information system. In this unit, we will explore the access control mechanisms for user authorization. By the means of access control, appropriate authorization to information is provided to different entities in an organization. The common mechanisms include discretionary access control (DAC) and role-based access control (RBAC). We look into each of these in the context of their current usage in a typical enterprise.
Unit 4 Time Advisory show close
Unit 4 Learning Outcomes show close
-
4.1 Authentication
- Reading: CGISecurity’s Open Web Application Security Project: A Guide to Building Secure Web Applications: “Chapter 6: Authentication”
Link: CGISecurity’s Open Web Application Security Project: A Guide to Building Secure Web Applications: “Chapter 6: Authentication” (HTML)
Instructions: Please click the link above and read the webpage to gain an understanding of authentication, a process of determining if a user or entity is who he/she claims to be.
Reading this webpage should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: CGISecurity’s Open Web Application Security Project: A Guide to Building Secure Web Applications: “Chapter 6: Authentication”
-
4.2 Access Control and Authorization
- Reading: CGISecurity’s Open Web Application Security Project: A Guide to Building Secure Web Applications: “Chapter 8: Access Control and Authorization”
Link: CGISecurity’s Open Web Application Security Project: A Guide to Building Secure Web Applications: “Chapter 8: Access Control and Authorization” (HTML)
Instructions: Please click the link above and read this webpage to gain an understanding of discretionary access control (DAC) and role-based access control (RBAC), a technical means for controlling access to computer resources.
Reading this webpage should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: CGISecurity’s Open Web Application Security Project: A Guide to Building Secure Web Applications: “Chapter 8: Access Control and Authorization”
-
4.3 Role-Based Access Control
- Reading: National Institute of Standards and Technology’s NIST/ITL Bulletin: “An Introduction to Role-Based Access Control”
Link: National Institute of Standards and Technology’s NIST/ITL Bulletin: “An Introduction to Role-Based Access Control” (HTML)
Instructions: Please click the link above and read this webpage to gain an understanding of role-based access control (RBAC), a technical means for controlling access to computer resources.
Reading this webpage should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: National Institute of Standards and Technology’s NIST/ITL Bulletin: “An Introduction to Role-Based Access Control”
-
4.4 Role-Based Access Control and Role Graph Model
- Lecture: Purdue University Center for Education and Research in Information Assurance and Security: Sylvia Osborn’s “The Role Graph Model and Its Extensions”
Link: Purdue University Center for Education and Research in Information Assurance and Security: Sylvia Osborn’s “The Role Graph Model and Its Extensions” (Flash)
Instructions: Please watch this video from CERIAS Security to gain understanding of techniques used in context of Role-Based Access Control mechanism.
Watching this video and pausing to take notes should take approximately 1 hour.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Lecture: Purdue University Center for Education and Research in Information Assurance and Security: Sylvia Osborn’s “The Role Graph Model and Its Extensions”
-
Unit 5: Security Solutions
In this unit, we explore some of the common solutions for security issues that are currently in use. For securing web-based applications such as e-Commerce, Secure Sockets Layer (SSL) is a commonly used solution to enable security of transactions. It makes use of public-key based encryption and symmetric encryption during the transaction to ensure security. We also look into a protocol called Internet Protocol Security (IPSec) to secure communications.
Unit 5 Time Advisory show close
Unit 5 Learning Outcomes show close
-
5.1 Security Protocols and Solutions
- Lecture: YouTube: Indian Institute of Technology Kharagpur: Professor Indranil Sengupta’s “Basic Cryptographic Concepts: Part III”
Link: YouTube: Indian Institute of Technology Kharagpur: Professor Indranil Sengupta’s “Basic Cryptographic Concepts: Part III” (YouTube)
Instructions: Please click the link above and watch this video to gain an understanding of cryptographic concepts related to Secure Sockets Layer (SSL), Secure Shell (SSH), and Internet Protocol Security (IPSec).
Watching this video should take approximately 1 hour.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Lecture: YouTube: Indian Institute of Technology Kharagpur: Professor Indranil Sengupta’s “Basic Cryptographic Concepts: Part III”
-
5.2 Internet Protocol Security
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “IP Security (IPSec) Protocol”
Link: Dr. Gary C. Kessler’s An Overview of Cryptography: “IP Security (IPSec) Protocol” (HTML)
Instructions: Please read this section for information on Internet Protocol for securing communications. After reading this section, describe the two modes for IPSec: AH and ESP. Also try to explain how to use AH and ESP to build VPN (tunnel mode and transport mode).
Reading this webpage should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “IP Security (IPSec) Protocol”
-
5.3 Secure Sockets Layer
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “The SSL “Family” of Secure Transaction Protocols for the World Wide Web”
Link: Dr. Gary C. Kessler’s An Overview of Cryptography: “The SSL “Family” of Secure Transaction Protocols for the World Wide Web” (HTML)
Instructions: Please read this section to gain understanding of the SSL family of protocols for securing transactions over the Internet. When reading this section, please pay special attention to the diagram in Figure 5. You need to be able to explain the message flows in Figure 5 for SSL/TLS.
Reading this webpage should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “The SSL “Family” of Secure Transaction Protocols for the World Wide Web”
-
5.4 Pretty Good Privacy
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “Pretty Good Privacy (PGP)”
Link: Dr. Gary C. Kessler’s An Overview of Cryptography: “Pretty Good Privacy (PGP)” (HTML)
Instructions: Please read this section to learn about Pretty Good Privacy (PGP) as one of today’s most widely used public-key cryptography programs.
Reading this webpage should take approximately 30 minutes.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Dr. Gary C. Kessler’s An Overview of Cryptography: “Pretty Good Privacy (PGP)”
-
Unit 6: Firewalls, Intrusion Detection, and Intrusion Prevention
In this unit, we will explore the use of security tools such as firewalls and intrusion prevention systems. Following a quick introduction to the concepts of intranet and extranet systems that are frequently used for information exchange by enterprises today, we will look into cryptographic concepts related to securing communication using firewalls. We will explore how firewalls work and will also study different types of intrusion detection systems including host-based and network-based systems.
Unit 6 Time Advisory show close
Unit 6 Learning Outcomes show close
-
6.1 Security Protocols and Solutions
- Lecture: YouTube: Indian Institute of Technology Kharagpur: Professor Indranil Sengupta’s “Intranet, Extranet, Firewall”
Link: YouTube: Indian Institute of Technology Kharagpur: Professor Indranil Sengupta’s “Intranet, Extranet, Firewall” (YouTube)
Instructions: Please click the link above and watch this video. Following a brief introduction to intranets and extranets used frequently today by businesses, Professor Sengupta explains cryptographic concepts related to securing communication using firewalls.
Watching this video and pausing to take notes should take approximately 1 hour.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Lecture: YouTube: Indian Institute of Technology Kharagpur: Professor Indranil Sengupta’s “Intranet, Extranet, Firewall”
-
6.2 Firewall
- Reading: The Open University’s Protocols in Multi-Service Networks: “Firewalls – An Overview” and HowStuffWorks: Jeff Tyson’s “How Firewalls Work”
Link: The Open University’s Protocols in Multi-Service Networks: “Firewalls – An Overview” (HTML) and HowStuffWorks: Jeff Tyson’s “How Firewalls Work” (HTML)
Instructions: Please read both of these webpages.
Reading these webpages should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: The Open University’s Protocols in Multi-Service Networks: “Firewalls – An Overview” and HowStuffWorks: Jeff Tyson’s “How Firewalls Work”
-
6.3 Host-Based IDS vs. Network-Based IDS
- Reading: WindowSecurity.com: Ricky M. Magalhaes’ “Host-Based IDS vs. Network-Based IDS”
Link: WindowSecurity.com: Ricky M. Magalhaes’ “Host-Based IDS vs. Network-Based IDS” (HTML)
Instructions: Please read this article to gain understanding of host-based and network-based intrusion detection systems.
Reading this article should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: WindowSecurity.com: Ricky M. Magalhaes’ “Host-Based IDS vs. Network-Based IDS”
-
6.4 Network Attacks and Defense
- Reading: University of Cambridge Computer Laboratory: Ross Anderson’s Security Engineering: “Chapter 18: Network Attack and Defense”
Link: University of Cambridge Computer Laboratory: Ross Anderson’s Security Engineering: “Chapter 18: Network Attack and Defense” (PDF)
Instructions: Click on the link above and then click SE-18.pdf to download the document. When reading this chapter, try to explain various attacks, the skills that are needed for carrying out these attacks, and how to defend your system against these attacks.
Reading this chapter should take approximately 3 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: University of Cambridge Computer Laboratory: Ross Anderson’s Security Engineering: “Chapter 18: Network Attack and Defense”
-
Unit 7: Physical Security
Physical securityis the protection of personnel, hardware, programs, networks, and data from physical circumstances and events that could cause serious losses or damage. This unit explains the importance of physical security as a significant item in providing overall security. Without physical security, all other sophisticated techniques can become useless. Specifically, we will study the NASA physical security program, which is a result of extensive research on physical security. We will also look into different types of attacks that are possible in the context of physical security.
Unit 7 Time Advisory show close
Unit 7 Learning Outcomes show close
-
7.1 Physical Security
- Reading: University of Cambridge Computer Laboratory: Ross Anderson’s Security Engineering: “Chapter 10: Monitoring Systems” and “Chapter 11: Physical Protection”
Link: University of Cambridge Computer Laboratory: Ross Anderson’s Security Engineering: “Chapter 10: Monitoring Systems” (PDF) and “Chapter 11: Physical Protection” (PDF)
Instructions: Click on the link above and then download SE-10.pdf and SEv2-c11.pdf to read the chapters. After reading these chapters, explain the relationship between threat models and attacks. Take the communication examples in the chapters and try to explain different attacks based on different assumption of threat models.
Reading these chapters should take approximately 4 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: University of Cambridge Computer Laboratory: Ross Anderson’s Security Engineering: “Chapter 10: Monitoring Systems” and “Chapter 11: Physical Protection”
-
7.2 NASA’s Physical Security Program
- Reading: National Aeronautics and Space Administration: NASA Security Program Procedural Requirements: “Chapter 7: Physical Security Program”
Link: National Aeronautics and Space Administration: NASA Security Program Procedural Requirements: “Chapter 7: Physical Security Program” (HTML or PDF)
Instructions: Please click the link above and read this webpage to gain an understanding of NASA’s physical security program. Physical security in IT context requires most of the ideas discussed here, even though they were developed in the context of NASA’s requirements. Please note that you have the option to download this document as a PDF by clicking the Printable Format (PDF) link at the top right of the webpage.
Reading this webpage should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: National Aeronautics and Space Administration: NASA Security Program Procedural Requirements: “Chapter 7: Physical Security Program”
-
7.3 Types of Attacks
- Reading: Symantec: Sarah Granger’s “Social Engineering Fundamentals, Part I: Hacker Tactics”
Link: Symantec: Sarah Granger’s “Social Engineering Fundamentals, Part I: Hacker Tactics” (HTML)
Instructions: Please read this webpage. After reading, explain how the attacker identifies the target/victim and how to carry out social engineering via various approaches (phones, online chatting, Dumpster diving, reverse engineering etc.).
Reading this webpage should take approximately 1 hour.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Symantec: Sarah Granger’s “Social Engineering Fundamentals, Part I: Hacker Tactics”
-
Unit 8: Malicious Software and Software Security
In this unit, we will explore malicious software, also known as malware. We will also study common software security issues such as buffer overflow, used by several malware to exploit systems’ vulnerability. At the end of the unit, we will learn how to use these malware and other security attacks to carry out information warfare.
Unit 8 Time Advisory show close
Unit 8 Learning Outcomes show close
-
8.1 Malicious Web
- Lecture: YouTube: University of Washington: Professor Giovanni Vigna’s “From Badware to Malware: Taming the Malicious Web”
Link: YouTube: University of Washington: Professor Giovanni Vigna’s “From Badware to Malware: Taming the Malicious Web” (YouTube)
Instructions: Please click the link above, and watch this video to gain an understanding of the leveraging of legitimate websites for the delivery of attacks that target vulnerabilities in client-side software.
Watching this video and pausing to take notes should take approximately 1 hour.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Lecture: YouTube: University of Washington: Professor Giovanni Vigna’s “From Badware to Malware: Taming the Malicious Web”
-
8.2 Internet Security Issues
- Lecture: YouTube: AtGoogleTalks: Vint Cerf’s “Greyglers@Google: Vint Cerf”
Link: YouTube: AtGoogleTalks: Vint Cerf’s “Greyglers@Google: Vint Cerf” (YouTube)
Instructions: Please click the link above and watch this video to gain an understanding of security issues on the Internet, and what could have been done differently had we realized this was going to be the global information exchange infrastructure of the 21st century.
Watching this video and pausing to take notes should take approximately 1 hour and 30 minutes.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Lecture: YouTube: AtGoogleTalks: Vint Cerf’s “Greyglers@Google: Vint Cerf”
-
8.3 Types of Internet Security Issues
- Reading: Carnegie Mellon University CERT Program: “Denial of Service” and LinuxSecurity.com: Bennett Todd’s “Distributed Denial of Service Attacks”
Link: Carnegie Mellon University CERT Program: “Denial of Service” (HTML) and LinuxSecurity.com: Bennett Todd’s “Distributed Denial of Service Attacks” (HTML)
Instructions: Please read these webpages. While reading, try to explain the modes of DoS attacks, such as consumption of scarce resources, configuration information alternation, and physical destruction. For DDoS attacks, describe the tools that are used for DDoS, why the DDoS attacks are possible, and the protocol vulnerabilities that are used in DDoS attacks.
Reading these webpages should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Carnegie Mellon University CERT Program: “Denial of Service” and LinuxSecurity.com: Bennett Todd’s “Distributed Denial of Service Attacks”
-
8.4 Secure Coding
- Reading: Carnegie Mellon University CERT Program: Robert Seacord’s “Top Ten Secure Coding Practices” and the Open Web Application Security Project: “Secure Coding Principles”
Link: Carnegie Mellon University CERT Program: Robert Seacord’s “Top Ten Secure Coding Practices” (HTML) and the Open Web Application Security Project: “Secure Coding Principles” (HTML)
Instructions: Please read these webpages. After reading, describe the top 10 best practices for secure coding and describe the principles for secure coding (e.g., separation of duties, least privilege).
Reading these webpages should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: Carnegie Mellon University CERT Program: Robert Seacord’s “Top Ten Secure Coding Practices” and the Open Web Application Security Project: “Secure Coding Principles”
-
8.5 Electronic and Information Warfare
- Reading: University of Cambridge Computer Laboratory: Ross Anderson’s Security Engineering: “Chapter 16: Electronic and Information Warfare”
Link: University of Cambridge Computer Laboratory: Ross Anderson’s Security Engineering: “Chapter 16: Electronic and Information Warfare” (PDF)
Instructions: Please click the link above, download SE-16.pdf to read the document. After reading this chapter, describe the different attacks on communication systems and how one could use these attacks to carry out information warfare (in particular, based on the interaction between civil and military uses).
Reading this chapter should take approximately 2 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: University of Cambridge Computer Laboratory: Ross Anderson’s Security Engineering: “Chapter 16: Electronic and Information Warfare”
-
Unit 9: Security Risk Management
In this unit, we will explore risk management, which is the process of identifying vulnerabilities in an organization’s information systems and taking appropriate steps to ensure confidentiality, integrity, and availability of various components of the information systems. Risk assessment is an essential element of risk management, and we will identify the steps of the risk assessment process using case studies for four different types of enterprises.
Unit 9 Time Advisory show close
Unit 9 Learning Outcomes show close
-
9.1 How Much Security Do You Really Need?
- Reading: CGISecurity’s Open Web Application Security Project: A Guide to Building Secure Web Applications: “Chapter 3: How Much Security Do You Really Need?”
Link: CGISecurity’s Open Web Application Security Project: A Guide to Building Secure Web Applications: “Chapter 3: How Much Security Do You Really Need?” (HTML)
Instructions: Please click the link above and read this webpage to gain an understanding of the basics of risk assessment.
Reading this webpage should take approximately 1 hour and 30 minutes.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: CGISecurity’s Open Web Application Security Project: A Guide to Building Secure Web Applications: “Chapter 3: How Much Security Do You Really Need?”
-
9.2 Risk Management
- Lecture: Purdue University’s Center for Education and Research in Information Assurance and Security: Jack Jones’ “Shifting Focus: Aligning Security with Risk Management”
Link: Purdue University’s Center for Education and Research in Information Assurance and Security: Jack Jones’ “Shifting Focus: Aligning Security with Risk Management” (Flash)
Instructions: Please watch this video to gain an understanding of security and the risk management process.
Watching this video and pausing to take notes should take approximately 1 hour.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Lecture: Purdue University’s Center for Education and Research in Information Assurance and Security: Jack Jones’ “Shifting Focus: Aligning Security with Risk Management”
-
9.3 Information Security Risk Assessment: Introduction
- Reading: United States Government Accountability Office’s Information Security Risk Assessment: “Practices of Leading Organizations”
Link: United States Government Accountability Office’s Information Security Risk Assessment: “Practices of Leading Organizations: Introduction” (PDF)
Instructions: Please click on the “View Report” link to download the PDF. Read the introduction, up to page 8 of the PDF. After reading this chapter, describe the recommended process for risk assessment including the different roles involved.
Reading this chapter should take approximately 1 hour and 30 minutes.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: United States Government Accountability Office’s Information Security Risk Assessment: “Practices of Leading Organizations”
-
9.4 Information Security Risk Assessment: Case Studies, Part I
- Reading: United States Government Accountability Office’s Information Security Risk Assessment: “Practices of Leading Organizations: Case Studies, Part I”
Link: United States Government Accountability Office’s Information Security Risk Assessment: “Practices of Leading Organizations: Case Studies, Part I” (PDF)
Instructions: Please click on the “View Report” link to download the PDF. Read the second and third chapters, entitled Case Study 1: Multinational Oil Company and Case Study 2: Financial Services Company, on pages 9-31 of the PDF. When reading these chapters, try to map these two case studies to the risk assessment process introduced in unit 9.3.
Reading these chapters should take approximately 2 hours and 30 minutes.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: United States Government Accountability Office’s Information Security Risk Assessment: “Practices of Leading Organizations: Case Studies, Part I”
-
9.5 Information Security Risk Assessment: Case Studies, Part II
- Reading: United States Government Accountability Office’s Information Security Risk Assessment: “Practices of Leading Organizations: Case Studies, Part 2”
Link: United States Government Accountability Office’s Information Security Risk Assessment: “Practices of Leading Organizations: Case Studies, Part 2” (PDF)
Instructions: Please click on the “View Report” link to download the PDF. Read the fourth and the fifth chapters, entitled Case Study 3: Regulatory Organization and Case Study 4: Computer Hardware and Software Company, on pages 32-46 of the document.
Reading these chapters should take approximately 4 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Reading: United States Government Accountability Office’s Information Security Risk Assessment: “Practices of Leading Organizations: Case Studies, Part 2”
-
9.6 Risk Assessment in Practice
- Activity: Microsoft: “Microsoft Security Assessment Tool”
Link: Microsoft: “Microsoft Security Assessment Tool” (HTML)
Instructions: Download this program and install it on your computer. Use some simple cases to carry out a business risk profile assessment and defense in depth assessment.
Completing this activity should take approximately 3 hours.
Terms of Use: Please respect the copyright and terms of use displayed on the webpage above.See a broken link? Please let us know!
- Activity: Microsoft: “Microsoft Security Assessment Tool”
-
Final Exam
- Final Exam: The Saylor Foundation’s “CS406 Final Exam”
Link: The Saylor Foundation’s “CS406 Final Exam”
Instructions: You must be logged into your Saylor Foundation account in order to access this exam. If you do not yet have an account, you will be able to create one, free of charge, after clicking the link.See a broken link? Please let us know!
- Final Exam: The Saylor Foundation’s “CS406 Final Exam”
