CISS 391 A Information Systems Security

Transcription

1 Columbia College Online Campus P a g e 1 CISS 391 A Information Systems Security Late Fall Session Monday, October 26, 2015 to Saturday, December 19, 2015 Course Description An introduction to systems security issues associated with formal and informal systems protection, detection and responses. Prerequisite: Junior Standing Proctored Exams: -- Final Exam Textbooks Dhillon, G. Principles of Information Systems Security: Texts and Cases. John Wiley & Sons, Inc., ISBN-13: Textbooks for the course may be ordered from MBS Direct. You can order online at (be sure to select Online Education rather than your home campus before selecting your class) by phone at For additional information about the bookstore, visit Course Overview This course will provide an overview of various Information Systems security threats and the related means to help establish countermeasures. We will examine at the framework of three kinds of systems technical, formal, and informal and the relationships of the three systems. The course will also explore the core technical system security requirements of an organization and the various security models.

2 Columbia College Online Campus P a g e 2 Technology Requirements Participation in this course will require the basic technology for all online classes at Columbia College: A computer with reliable Internet access, a web browser, Acrobat Reader, Microsoft Office or another word processor such as Open Office. You can find more details about standard technical requirements for our courses on our site. Course Objectives To understand the fundamental concepts and terminologies of information systems security. To identify the security risks associated with information systems. To describe major technologies that is used to secure a network and its resources. To identify current technologies used in the field of information systems security. To examine the tools that is used to compromise systems in order to create better defense measures. To use the appropriate security policies and technology to best meet security requirements. To understand the trade-offs between usability and security. Measurable Learning Outcomes Explain roles of information systems security. Use available tools to protect, detect, and respond to attacks. Write security policy. Integrate security with systems design. Provide training guideline for business. Discuss risk analysis. Grading Grading Scale GRADE POINTS PERCENT A B C D F Grade Weights ASSIGNMENT POINTS PERCENT Discussions % Dropbox Assignments % Midterm Exam % Final Exam % Total %

3 Columbia College Online Campus P a g e 3 Schedule of Due Dates Week Assignment Points Due Date 1 Discussion 1 10 Friday Dropbox 1 20 Saturday Case Study 1 30 Saturday 2 Discussion 1 10 Friday Dropbox 2 20 Saturday Article 1 30 Saturday 3 Discussion 1 10 Friday Dropbox 3 20 Saturday Case Study 2 30 Saturday 4 Discussion 1 10 Friday Dropbox 4 20 Saturday Midterm Exam 200 Monday 11:59 PM 5 Discussion 1 10 Friday Dropbox 5 20 Saturday Article 2 30 Saturday 6 Discussion 1 10 Friday Dropbox 6 20 Saturday Case Study 3 30 Saturday 7 Discussion 1 10 Friday Dropbox 7 20 Saturday Article 3 30 Saturday 8 Discussion 1 10 Friday Dropbox 8 20 Saturday Final Exam 200 Monday 11:59 PM Total 900 Assignment Overview Text readings should be completed prior to submitting assignments or participating in online discussions. Online Discussion postings should be completed by Midnight Friday of the week. Discussion postings and are worth 160 points of the student s final grade and will be graded according to the

4 Columbia College Online Campus P a g e 4 Discussion grade criteria table. You must post and reply. Textbook questions should be completed Saturday (midnight CT) of each week and will be graded according to the point system presented in the assignment table below. Total possible points for Dropbox assignments are 160 Case Studies should be completed Saturday (midnight CT) of each week. Include the question at the top of the page. You answers should be at least one paragraph in length. They will be graded according to the rubric below. Total possible points for case studies are 90. Current Related News Articles summaries should be completed Saturday (midnight CT) of each week. Each article summary should be at least one paragraph in length, with 1.5 line spacing. Be sure to include the title of the article and attach the article itself with the summary posted to the dropbox. They will be graded according to the rubric below. Total possible points for case studies are 90. Exams: There will be a midterm and a final exam, each worth 200 points. Each exam will consist of 50 multiple choice questions. Multiple choice questions will be based on the information in the textbook. Please read all your assignments. The midterm is open-book and is not proctored. The final will be closed-book and proctored. You will take both exams online in the course environment; the only window that can be opened is the exam. You will have 2 hours for each exam. Course Schedule Week 1 Information Systems Security Readings: Chapter 1 Discussion 1: Do we really need to understand and place great importance on the informal controls prior to establishing security rules? Why or why not? Discussion 2: Even though information system security goes way beyond the security of the technical edifice, applications and organization resources can only be protected by using the latest security gadgets. Isn t this a contradiction in itself? Textbook Questions (Post in Dropbox): Answer questions Case Study 1: Designer Clothing Marketer Guess (p. 11). Choose one question at the end of the case study write a short paragraph and discuss. Please write the question at the top of your page. Week 2 Technical Aspects of Information Systems Security Readings: Chapters 2-3 Discussion 3: Discuss the relationship between core security requirements and the principles of easiest penetration, timeliness and effectiveness. Discussion 4: What is the relative positioning of the Bell La Pudula, Biba Integrity and Clark and Wilson models? How do you see one complementing the other? Textbook Questions (Post in Dropbox): Chapter 2, questions 3, 5, 6, 7 and 8; Chapter 3, questions 1, 4, 6, 9 and 10 Article 1: Submit on an article related to cyber-attacks on either individuals or corporations. Provide a brief synopsis. Be sure to attach or provide a link to the article.

5 Columbia College Online Campus P a g e 5 Submit proctor information form to the Proctor Information Dropbox by the end of this week. Week 3 Technical Aspects of Information Systems Security (cont.) Readings: Chapters 4-5 Discussion 5: Clearly encryption is essential in ensuring secrecy of communication. Identify characteristics of encryption that make it rather impossible to decrypt. Discussion 6: Differentiate between targeted attacks and target of opportunity attacks. Textbook Questions (Post in Dropbox): Chapter 4, questions 2, 6, 11, 13, and 16; Chapter 5, questions 3, 4, 5, 7, and 10. Case Study 2: Case of a Computer Hack (p. 325). Choose one question below and discuss. Please write the question at the top of your page. 1. What are challenges when security was added to legacy systems? 2. Discuss the advantages and disadvantages of moving all servers of the university to the computer center. 3. How was the hack discovered? What can we learn from this? 4. Should the system administrators check all computers of the university after the hack? Why or why not? Week 4 Formal Aspects of Information Systems Security Readings: Chapters 6-7 Discussion 7: What kind of executive level support is essential for ensuring uptake of information system security? How should such a support be generated? What strategies can be put in place to ensure that executive level support is sustained over a period of time? Discussion 8: Development of security policies and their implementation is the responsibility of different roles in organizations. Discuss the differences in opinion with respect to development and implementation of security policies. Textbook Questions (Post in Dropbox): Chapter 6, questions 1, 2, 5, 6, and 8; Chapter 7, questions 1, 4, 6, 8 and 12. Midterm Exam: Students must take the (un-proctored) Midterm exam between Monday and Sunday (by 11:59 PM) of this week. The exam questions are all multiple choice. It is an open-book exam. You will have 2 hours to complete it. Week 5 Formal Aspects of Information Systems Security (Continued) Readings: Chapters 8-9 Discussion 9: Establishing control structures in systems can best be achieved by focusing on requirement definitions and ensuring that controls get represented in basic data flows. Although such an assertion seems logical and commonsensical, identify and examine hurdles that usually prevent us from instituting such controls. Discussion 10: What is the systematic position of risk management in ensuring the overall security of an enterprise? Discuss giving examples.

6 Columbia College Online Campus P a g e 6 Textbook Questions (Post in Dropbox): Chapter 8, questions 1, 4, 5, 8, and 10; Chapter 9, questions 1, 2, 3, 5, and 8. Article 2: Submit an article related to intrusion detection tools for individuals or organizations. Provide a brief synopsis (at least 1 paragraph) and the title of the article. Be sure to attach or provide the link to the article. Week 6 Informal Aspects of Information Systems Security Readings: Chapters Discussion 11: Any reference to corporate governance results in discussing shareholders responsibilities. Perhaps there needs to be a focus on shareholder rights. Comment and compare countries with a common-law tradition (UK, USA, and those with a codified civil law Europe, former colonies). How does this impact the protection of information resources? Discussion 12: People who tend to pose the greatest IS security risks are those who have low self-esteem and strongly desire the approval of their peers. People who put more emphasis on associations and friendships relative to maintaining the organization s value system can cause serious damage to the security. Discuss. Textbook Questions (Post in Dropbox): Chapter 10, questions Case Study 3: Security Management at the Tower (p. 369). Choose one question below and write a short paragraph and discuss. Please write the question at the top of your page. 1. Describe some of the conflicts between the IT and security department. 2. Suggest some solutions to these conflicts. 3. Are most of these conflicts related to a technical, formal, or informal system? Course Evaluations: You will have an opportunity to evaluate the course near the end of the session. A link will be sent to your CougarMail that will allow you to access the evaluation. Be assured that the evaluations are anonymous and that your instructor will not be able to see them until after final grades are submitted. Week 7 Regulatory Aspects of Information Systems Security Readings: Chapters Discussion 13: There are a number of independent security assurance and certification programs. Each claims itself to be the best in the industry and suggest that their certification allows companies and individuals to place a level of trust in the systems and practices. Can any security certification or assurance program guarantee a high level of success in ensuring security? Discuss. Discussion 14: Consider HIPAA and SOX as two cases in point. Consider aspects of each law and comment on the extent to which the laws demand extraordinary measure as opposed to regular good management. Discuss. Dropbox Assignment (Post in Dropbox): 1. ISO Framework identifies 10 control areas. List and briefly describe each of the controls. 2. List and briefly describe the Six Acts that have major IS orientation. Article 3: Submit on an article related to the HIPAA rules and its impacts. Provide a brief synopsis (at least 1 paragraph) and the title of the article. Be sure to attach or provide a link to the article.

7 Columbia College Online Campus P a g e 7 Week 8 Regulatory Aspects of Information Systems Security (cont.) Readings: Chapter 15 Discussion 15: Information provided in an Intrusion Detection System is useful in dealing with computer crimes. Comment on the legal admissibility of such information. Discussion 16: Today security executives perform the difficult task of balancing the art and science of security. While the art relates to aspects of diplomacy, persuasion, and the understanding different mindsets, the science deals with establishing measures, forensics and intrusion detection. Given that security is indeed an art and a science, comment on the role of computer forensics in the overall security of the enterprise. Dropbox Assignment (Post in Dropbox) Final Exam In emergent issues there are two arenas: the international arena and the national arena. What are the 10 areas that define the critical issues within the national arena? The final exam will cover chapters Students must take a proctored Final exam between Monday and Saturday (by 11:59 PM) of this week. The exam questions are all multiple choice. It is a closed book exam. You will have 2 hours to complete it. See the information below about locating a proctor. Course Policies Student Conduct All Columbia College students, whether enrolled in a land-based or online course, are responsible for behaving in a manner consistent with Columbia College's Student Conduct Code and Acceptable Use Policy. Students violating these policies will be referred to the office of Student Affairs and/or the office of Academic Affairs for possible disciplinary action. The Student Code of Conduct and the Computer Use Policy for students can be found in the Columbia College Student Handbook. The Handbook is available online; you can also obtain a copy by calling the Student Affairs office (Campus Life) at The teacher maintains the right to manage a positive learning environment, and all students must adhere to the conventions of online etiquette. Plagiarism Your grade will be based in large part on the originality of your ideas and your written presentation of these ideas. Presenting the words, ideas, or expression of another in any form as your own is plagiarism. Students who fail to properly give credit for information contained in their written work (papers, journals, exams, etc.) are violating the intellectual property rights of the original author. For proper citation of the original authors, you should reference the appropriate publication manual for your degree program or course (APA, MLA, etc.). Violations are taken seriously in higher education and may result in a failing grade on the assignment, a grade of "F" for the course, or dismissal from the College. Collaboration conducted between students without prior permission from the instructor is considered plagiarism and will be treated as such. Spouses and roommates taking the same course should be particularly careful. Please review the plagiarism tutorial in the content area of the course. All required papers may be submitted for textual similarity review to Turnitin.com for the detection of plagiarism. All submitted papers may be included in the Turnitin.com reference database for the purpose of detecting plagiarism. This service is subject to the Terms and Conditions of Use posted on

8 Columbia College Online Campus P a g e 8 the Turnitin.com site. Please review the plagiarism tutorial that can be found in your course content area in D2L. Non-Discrimination There will be no discrimination on the basis of sex, race, color, national origin, sexual orientation, religion, ideology, political affiliation, veteran status, age, physical handicap, or marital status. Disability Services Students with documented disabilities who may need academic services for this course are required to register with the Coordinator for Disability Services at (573) Until the student has been cleared through the disability services office, accommodations do not have to be granted. If you are a student who has a documented disability, it is important for you to read the entire syllabus before enrolling in the course. The structure or the content of the course may make an accommodation not feasible. Online Participation You are expected to read the assigned texts and participate in the discussions and other course activities each week. Assignments should be posted by the due dates stated on the grading schedule in your syllabus. If an emergency arises that prevents you from participating in class, please let your instructor know as soon as possible. Attendance Policy Attendance for a week will be counted as having submitted a course assignment for which points have been earned during that week of the session or if the proctoring information has been submitted or the plagiarism quiz taken if there is no other assignment due that week. A class week is defined as the period of time between Monday and Sunday (except for Week 8, when the week and the course will end on Saturday at midnight). The course and system deadlines are all based on the Central Time Zone. Cougar All students are provided a CougarMail account when they enroll in classes at Columbia College. You are responsible for monitoring from that account for important messages from the College and from your instructor. You may forward your Cougar account to another account; however, the College cannot be held responsible for breaches in security or service interruptions with other providers. Students should use for private messages to the instructor and other students. The class discussions are for public messages so the class members can each see what others have to say about any given topic and respond. Late Assignment Policy An online class requires regular participation and a commitment to your instructor and your classmates to regularly engage in the reading, discussion and writing assignments. Although most of the online communication for this course is asynchronous, you must be able to commit to the schedule of work for the class for the next eight weeks. You must keep up with the schedule of reading and writing to successfully complete the class. No late assignments will be accepted without extenuating circumstances beyond the control of the student and with instructor notification prior to the due date (Columbia College Catalog). Course Evaluation You will have an opportunity to evaluate the course near the end of the session. A link will be sent to

9 Columbia College Online Campus P a g e 9 your CougarMail that will allow you to access the evaluation. Be assured that the evaluations are anonymous and that your instructor will not be able to see them until after final grades are submitted. Proctor Policy Students taking courses that require proctored exams must submit their completed proctor request forms to their instructors by the end of the second week of the session. Proctors located at Columbia College campuses are automatically approved. The use of ProctorU services is also automatically approved. The instructor of each course will consider any other choice of proctor for approval or denial. Additional proctor choices the instructor will consider include: public librarians, high school or college instructors, high school or college counseling services, commanding officers, education service officers, and other proctoring services. Personal friends, family members, athletic coaches and direct supervisors are not acceptable. Additional Resources Orientation for New Students This course is offered online, using course management software provided by Desire2Learn and Columbia College. The Student Manual provides details about taking an online course at Columbia College. You may also want to visit the course demonstration to view a sample course before this one opens. Technical Support If you have problems accessing the course or posting your assignments, contact your instructor, the Columbia College Helpdesk, or the D2L Helpdesk for assistance. Contact information is also available within the online course environment. CCHelpDesk@ccis.edu ex helpdesk@desire2learn.com Online Tutoring Smarthinking is a free online tutoring service available to all Columbia College students. Smarthinking provides real-time online tutoring and homework help for Math, English, and Writing. Smarthinking also provides access to live tutorials in writing and math, as well as a full range of study resources, including writing manuals, sample problems, and study skills manuals. You can access the service from wherever you have a connection to the Internet. I encourage you to take advantage of this free service provided by the college. Access Smarthinking through CougarTrack under Students->Academics->Academic Resources. Grading Criteria GRADE 9-10 = A DISCUSSION POSTINGS Online posting and reply is on time and answers given for all questions. Answers are complete and concise. Shows familiarity with the assigned readings. 8 = B Assignment is on time, but answers are not complete. 7 = C Assignment is on time, and answers may have error or missing points. 6 = D Assignment is on time, and answers may have major errors or missing points.

10 Columbia College Online Campus P a g e 10 GRADE DROPBOX ASSIGNMENTS Short Answer questions 20 = A Complete on time. Ten questions (2 points for question) = B Complete on time. Ten questions (2 points for question) = C Complete on time. Ten questions (2 points for question = D Complete on time. Ten questions (2 points for question) GRADE CURRENT NEWS RELATED ARTICLE = A Complete Assignment on time. Show highest quality work. Article Attached = B Complete Assignment on time. Show good quality work. Article Attached = C Complete Assignment on time. Show fair quality work. Article Attached = D Complete Assignment on time. Lack quality work. Article Attached. GRADE CASE STUDY = A Complete Assignment on time. Show highest quality work = B Complete Assignment on time. Show good quality work = C Complete Assignment on time. Show fair quality work = D Complete Assignment on time. Lack quality work