Discuss the ethical, moral and professional issues relating to computer security, ethical hacking and incident response.

Transcription

1 Unit Information Form (UIF) UIF1011 The UIF provides essential information to students, staff teams and others on a particular unit. Please refer to the University s Guidance notes on Unit Information Forms before completing the details below SECTION 1 - Changes made to Section 1 of the UIF will require Faculty level approval. If substantial changes to Units/Courses are required, consult with Sub Dean (Quality Enhancement) for advice Unit Name Unit Code Security Testing and Forensic Investigation CIS019-2 Level FHEQ 5 Credit Value 30 Location of Delivery Park Square Summary/Overview This unit provides students with a wide range of essential theoretical, conceptual and pragmatic hands-on skills underpinning modern computer systems in the closely related areas of ethical hacking and forensic investigation and it requires good numeracy skills and knowledge of computer hardware architecture. Thus, topics areas such as attack techniques, concealing access and tracks, computer investigations, incident response and forensic analysis form the essential building blocks of the unit. The primary aim of the unit is: To advance the students knowledge about the judicial process within the UK, the law of evidence and laws relevant to Computer or IT security. Aims Upon successful completion of the unit the students should be able to :- Understand the procedures behind UK Judicial System and understand the role of the Crown prosecution service and the differences between Magistrate and Crown Courts. Demonstrate an understanding the concept of process to be used to safeguard evidence and in particular digital evidence gathered through computer forensic techniques. Demonstrate knowledge of the legal issues surrounding the use of computers and IT and be able to understand major pieces of UK and European legislation concerning issues with computer security.

2 Core Learning Outcomes Learning Outcomes On completion of this unit you should be able to: Assessment Criteria To achieve the learning outcome you must demonstrate the ability to: 1 2 Discuss the ethical, moral and professional issues relating to computer security, ethical hacking and incident response. To understand the concept of phases in a penetration test and the various open source frameworks. Demonstrate the understanding of concept of different codes of conduct issued by organisations with others and how to apply to ethical hacking. Show an understanding of the phases of a penetration test and discuss the individual phases and including methodologies and expected outcomes; Discuss and compare the different methodologies To know the tools and their usage to conduct a penetration test. Understand the concept of computer forensic investigation in an incident response, including an understanding of the procedures and techniques involved in scene of crime investigation. Understand the concept of conducting evidence gathering and forensic analysis and knowledge of tools to conduct computer forensic investigation. 6 Fundamentally understand the concept of different witnesses. Understand the concepts of tools availability and the phase they are used; Discuss the different tools and their advantages and disadvantages. Describe what a computer forensic investigation is; Outline the proper response to various incident scenarios; Describe procedures for evidence gathering and protection during a Crime Scene Investigation. Identify different types of forensic analysis techniques and describe the problems associated with them; Understand the concept of a range of opens source and commercial tools and discuss the availability for computer forensic analysis. Understand the role of different witnesses and their duties.

3 SECTION 2 - Any changes made to Section 2 of the UIF will normally require Faculty level approval Period of Delivery Pre-requisites/Restrictions Student Activity Year long n/a Activity Notional Learning Hours Lectures 40 Seminars/tutorials 20 Lab/Field work 20 Workshops Rehearsals 4 Assessment 10 e-learning 10 Self-directed study 196 Group work Other (specify) Total 300 This unit will be delivered using formal lectures, lab-based practical exercises and tutorial sessions to help students to understand fundamentals of ethical hacking and forensic investigation and to develop their problem-solving skills. The following specific elements are included: Lectures introduce the basic concepts of ethical hacking and forensic investigation, together with a variety of techniques needed to implement penetration testing and forensic investigation. Approach to Learning Lab-based practical sessions and tutorials provide students opportunities of consolidating the concepts and techniques introduced in the lectures and in the use of these concepts and technique to develop solutions to problems which are designed based on real-world environment. Guided and self-directed review of research papers on modern ethical hacking and forensic investigation techniques using electronic and paper based resources is expected and encouraged. Students self-directed study using a variety of information sources is expected. Communication To help with the development of this you will Skills Development Develop oral communication skills via the oral informal group work activities and in practical lab-based sessions, Written skills are developed via critical and evaluative report writing in support of their Assignment (assessment point 2). Information Literacy To help with the development of this you will:-

4 Be encouraged to access and critically review information sources via access to the web, via the Learning Resource Centre and through on-line access to scholarly Journals and articles. Where appropriate students are encouraged to critically review papers written by members of the unit team. Research and Evaluation To help with the development of this you will:- Be encouraged to evaluate academic literature whilst completing the first two assessment points and be encouraged to search for state of the art information sources to support your study. Where appropriate students are encouraged to critically review papers written by members of the unit team. Creativity and Critical Thinking To help with the development of this you will:- Be encouraged to creative problem-solving, not only in relation to specific assessment, but also towards wider issues that relate to real-world concerns in relation to real-world testing requirements and incident response. Each of the assessment points provides ample opportunities for students to demonstrate creativity and critical awareness. 1. The first assessment point is a short in class test conducted in class on UK and European legislation and legal issues and basic Forensic tests to provide formative feedback as to student s progress. Assessment Strategy 2. The second assessment point is designed to test students understanding of computer forensics and problem-solving skills development in terms of solving problems design in real-world environment. This assignment is practical-based. Students are expected to complete this assignment within a small group. A supportive written commentary and discussion are encouraged. 3. This assessment point comprises a three hour unseen written examination covering all aspects of this unit. No Learning Outcomes Submission week Assessment Description of Assessment Weight Assessed (assignments) or Method* Method % length (exam) 1 CB In-unit test 20 X X Week 10 2 CS,GR Case Study 40 X X X Week 20 3 EX Exam 40 X X X X X X 2 hours *The following codes for assessment methods apply:- AR Artifact PC Practical CB Computer-based PF Performance CS Case Study PL Placement DI Dissertation or Project PO Portfolio

5 EX Exam PR Presentation GR Group Report RE Individual Report IT In-unit Test OR Oral LR Literature Review OT Other SECTION 3 - Once initial approval of the unit has been given, the Unit Co-ordinator may make changes to this section, following appropriate consultation Outline Teaching Schedule Overview and introduction (2 weeks) Background knowledge (2 weeks) Ethics of Penetration Testing (1 week) Penetration Testing (2 weeks) Tools (2 weeks) Understanding Computer Investigations (3 weeks): First Response to Incidents (1 week): Digital Evidence Preservation (2 weeks) Understanding Operating systems & File Storage (2 weeks) Data Acquisition (3 weeks) Forensic Analysis (5 weeks) Revision (2 Weeks) Recommended Resources Essential Hands-on Ethical Hacking and Network Defence, Michael t. Simpson, Thompson,ISBN Guide to Computer Forensics and Investigation, Second Edition, Bill Nelson et al, Thomson, ISBN File System Forensic Analysis, Brian Carrier, Addison Wesley, ISBN Cole E (2008): Network Security Fundamentals, Wiley, ISBN 13: Background Penetration Testers Open Source Toolkit, Johnny Long et al, Syngress, ISBN Wi-Foo The secrets of wireless hacking, Andrew Vladimirov, Addison-Wesley, ISBN Cole Eric (2009): Network Security Bible, John Wiley & Sons; 2nd ed. ISBN-10: Harlan Carvey (2009): Windows Forensic Analysis DVD Toolkit, Edition 2, Elsevier Science, ISBN: ,

6 Catherine Bond, et al. (2007): The Expert Witness: A Practical Guide, Third Edition, Shaw & Sons, ISBN X William Stallings (2003): Cryptography and Network Security: Principles and Practice, Prentice Hall, ISBN Ross Anderson (2008): Security Engineering, 2nd Ed. Wiley Dieter Gollmann (2005): Computer Security, 2nd Ed. John Wiley and Sons Ltd. ISBN: Security Computer Forensics Principles and practices, Linda Volonino et al, Pearson, ISBN Computer Forensics Jump Start, Michael Solomon, Sybex, ISBN X Real Digital Forensics, Keith Jones el al, Addison Wesley, ISBN Journals Computers and Security International Journals of Information Management and Computer Security SECTION 4 Administrative Information Faculty Field Department/School/Division Unit Co-ordinator CATS Undergraduate Computer Science and Technology Department of Computer Science and Technology Xiaohua Feng Version Number Body approving this version FTQSC (Periodic Review 2012) Date of University approval of this version (dd/mm/yyyy) Shared Units Indicate below all courses which include this Unit in their diet BSc (Hons) Computer Security and Forensics Form completed by: Name: Marc Conrad Date: 27/02/2012 Authorisation on behalf of the Faculty Teaching Quality and Standards Committee (FTQSC) Chair: Date:... Unit Updates Date (dd/mm/yyyy) Nature of Update FTQSC Minute Ref:

7