Introduction to Information Security (IST623)

Transcription

1 Intrductin t Infrmatin Security (IST623) Spring 2014, Campus Schl f Infrmatin Studies Syracuse University 1. Instructr Name: Prf. Jn S. Park, Ph.D. jspark@syr.edu Phne: (315) URL: Fax: (315) Office: 334 Hinds Hall, Schl f Infrmatin Studies, Syracuse University, New Yrk Office Hurs: Thursday 10:00 AM 11:00 AM r By Appintment 2. Teaching Assistant Name: Arpit Blia ablia@syr.edu Office: 325 Hinds Hall, Schl f Infrmatin Studies, Syracuse University, New Yrk Office Hurs: Thursday 10:00 AM 11:00 AM r By Appintment 3. Meeting Time & Place TBD 4. Prerequisite / C-requisite Nne 5. Curse Descriptin This curse (IST623, Intrductin t Infrmatin Security) is intended t teach fundamental elements in infrmatin security and intrduce the key areas f security challenges, cuntermeasures, and applicatins. The curse will fcus n a cmprehensive understanding f infrmatin security rather than an in-depth analysis f a particular area. Tpics include security prperties, vulnerabilities, cryptgraphy, PKI (Public Key Infrastructure), security plicies, authenticatin, access cntrl, security prtcls, netwrk security, cyber attacks, and security management. Students will als have research pprtunities and hands-n experiences in infrmatin security. This is the nly cre curse fr the Certificate f IST623 1 Spring 2014

2 Advanced Study (CAS) in Infrmatin Security Management (ISM) and ne f the tw required curses fr the Infrmatin Security Specializatin in the Master f Science in Infrmatin Management (IM). 6. Curse Learning Outcmes After taking this curse, the students will be able t: Explain the fundamental security elements, including security prperties, vulnerabilities, cryptgraphy, PKI (Public Key Infrastructure), security plicies, authenticatin, access cntrl, security prtcls, netwrk security, cyber attacks, and security management. Demnstrate the hands-n ability t analyze security prperties using varius security services and tls. Cnduct further study n a specific area f infrmatin security, extending the cntents learned frm this curse. Explain in-depth security knwledge and skills in the research areas that they selected. Demnstrate the ability in cllabratin with ther clleagues t perfrm team prjects in infrmatin security. 7. Curse This intrductry curse in infrmatin security is intended t teach the cmprehensive cncepts and cre elements in the area. Therefre, there is n single bk that cvers all the tpics f the curse. We will use the lecture materials develped by Dr. Park fr this curse and the textbk alng with additinal resurces, which will be available within Syracuse University s Blackbard learning management system ( Textbk (required) Crprate Cmputer Security (3 rd Editin) Authrs: Randall Byle and Raymnd Pank) ISBN: Available thrugh the Syracuse University Bkstre and ther nline bkstres. In additin t the lecture slides and the required textbk, additinal class materials are available under Additinal Readings within the curse Blackbard. Recmmended search engines fr research articles: ACM Digital Library IEEE Xplre CiteSeer ( ** Nte** In rder t access the digital libraries with the university s license, yur access shuld start frm Syracuse University Libraries ( Then, yu may search fr the specific Databases (e.g., ACM Digital Library r IEEE Xplre) first by selecting Databases under the Find menu. If yur current machine des nt use an SU IP (say, yu are using a hme machine), yu will be asked t lg in with yur SU NetID. IST623 2 Spring 2014

3 8. Curse Requirements 8.1 Curse Plicies Primary Cntact: If yu need t me regarding this class, please use the Curse Messages tl with instead f my regular . This helps me t rganize my curse cntents. I typically respnd within 48 hurs Mnday thrugh Friday. In an emergency nly (r regarding nn-class related issues), yu may me at jspark@syr.edu. Late Submissin: Students are expected t submit all the assignments befre r n the due date. Late submissin is allwed up t ne week but with 10% penalty per day. Assignments are nt accepted mre than a week after the due date. Late submissin may receive its assessment much later than the assignments submitted n time. Make-up Cnditin: Make-up assignments will nly be allwed if the student can prvide a frmal dcumentatin thrugh the crrespnding ffice. If yu are having prblems in keeping up with the class, yu shuld cntact the instructr immediately s that apprpriate arrangements can be made as sn as pssible. Wrking Grups: Thrugh the grup activities in the curse all the students will have valuable experience wrking with grup members fr bth their case studies and research prjects. The quality utcmes f thse activities can be cunted fr part f yur prfessinal career develpment. Wrking grups will be frmed in the third week f the curse. Each team typically includes 3-5 students with 4 being the ideal number. Each grup is required t designate a leader, wh will be the primary pint f cntact with the instructr. Case Studies (Grup): Each grup is required t present its security-related case study t the class (20-minute presentatin and 10-minute Q&A). Sme example cases are available in the textbk (e.g., the TJX Data Breach, pages 4-9), but are nt limited t them. Each case study shuld list at least 5 references (e.g., published news, jurnal articles, cnference prceedings, nline resurces, etc.) relevant t the tpic, prviding the URL, PDF, r ther reference infrmatin. The presenting grups are required t pst their presentatin materials (e.g., slides, vide/audi clips, etc.) t the class Blackbard 24 hurs befre the scheduled class s that the ther students can preview them befre the class. N ther submissin is required. Assignment#2 (individual, due by ***) will require yur summaries f three cases studies (ne frm each case study sessin, excluding his/her wn grup s wrk) in 1000 wrds each (duble-spaced, 11-fnt size, 1 inch margins, Times New Rman), including the key ideas f the case study (< 800 wrds) and the lessns (< 200 wrds) yu learned frm it. Research Prject (Grup): Each grup can chse ne f the fllwing three tracks fr the research prject. If yu have any dubt abut the tpic f yur research prject, please feel free t discuss it with Dr. Park. Track#1: Security Tl Dem/Analysis (e.g., Nessus, WEP Cracking, SET (Scial Engineer Tlkit), Malteg, etc.) Track#2: Security Vulnerability Assessment in Existing Services/Applicatins (e.g., Facebk, ebay, PayPal, Windws, etc.) Track#3: Survey n Security Areas (e.g., Security Technlgy Trends, Security Certificatins, Security Curriculum/Training Prgrams, Future f Infrmatin Security, etc.) IST623 3 Spring 2014

4 Each grup is required t present their prject plan and utcmes t the class separately. All the grups are required t present their prject plans first t the class (< 10 minutes/grup, tentatively scheduled n ***) and receive cmments/suggestins frm the ther students and Dr. Park. The final disseminatin is scheduled in the last week f the curse (tentatively scheduled n ***). The methd f the final disseminatin (i.e., presentatin, pster, and ther methds) will be determined based n the class size. Each grup is required t pst their prject materials (e.g., slides, vide/audi clips, etc.) fr bth the prject plan and the final disseminatin t the class Blackbard 24 hurs prir t the scheduled class s that the ther students can preview them befre the class. N ther submissin is required. There is n fixed frmat fr yur presentatin/pster. Hwever, in yur grup s final presentatin/pster, yu shuld list at least 10 references (e.g., published news, jurnal articles, cnference prceedings, nline resurces, etc.) relevant t the tpic area, prviding the URL, PDF, r ther reference infrmatin, and summarize the lessns/recmmendatins/suggestins that yu learned thrugh yur research prject. TME (Individual): Grup wrk needs a team effrt by the members. Each member is required t cntribute individually t a whle. T encurage each member's active participatin in the grup activities and prduce a fair grading result, each student is required t submit his/her TME (Team Member Evaluatin) in the end f the semester, cnsidering self/peer cntributin t the grup wrk thrughut the semester. TME is an individual evaluatin. The instructr will take yur TME very seriusly fr grading each student s grup wrk (i.e., case study and research prject). Yu must nt share yur TME with thers. The TME frm will be prvided in the class. I wuld like t urge yu t start wrking with yur grup members fr the grup activities as sn as pssible s that each member can spend sufficient time n his/her cntributin t the team. Hands-On Labs (Individual): Each student will cnduct hands-n labs based n the class cntents. The graduate lab instructrs will assist yu t finish the lab prcedures in the scheduled lab sessins. Yu may cntinue the labs beynd the lab sessins if yu need mre time. Each student is required t submit the lab reprt after each lab. 8.2 Curse Assessment Activities Case Study Class Participatin Assignment #1 Assignment #2 Labs Grup Prject Plan Final Disseminatin Ttal Pints 10 pints 10 pints 5 pints 15 pints 30 pints (5 pints fr each lab) 5 pints 25 pints 100 pints 8.3 Grading Scale Pints Earned Grade A A B+ IST623 4 Spring 2014

5 9. Tentative Class Schedule B B C C D Belw 55 F Week N. #1 #2 #3 #4 #5 #6 #7 #8 Tpics Class Activities Readings Assignments Due* Ice Breaker Intrductin (Security Prgrams at ischl, Curse Overview, Security Prperties, Security Trends) Security Cncerns (Threat Envirnment, Security Incidents, Basic Terminlgies) Security Plicies (Security Plicy Principals, Security Plicy Examples, Planning) Secret Key Cryptgraphy (Operatinal Scheme, Basic Algrithms, Attack Analysis) Public Key Cryptgraphy (Operatinal Schemes, Basic Algrithms, Digital Hashes, Digital Certificates) Access Cntrl (Access Cntrl Mdels, BLP Rules, RBAC Cncepts) Authenticatin (Passwrds, Physical Devices, Bimetrics, Cryptgraphic Techniques, Kerbers) Internet Security Prtcls Assignment #1 (Shrt Bi) Lab #1 Frm Research Grups Lab #2 Research Prject- Plan Presentatin and Review Lab #3 Case Study #1 Assignment #2 (1/3) Lab # , Assignment #1 (Pst t Bb befre Lab #1 Reprt Each Grup s Presentatin Slides (Pst t Bb befre Lab #2 Reprt Case Study #1 (Pst t Bb at least TWO days befre Lab #3 Reprt IST623 5 Spring 2014

6 #9 (SSL/TLS, IPSEC, SSH) Wireless Security Case Study #2 Assignment #2 (2/3) Case Study #2 (Pst t Bb at least TWO days befre #10 Firewalls Lab #5 Lab #4 Reprt #11 #12 Security Management (Applicatin Security, Data Prtectin, Incident Respnse) Security Evaluatin (Orange Bk, Cmmn Criteria) Case Study #3 Assignment #2 (3/3) Lab # , 6.5 Case Study #3 (Pst t Bb at least TWO days befre Lab #5 Reprt #13 #14 Special Tpic Research Prject Disseminatin Finalizing Research Prjects Prject Presentatin Tl Demnstratin Discussin Prvided by Research Grups Assignment #2 Lab #6 Reprt Each Grup s Presentatin/Dem (Pst t Bb befre TME *Nte: Please submit assignments as directed. D NOT assignments t the instructr r graduate assistants. Thse will nt be accepted. Assignments shuld be prepared in a prfessinal manner accrding t the submissin guidelines with crrect spelling and grammar. 10. Class Administratin Academic Integrity Syracuse University s Academic Integrity Plicy hlds students accuntable fr the integrity f the wrk they submit. Students shuld be familiar with the plicy and knw that it is their respnsibility t learn abut curse-specific expectatins, as well as abut university plicy. The university plicy gverns apprpriate citatin and use f surces, the integrity f wrk submitted in exams and assignments, and the veracity f signatures n attendance sheets and ther verificatin f participatin in class activities. The plicy als prhibits students frm IST623 6 Spring 2014

7 submitting the same written wrk in mre than ne class withut receiving written authrizatin in advance frm bth instructrs. The presumptive penalty fr a first ffense by an undergraduate student is curse failure, accmpanied by a transcript ntatin indicating that the failure resulted frm a vilatin f Academic Integrity Plicy. The standard sanctin fr a first ffense by a graduate student is suspensin r expulsin. Fr mre infrmatin and the cmplete plicy, see Disability-Related Accmmdatins If yu believe that yu need accmmdatins fr a disability, please cntact the Office f Disability Services(ODS), lcated in Rm 309 f 804 University Avenue, r call (315) fr an appintment t discuss yur needs and the prcess fr requesting accmmdatins. ODS is respnsible fr crdinating disabilityrelated accmmdatins and will issue students with dcumented Disabilities Accmmdatin Authrizatin Letters, as apprpriate. Since accmmdatins may require early planning and generally are nt prvided retractively, please cntact ODS as sn as pssible. Religius Observances Plicy SU religius bservances plicy, fund at recgnizes the diversity f faiths represented amng the campus cmmunity and prtects the rights f students, faculty, and staff t bserve religius hlidays accrding t their traditin. Under the plicy, students are prvided an pprtunity t make up any examinatin, study, r wrk requirements that may be missed due t are religius bservance prvided they ntify their instructrs befre the end f the secnd week f classes. Fr fall and spring semesters, an nline ntificatin prcess is available thrugh MySlice/StudentServices/Enrllment/MyReligiusObservances frm the first day f class until the end f the secnd week f class. Ownership f Student Wrk: This curse may use curse participatin and dcuments created by students fr educatinal purpses. In cmpliance with the Federal Family Educatinal Rights and Privacy Act, wrks in all media prduced by students as part f their curse participatin at Syracuse University may be used fr educatinal purpses, prvided that the curse syllabus makes clear that such use may ccur. It is understd that registratin fr and cntinued enrllment in a curse where such use f student wrks is annunced cnstitutes permissin by the student. After such a curse has been cmpleted, any further use f student wrks will meet ne f the fllwing cnditins: (1) the wrk will be rendered annymus thrugh the remval f all persnal identificatin f the wrk s creatr/riginatr(s); r (2) the creatr/riginatr(s) written permissin will be secured. As generally accepted practice, hnrs theses, graduate theses, graduate research prjects, dissertatins, r ther exit prjects submitted in partial fulfillment f degree requirements are placed in the library, University Archives, r academic departments fr public reference. University Enrllment Plicy: Only fficially registered students are allwed in this curse. University plicy prhibits students frm attending, being evaluated, auditing, r participating in regular semester curses withut being fficially enrlled. Schedule Change: The curse schedule is a plan, which may be changed. IST623 7 Spring 2014