Final plan: Minor in Information Security Systems (ISS)

Transcription

1 #4835 Final plan: Minor in Information Security Systems (ISS) Overview: The School of Computing and Information Systems (CIS) and the School of Criminal Justice (CJ) propose a joint minor in Information Security Systems (ISS). This minor will provide the GVSU student population an opportunity to learn the basics of information security with limited additional cost or demand on GVSU resources (i.e., no added library, computer, or other related resources). A more detailed description of the minor is in Appendix A. A resource statement is located in Appendix C and D. Information security related issues are largely unseen but critical issues in contemporary society. The scope of computer-based, information crime (a.k.a. cybercrime) is far beyond common perceptions. A Department of Justice cybercrime advisor recently noted that in 2004, cybercrime yielded more illicit revenue than the illicit drug trade's estimated $105 billion for that year. In a recent cybercrime survey (2005) of over 800 organizations conducted by the US Secret Service (who along with the FBI investigates cybercrime), found that 82% of those people/individuals or organizations surveyed experienced some type of cybercrime. The average monetary loss, was $506,000. These data are typical of studies by the FBI and other private industry organizations, and represent "the tip of the iceberg," reflecting the growing problem of cybercrime. Public and private sector officials view the situation with increasing frustration. Congress is passing laws on cybercrime, and in many cases, imposing penalties on the victims for collateral damages if their computer systems fall prey to such crimes. A very real problem is a shortage of properly trained professionals in the field of information security. 1. Present the academic merit of the program and how it serves the GVSU student population. This minor will provide students with a comprehensive foundation, understanding, and recognition of the importance of how a coherent, well-developed information security program contributes to organizational effectiveness and the security of vital information for employees, clients and customers that the organization serves. The University does not currently offer any minor(s) related to information security in any of its schools or departments. As discussed in the Information and Background section of the Program Change Request, the need for this minor program is based on the recognition by faculty, practitioners, and concerns by students that there is currently no opportunity to take a series of recognized and structured courses specifically designed or related to information security. The creation of a comprehensive minor of this nature will make GVSU one of the few universities in Michigan to offer such a program. GVSU is in a unique position to be on the leading edge of this trend, with the establishment of this ISS minor that combines essential courses in criminal justice, security and computer science. The requirements for the minor are rather straightforward. The minor will be open to all students at GVSU who have an interest in gaining an understanding of 1) current issues in information security; and 2) best practices to safeguard critical information. It should be noted that the minor is best suited for CIS and CJ majors since many courses within the minor are fulfilled by taking courses within the

2 specific major, i.e., Computer Science (CS), Criminal Justice (CJ) and Information Systems (IS). Interested students will need to successfully complete 28 hours of coursework that combines a management course, in addition to criminal justice and information systems courses. 2. What is the projected financial cost of the proposed change? This minor uses existing courses and faculty from two well-established programs at GVSU. Therefore, there will be modest additional cost to these units in the context of the need for additional faculty or courses. (In fact, this minor will serve to fill existing underutilized courses that exist in CS and CJ.) Because it is projected that this minor will be popular for CS, CJ and IS students (and other interested majors), future demands for some courses may increase to the point where additional sections will be required to meet student demand. Estimates of classroom seat availability: The courses in the minor that will be affected the most are: CS 160, CS 333, CS 337, CS 458, CJ 201, CJ 302, CJ 315, CJ 311, CJ 408, CJ 464, MGT 268. As of Fall 08, the number of seats available is shown in Table 1. Seat availability is not an issue for the remaining courses. Course Number of seats available Winter 09 Number of seats available Fall 08 CS CS CS CS 458 NA 11 CJ 201 >50 >50 CJ CJ 315 NA 14 CJ CJ last offered - Winter (08) NA CJ NA MGT Table 1: Number of seats available in the different courses in the minor; data collected after the first week of class Fall 08. The data shows that most courses have 10 seats or more available for an academic year. Courses such as CS 337 and CJ 408 may require additional sections since the number of seats available is less then 10 or, as in the case of CJ 408, the course is only offered every other year (even numbered years). There will also be limited financial impact on other units that will support the minor. For example, current library holdings are adequate for this minor. Existing classroom technologies (i.e. computers, video equipment, software) and access to computer labs are more than sufficient. Initially, there may be some additional demand for classroom space (see Results of a student survey of interest below). Also, academic advising will be conducted by the CCPS advising center that have the trained personnel and resources to advise students interested in the ISS minor.

3 3. How does the proposal fit with the current direction of the University? The minor fits the current direction of the University in several ways. First, the CJ/CIS task force committee examined how the minor fits in at GVSU and also across the state. Two years ago we conducted a comprehensive search for programs in information security at other Michigan schools. At that time, we could not find one program. When we searched again in September of 2008, several programs have emerged at institutions in Michigan and throughout the United States. Ferris State University has a BS in Information Security Intelligence and minor in Digital Security and Forensics. Saginaw Valley State University has a Computer Forensics Minor Davenport University has a BS in Biometric Security and a BS in Network Security Eastern Michigan University is now offering a BA in Information Assurance and is recognized by the NSA as a Center of Academic Excellence in Information Assurance. While these programs are very diverse in their course offerings, they are all somewhat similar to the program that we are proposing for consideration at GVSU. However, emphasis on security and how it relates to the CJ system makes the ISS minor a distinctive program within the State of Michigan. Currently, job opportunities in information assurance are on the rise. As employers in a wide variety of disciplines continue to search for educated and trained workers, more and more students will be seeking the requisite skills to gain employment in information assurance. The minor fits the current direction of the University in several ways: This minor fits the overall mission of the University in the context of serving the public. The minor in ISS integrates very well with the University liberal education theme. This minor helps students integrate knowledge from two very different fields into a central theme. In other words, students learn to take advantage of facts and theories from both criminal justice and computing and apply them to the new field of Information Security Systems. The minor will prepare GVSU students for careers that require knowledge in information security. It will produce graduates that are able to meet the needs of this growing industry. The minor will compliment current GVSU programs in criminal justice, computer science, business, and other majors that deal with issues related to information security. This will offer GVSU students a unique opportunity to make themselves more marketable in their chosen careers. It will enhance GVSU s reputation as a leader in providing innovative programs that meet the needs of the 21 st century economy.

4 Results of a student survey of interest: On September 24, 2008 we surveyed students majoring in CS, CJ, and IS via , encompassing a population of 1,032 students. To date, we have received 64 responses to our survey. The responses received have all been positive with all respondents indicating that there would be significant interest by Grand Valley students in this offering and that it would be beneficial to students. We also asked these students if they would be interested in pursuing this minor. Of the 64 students responding, 51 indicated they would be interested in pursuing this offering and provided their information, requesting to be contacted when this minor becomes available. Of those not wishing contact, the largest reason was that they were graduating soon or would be unable to add a minor into their program. Interest from the three surveyed groups appeared to be balanced with students identifying themselves among all three majors polled. Overall, the results of our survey are positive, both in terms of the responses received, and the return percentage obtained (6.2%) through our mass . These factors indicate that this offering would be well-received by the Grand Valley State University target audience with perhaps additional interest from other parties. Respectfully submitted by the School of Computing and Information Systems & the School of Criminal Justice

5 Appendix A PROGRAM TITLE Minor in Information Security Systems (ISS), School of Computing and Information Systems and School of Criminal Justice, Grand Valley State University. SUMMARY OF REQUIREMENTS The minor will be open to all students at GVSU who have an interest in gaining an understanding of current issues in information security and practices that can be used to safeguard critical information, investigate violations of the criminal law and work with proper authorities to prosecute those engaged in cybercrime. The minor is best suited for students majoring in CS, CJ and/or IS. In order to attract students and meet their needs, the requirements for the minor are rather straightforward, and involve minimal additional course work. For example, for a student who is majoring in IS or CS there would be an additional credits required for the minor, i.e., (CJ 201 or CJ 302, CJ 315, CJ 311 or CJ 408, CS 458). For a student majoring in CJ there would be an additional 16 (or 19 for CS track) credits required for the minor, (i.e., CS 160, MGT 268, CS 333, CS 337, CS 458, or CS162, CS163, CS353, CS457, CS458). The rest of the requirements for the minor shown below would typically be fulfilled by taking courses within the specific major (CS, IS, CJ). Advising students to ensure that students fulfill the requirements for the minor (and major) is considered essential. For students that are not in the best suited major, they will need to successfully complete 28 hours of coursework that combines CJ and IS courses. The minor has taken into account the pre-requisites for all courses within the minor, for example: MGT 268 is a pre-requisite for CS 333, CS 353 has CS 163 as a pre-requisite and the pre-requisite has been removed for CJ 464 (a course change proposal has been submitted). All other courses within the minor have no pre-requisites. SUGGESTED PATTERN OF COURSEWORK Requirements for the minor are as follows: Up to 28 hours (this includes the pre-requisites), including the following: One criminology course: CJ 201 or CJ 302 A course in principles of security: CJ 315 One investigation course: CJ 311 or CJ 408 A course in security administration: CJ 464 One programming course: CS 160 or CS 162 or CS 163 One database course: CS 333 or CS 353 or CS 233 One network course: CS 337 or CS 457 One network security course: CS 458

6 Pre-requisites: CS 333 requires MGT 268, CS 150 CS 353 requires CS 163 CS 163 requires CS 162 CS 337 requires CS 163 CS 233 requires CS 150 CJ 408 requires CJ 101 MGT 268 requires CS 150 CJ 464 (note: a course change proposal has be submitted to remove the pre-requisite) Example 1, pattern of courses for CJ major (base knowledge): CJ majors would take: CJ 201, CJ 315, CJ 311, CJ 464 (taken by a CJ major) CS 150, CS 162, CS 233, CS 337, CS 458 (required to complete the minor, 16 credits) Example 2, pattern of courses for CJ major (more emphasis on databases): CJ majors would take: CJ 201, CJ 315, CJ 311, CJ 464 (typically required for a CJ major) CS 150, MGT 268, CS162, CS 333, CS337, CS458 (required to complete the minor, 19 credits) Example 3, pattern of courses for CS major (More emphasis white collar crime): CS majors would take: CS 162, CS 163, CS 251, CS 353, CS457, CS458 (taken by a CS major) CJ 101, CJ201, CJ315, CJ408, CJ464 (required to complete the minor, 15 credits) Example 4, pattern of courses for IS major (More emphasis criminal investigation): IS majors would take: CS 160, CS 162, MGT 268, CS 333, CS337, CS 458 (taken by a IS major) CJ 201, CJ 315, CJ 311, CJ 464 (required to complete the minor, 12 credits) Example 5, pattern of courses for non CS, CJ, or IS major (base knowledge): These non-majors would take: CS 150, CS 162, CS 233, CS 337, CS 458 CJ 201, CJ 315, CJ 311, CJ 464 (required to complete the minor, 28 credits)

7 Appendix B: For a Computer Science major the courses are: CJ 201 Criminology An analysis of crime, criminal behavior, punishment, and the theories of deviancy from historical perspectives. CJ 302 Criminal Law The sources, specific and general elements, and limitations of modern criminal laws, ad the role of criminal law in the definition and control of deviant behavior in contemporary society. CJ 311 Criminal Investigation Modern police field investigation techniques in collection and preservation of physical evidence and interrogation and preparation of formal statements of witnesses and suspects. CJ 315 Principles of Security An in-depth analysis of the historical perspectives, current status components, and opportunities in private security. Special emphasis is placed on technology, internal and external threats, and fire prevention and safety. CJ 408 White-Collar and Corporate Crime An overview of the types, causes and implications of white-collar and corporate crime, and examines the political, physical and financial harm caused by wayward corporations, corporate officials and employees. Emphasis is placed on ethical and legal decision-making and regulatory monitoring and control of white collar and corporate activity. CJ 464 Security Administration and Legal issues An in-depth analysis of critical issues in the administration and supervision of private security organizations with an emphasis on the related legal issues. CS 150 Introduction to Computing Basic principles of computing, including study of the major components of a computer system. Introduction to software packages such as word processors, spreadsheets, databases, and languages. CS 160 Programming With Visual Basic

8 Emphasis on problem solving algorithms, structure, style, and object-oriented/event-driven programming. Includes subroutines, loops, arrays, debugging files, graphics, and graphical user interface. CS 162 Computer Science I Introduction to programming and computer science through lab and lecture. Simple and structured data types and program control structures. Problem analysis, algorithm design, and computer implementation using a high-level language. CS 163 Computer Science II Programming methodology, design and analysis of algorithms, and an introduction to data structures and an introduction to the CIS computing facilities. Examples from a wide range of computing applications will be discussed. CS 233 Concepts of Database Systems Introduces key concepts of relational database management systems (DBMS) and database design. Provides hands-on experiences in data modeling, database implementation, and the design of graphical user interfaces (GUI) suitable for querying and managing the database. CS 333 Database Management and Implementation Covers information systems design and implementation within a database management system environment. Students will design and construct a physical system using database management system software to implement the logical design. Examination of the system development and modification process. Emphasis on factors for effective communication with users and interpersonal skill development. CS 353 Database History and functions of database management systems. Relational, object-oriented, network, and hierarchical models. Logical and physical database design. Query languages, application generators, data dictionaries, and client server processing. Project experience in database design and development. CS 337 Network Systems Management Provides Information Systems students with the knowledge and skills necessary to manage the sophisticated Local Area Networks available today. It approaches the subjects of network design, installation, and management from the corporate view of networking. CS 457 Data Communications

9 An introduction to data communications techniques, particularly as applied to computer networks. Physical media and devices, data link and network protocols, and other data communications topics will be studied. CS 458 System Security Learn the tools needed to protect computer systems from both inside attacks and network based attacks. Theory and applications of various techniques will be explored. MGT 268 Management Information Systems. This course is designed to give the student an understanding of the importance of information systems in modern companies, the components that make up information system and insight into the integration that good information systems foster in a business organization. Enterprise Resource Planning (ERP) Systems will also be covered.

10 Appendix C: Impact on the unit, and budget: Faculty There will be limited impact on faculty, or demand for increased faculty resources. CJ and CS courses listed in the minor already exist. Additional sections of the existing courses may be needed based upon future student demand. As stated earlier, the data shows that most courses have 10 seats or more available for an academic year. Courses such as CS 337 and CJ 408 may require additional sections since the number of seats available is less then 10 or, as in the case of CJ 408, the course is only offered every other year (even numbered years). Facilities and Special Equipment Since all of the courses listed in the minor already exist, there will be no increased demand for facilities or special equipment. Library Support As the courses required for the minor already exist, and there are existing adequate resources, there will be limited additional demands for library support in the context of resources and demand for services. Timetable The anticipated implementation of this minor is Fall Budget There is limited impact on any of the departmental budgets as indicated by the supporting documents included in the proposal. The immediate cost will be in additional training of the current faculty (at the annual cost of 4000 dollars). To summarize: Current library holdings are adequate for this minor to start the minor. Existing classroom technologies (i.e. computers, video equipment, software) and access to computer labs are more than sufficient. Also, academic advising will be conducted by the CCPS advising center that have the trained personnel and resources to advise students interested in the ISS minor. This minor uses existing courses and faculty from two well-established programs at GVSU. Based upon the survey results (see above) it is projected that this minor will be popular for CS, CJ and IS students (and other interested majors), future demands for some courses may increase to the point where additional sections will be required to meet student demand.

11 PROJECTED BUDGET SUMMARY PERSONNEL AND STUDENTS EMPLOYEES YEAR 1 YEAR 2 YEAR 3 YEAR 4 YEAR 5 Faculty (FTE): one extra section.667 two extra sections Staff (FTE): Students Enrolled*: BUDGET ITEM Personnel: Student Wages: CSSM: Equipment: Accreditation Fees: Library: Instructional Technology: PROGRAM COSTS.667 two extra sections 4000 Professional Development & workshops 4000 Professional Development & workshops 4000 Professional Development & workshops 4000 Professional Development & workshops 4000 Professional Development & workshops Other: TOTAL: ,000 60,000 60,000 Tuition: (approx:) REVENUE FROM STUDENT TUITION 71,000 71, , , ,000 We have reviewed these budget totals and believe they are reasonable estimates. Gayle R. Davis, Provost, Dean Lee VanOrsdel, Director of the Library Sue Korzinek, Information Technology *Number

12 Appendix D: SUPPORTING MATERIALS Proposed Catalog Copy Minor in Information Security Systems listed in the School of Computing and Information Systems and the School of Criminal Justice: Minor in Information Security Systems: The Information Security Systems minor, offered by the School of Computing and Information Systems and the School of Criminal Justice, is a 28 credit hour program open to all students. This minor is designed to provide students with a foundation related to the principles of information security in a theoretical and practical application related to how a comprehensive information security program will contribute to protecting organizational information assets. Required Courses: At most 28 hours including CJ 201 or CJ 302, CJ 315, CJ 311 or CJ 408 CJ 464, CS 160 or CS 162 or CS 163, CS 333 or CS 353 or CS 233, CS 337 or CS 457, CS 458. See the Director of the School of Criminal Justice, or the Director of Computing and Information Systems for additional information.

13 Appendix E GRAND VALLEY STATE UNIVERSITY CURRICULUM COMMITTEE CURRICULUM RESOURCE STATEMENT Course/Program Title: Minor in Information Security Systems (ISS), 1. Library Resources A. Unit s Evaluation Discuss the extent to which this course relies on library resources. The courses in the minor in Information Security Systems (ISS) do not make extensive use of the library resources. Evaluate the present adequacy of the library holdings relevant to this course. What additional materials are needed? The current library holdings combined with the School of Computer and Information Systems library budget are adequate for this minor. The minor in Information Security Systems (ISS) has limited effect on library resources. B. Librarian s Evaluation Discuss whether, in your judgment, the present library holdings provide satisfactory resources in the context of 1.A (above). If not, what additional materials are needed, and what are their costs? 2. Equipment Resources 3. Classroom Resources No need for additional library resources at this present time. Discuss what non-computer equipment would be required for this course and whether the available equipment is satisfactory. If additional equipment is required, describe it, and estimate its costs. The Minor in Information Security Systems (ISS) requires no additional equipment. The School of Computing and Information Systems and the School of Criminal Justice recommends the standard lecture/discussion classroom computer, which includes a standard computer and video projector with a connection to the Internet and the GVSU network. The current classroom equipment and labs are adequate for this minor. 4. Computer Resources A. Unit s Evaluation Discuss the extent to which this program or course relies on computers and related resources. The courses required in the minor in Information Security Systems (ISS) use computers (especially in the CIS courses). The standard computers in the on-campus laboratories, or the School of Computing and Information Systems computers in dedicated laboratories are what the students will use for this minor.

14 Evaluate the present adequacy of the University s computer resources relevant to this program or course. What additional equipment is needed? The present University computers are adequate for the minor in Information Security Systems (ISS) B. Information Technology s Evaluation Discuss whether, in your judgment, the present computer resources are satisfactory in the context of 4.A (above). If not, what additional materials are needed, and what are their costs? Yes, more than satisfactory. 5. Budget Impact Describe how the total resource needs (including faculty) for this course will affect the Unit s budget. The minor in Information Security Systems (ISS) utilizes current required courses in the School of Computing and Information Systems and in the School of Criminal Justice. As the minor becomes more popular, students may request additional sections, requiring additional faculty coverage and sections.

15 Notes from the task force appointed by the University regarding the minor in Information Security Systems (ISS) Members: Dave Cannon Gerald Dehondt Mostafa El-Said Roger Ferguson, Chair Patrick Gerkin Frank Hughes Brian Kingshott The proposed minor in Information Security Systems (ISS) was approved Spring The University committees (e.g., UAS, ECS, UCC, etc) noted several issues with the proposal, which are addressed in the final plan as follows: Are there hidden pre-requisites in some courses in the minor? All pre-requisites have been addressed or eliminated by course change proposals, see Appendix A, summary of requirements. Is this minor needed at GVSU and/or the community? Definitely, a September 2008 survey of Computer Science, Criminal Justice and Information Systems Majors at GVSU confirmed that there is a significant interest in this offering (see page 4 of the Final Report). Additionally, a recent cybercrime survey (2005) of over 800 organizations conducted by the US Secret Service (who, along with the FBI, investigates cybercrime), found that 82% of those people/individuals or organizations surveyed experienced some type of cybercrime. See page 1. What are the existing minors/majors being offered by other institutions? Several Universities (e.g., Ferris, Davenport) have programs in place, see page 3. What is the cost of the minor, i.e., are there seats available? We anticipate minimal additional cost, however based upon actual demand some courses may need additional sections. See page 2. In conclusion, the final plan has been updated with the current information and survey data. The final plan has been unanimously approved by the ISS Minor Committee.

16 To: From: Subject: Kristine Mullendore Chair, University Academic Senate Paul Plotkowski Dean, Padnos College of Engineering & Computing Final Plan for Information Systems Security Minor Date: February 9, 2009 A minor in Information Systems Security represents a good first step in developing offerings in the rapidly emerging field of information security. Such a minor will not only serve students enrolled in computing and criminal justice disciplines, but also offer an academic path for students interested in strengthening other academic programs by developing this area of expertise. I have reviewed and enthusiastically endorse the Final Plan for the Minor in Information Security Systems. The curriculum is well thought out and balanced. Another important strength of this proposal is that it leverages our existing offerings to better serve our students in a very economic manner.

17 To: FROM: RE: Kristine Mullendore Chair, University Academic Senate George Grant, Jr. Dean, College of Community and Public Service Information Security Systems Minor I have reviewed and enthusiastically endorse the Final Plan for the Minor in Information Security Systems. This minor begins to address the long stated desire of students wanting a program that prepares graduates for the growing demand for information security expertise. The new minor not only serves students enrolled in computing and criminal justice disciplines, but also offers an academic path for students interested in enhancing their program with these skills. I appreciate those faculty members who worked to develop this Plan, and I strongly support its approval.