Enterprise Security Management CIS 259

Enterprise Security Management CIS 259 Prerequisites CIS 175 Descriptin This curse is designed t cver the managerial aspects f cmputer security and risk management fr enterprises. The student will attain knwledge fr accreditatin, prcurement, extensin and peratin principles fr secure cmputing systems. This curse is ne f the required curses fr btaining the NSTISSI 4011 and CNSSI 4013 certificatins. CNSSI 4013 Curse Objectives CNSSI 4013 Mapping Details General Curse Objectives Textbk Whitman and Mattrd, Management f Infrmatin Security. Curse Technlgy, 2010, ISBN 10: 1-4354-8884-9. ISBN-13: 978-1-4354-8884-7. Other References Air Frce Instructin 33-203, Vlume 3, Emissin Security Cuntermeasures - AFI33-203V3, Nvember 2005. Department f Defense MANUALNUMBER 5205.02-M - DD OPSEC Manual, Nvember 2008. Department f Defense Directive 8500.01E, Octber, 2002 http://en.wikiversity.rg/wiki/intrductin_t_cmputers Infrmatin Systems Security: A Cmprehensive Mdel Annex - NSTISSI_4011 Key Management Using ANSI X9.17, U.S. Department f cmmerce, OMB Circular A-130 NIST Special Publicatin 800-12, An Intrductin t Cmputer Security, Octber 1995. NIST Special Publicatin 800-16, Infrmatin Technlgy Security Training Requirements: A Rle- and Perfrmance-Based Mdel, April 1998. NIST Special Publicatin 800-18, Guide fr Develping Security Plans fr Federal Infrmatin Systems, February 2006. 1

NIST Special Publicatin 800-26, Security Self-Assessment Guide fr Infrmatin Technlgy Systems, Nvember 2001. NIST Special Publicatin 800-30, Risk Management Guide fr Infrmatin Technlgy Systems, July 2002. NIST Special Publicatin 800-34, Cntingency Planning Guide fr Infrmatin Technlgy Systems, June 2002. NIST Special Publicatin 800-37, Guide fr the Security Certificatin and Accreditatin f Federal Infrmatin Systems, May 2004 NIST Special Publicatin 800-47, Security Guide fr Intercnnecting Infrmatin Technlgy Systems, September 2002. NIST Special Publicatin 800-50, Building an Infrmatin Technlgy Security Awareness and Training Prgram, Octber 2003. NIST Special Publicatin 800-53, Recmmended Security Cntrls fr Federal Infrmatin Systems, December 2006. NIST Special Publicatin 800-59, Guideline fr Identifying an Infrmatin System as a Natinal Security System, August 2003. NIST Special Publicatin 800-60, Guide fr Mapping Types f Infrmatin and Infrmatin Systems t Security Categries, June 2004. NIST Special Publicatin 800-61, Cmputer Security Incident Handling Guide, January 2004. NIST Special Publicatin 800-64, Security Cnsideratins in the Infrmatin System Develpment Life Cycle, Octber 2003. NIST Special Publicatin 800-83, Guide t Malware Incident Preventin and Handling, Nvember 2005. NIST Special Publicatin 800-88, Guidelines fr Media Sanitizatin, September 2006. NIST Special Publicatin 800-100, Infrmatin Security Handbk: A Guide fr Managers, Octber 2006. CNSS Plicy N. 6, Natinal Plicy n Certificatin and Accreditatin f Natinal Security Systems, Octber 2005. CNSS Instructin N. 4009: Natinal Infrmatin Assurance (IA) Glssary, April 2010 NSTISSAM COMPUSEC/1-99: NSTISSAM COMPUSEC/1-99, Advisry Memrandum n the Transitin frm the Trusted Cmputer System Evaluatin Criteria t the Internatinal Cmmn Criteria fr Infrmatin Technlgy Security Evaluatin OMB Circular A-123, Management s Respnsibility fr Internal Cntrl http://www.niap-ccevs.rg/ web site cntains detailed infrmatin abut NSTISSP 11 and Cmmn Criteria Evaluatin and Validatin Scheme. Grading and Evaluatin Criteria 2

30% f the grade is based n quizzes. 70% f the grade will be based n in-class and take-hme labs Grading Scale A = 92-100 B = 83-91 C =75-82 D =70-74 F = 69 r belw Late Wrk Late lab assignments and quizzes will nt be accepted. Please be sure t keep up and pay very clse attentin t the due dates. Other Cmments Dishnesty will nt be tlerated. A final curse grade f F will be given t any student caught cheating. See the academic hnesty statement. Jacksn State will make reasnable accmmdatins fr persns with dcumented physical, mental r learning disabilities. Students shuld ntify their instructr and the Crdinatr f Disabled Student Services lcated in the Cunseling Office, Rm 12 f the Student Unin Building - f any special needs. Instructrs shuld be ntified the first week f class. All discussins remain cnfidential. N children allwed in the classrm. 3

Enterprise Security Management CIS 259 CNSSI 4013 Curse Objectives F1A1. Define and utline rganizatinal accuntability plicies, prcesses and prgrams F1A2. Define and Discuss emerging trends in the certificatin and accreditatin plicy f U.S. federal and ther rganizatin IT systems F1A3. Describe the dminant infrmatin security blueprints, framewrks, and infrmatin security management mdels, including U.S. gvernment sanctined mdels F1A4. Select an infrmatin security management mdel and custmize it t meet the needs f a particular rganizatin as it relates t a system security architecture study F1A5. Discuss and define hw assessments fr use during certificatin f infrmatin systems are prepared F1A6. Discuss NSTISSP 11 (Cmmn Criteria) plicies F1A7. Define and explain cnfiguratin cntrl (management) F1A8. Define defense in depth and give examples f defense in depth methds and plicy F1A9. Identify Department f Defense Directive 8500.1 plicies apprpriate civil agency guidance F1A10. Define and describe security dmains applicable t rganizatinal plicies F1A11. Define generally accepted security principles, gals, missin and bjectives f the rganizatin F1A12. Define and describe infrmatin assurance with regards t accreditatin, planning, design, implementatin and plicy develpment F1A13. Understand that a successful infrmatin security prgram is the respnsibility f bth an rganizatin s general management and IT management which includes infrmatin peratins and recrds retentin F1A14. Using examples, demnstrate hw t perfrm marking f sensitive infrmatin prcedures and discuss plicies relating t marking f classified, unclassified and sensitive infrmatin F1A15. Define magnetic media degaussing, marking, handling, string and destrying sensitive infrmatin and media, media management, identify infrmatin resurce wner and secure data deletin fr media reuse F1A16. Identify systems security standards plicies F1A17. Identify Infrmatin Technlgy Security Evaluatin Criteria (ITSEC) plices F1A18. Discuss the phases f the security systems develpment life cycle management, which includes requirements definitins, develpment, demnstratin and validatin, implementatin, peratins and testing and security with regards t certificatin and accreditatin F1A19. Describe wrkstatin security plicies F1B1 Describe the dminant infrmatin security blueprints, framewrks, and infrmatin security management mdels, including U.S. gvernment sanctined mdels F1B2 Explain why access cntrl is an essential element f infrmatin security management F1B3 Select an infrmatin security management mdel and custmize it t meet the needs f a particular rganizatin as it relates t a system security architecture study F1B4 Discuss hw assessments fr use during certificatin f infrmatin systems are prepared F1B5 Discuss NSTISSP 11 (Cmmn Criteria) plicies

Enterprise Security Management CIS 259 CNSSI 4013 Mapping Details (F1A) General Security Plicy (F1A1) Accuntability: OMB Circular A-123, Management s Respnsibility fr Internal Cntrl defines rganizatins accuntability plicies and utlines accuntability prcesses and prgrams. Curse bjective F1A1 (F1A2) Accreditatin: Curse textbk defines accreditatin. Curse bjective F1A2 (F1A3) Architecture: Curse textbk defines system security architectures, identifies apprpriate security architectures fr use in assigned IS, and address system security architecture study. Curse bjectives F1A3 and F1A4 (F1A4) Assessment: The NIST Handbk Special Publicatin 800-37, Guide fr Applying the Risk Management Framewrk fr Federal Infrmatin System: A Security Life Cycle Apprach - NIST 800-37.pdf Chapter 3 Defines assessments fr use during certificatin f infrmatin systems. Curse bjectives F1A5 and F1A6 (F1A5) Assurance: The NIST Handbk Special Publicatin 800-37, Guide fr Applying the Risk Management Framewrk fr Federal Infrmatin System: A Security Life Cycle Apprach - NIST 800-37.pdf Chapters 2 and 3 and the curse textbk define assurance. Curse bjective F1A12 (F1A6) Availability, Integrity, Cnfidentiality, Authenticatin and Nn-Repudiatin: Cvered in the CIS 156 curse. (F1A7) Certificatin: The NIST Handbk Special Publicatin 800-12 NIST 800-12.pdf Chapter 8 and the curse textbk defines certificatin plicies as related t rganizatinal requirements. Curse bjectives F1A2 (F1A8) NSTISSP 11, Natinal Plicy Gverning the Acquisitin f Infrmatin Assurance (IA) and IA Enabled Infrmatin Technlgy (IT) Prducts: http://www.niapccevs.rg/ web site cntains detailed infrmatin abut NSTISSP 11 and Cmmn Criteria Evaluatin and Validatin Scheme. The curse textbk als address Cmmn Criteria. Curse bjective F1A6 (F1A9) Cnfiguratin Cntrl: NIST Special Publicatin 800-53 Rev. A - Recmmended Security Cntrls fr Federal Infrmatin Systems and Organizatins explains cnfiguratin cntrl (management). Curse bjective F1A7 (F1A10) Custdian: Cvered in the CIS 156 curse. (F1A11) Defense in Depth: CNSS Instructin N. 4009: Natinal Infrmatin Assurance (IA) Glssary define defense in depth. Examples f defense in depth methds and plicy will be presented. Curse bjective F1A8 (F1A12) Dcument: Department f Defense Directive 8500.01E plicies are identified. Curse bjective F1A9 (F1A13) Dmains: Department f Defense Directive 8500.01E defines and describes security dmains applicable t rganizatinal plicies. Curse bjective F1A10 (F1A14) E-Mail: Cvered in the CIS 156 curse. (F1A15) Wireless Security : Cvered in the CIS 250 curse. (F1A16) EMSEC/TEMPEST (Emanatins Security/Shrt name referring t the investigatin, study, and cntrl f cmprmising emanatins frm IS equipment): Cvered in the CIS 250 curse. (F1A18) FAX: Cvered in the CIS 156 curse (F1A19) Generally Accepted Security Principles: The NIST Handbk Special Publicatin 800-12 NIST 800-12.pdf and the curse textbk define generally accepted security principles. Curse bjective F1A11 (F1A20) Gals/Missin/Objectives: The NIST Handbk Special Publicatin 800-12 NIST 800-12.pdf and the curse textbk define gals, missins and bjectives f the rganizatin. Curse bjective F1A11 (F1A21)Incident Respnse: Cvered in the CIS 156 curse

(F1A22) Infrmatin Assurance: The NIST Handbk Special Publicatin 800-37, Guide fr Applying the Risk Management Framewrk fr Federal Infrmatin System: A Security Life Cycle Apprach - NIST 800-37.pdf Chapters 2 and 3 and the curse textbk define rganizatinal infrmatin assurance plicies. Curse bjective F1A12 (F1A23) Infrmatin Operatins [DOD Organizatins Only]: The NIST Handbk Special Publicatin 800-12, Chapter 14 defines, describes and discusses hw t supprt infrmatin peratins. Curse bjective F1A13 (F1A24) Internet Security: Cvered in the CIS 156 curse. (F1A25) Law Enfrcement: Cvered in the CIS 156 curse. (F1A26) Marking: Cvered in the CIS 156 curse. (F1A27) Mnitring: Cvered in the CIS 156 curse. (F1A28) Multi-Level Security: Cvered in the CIS 156 curse. (F1A29) Netwrk: Cvered in the CIS 250 curse. (F1A30) Operating System: Cvered in the CIS 250 curse. (F1A32) Ownership: Cvered in the CIS 156 curse. (F1A33) Physical Security: Cvered in the CIS 250 curse. (F1A34) Recrds Management: Cvered in the CIS 156 curse. (F1A37) Security Tls: Cvered in the CIS 156 curse. (F1A38) Sensitivity: 32 CFR Parts 2001 and 2003 Classified Natinal Security Infrmatin defines, describes and explains infrmatin sensitivity in relatin t rganizatinal plicies. Curse bjectives F1A14 and F1A15 (F1A39) Separatin f Duties: Cvered in the CIS 156 curse. (F1A40) System Security: NIST Special Publicatin 800-16, Infrmatin Technlgy Security Training Requirements: A Rle- and Perfrmance-Based Mdel and CNSS Instructin N. 4009: Natinal Infrmatin Assurance (IA) Glssary identifies systems security standards plicies. Curse bjective F1A16 (F1A41) Infrmatin Technlgy Security Evaluatin Criteria (ITSEC): Infrmatin Technlgy Security Evaluatin Criteria (ITSEC) identifies Infrmatin Technlgy Security Evaluatin Criteria (ITSEC) plices. Curse bjective F1A17 (F1A42) Testing: Cvered in the CIS 156 curse. (F1A43) Validatin/Verificatin: The NIST Handbk Special Publicatin 800-12 NIST 800-12.pdf Chapter 8 defines and identifies validatin and verificatin prcess plicies. Curse bjective F1A18 (F1A44) Wrkstatin: The NIST Handbk Special Publicatin 800-12 NIST 800-12.pdf Chapter 15 describes wrkstatin security plicies. Curse bjective F1A19 (F1A45) Zne: Cvered in the CIS 250 curse (F1B) General Prcedures (F1B1) Netwrk Sftware: CIS 175 (F1B2) Aggregatin: CIS 156 (F1B3) Applicatin Vulnerabilities: CIS 156 (F1B4) Architecture: The curse textbk addresses system security architecture study. Curse bjectives F1B1, F1B3 (F1B5) Assessment: The NIST Handbk Special Publicatin 800-37, Guide fr Applying the Risk Management Framewrk fr Federal Infrmatin System: A Security Life Cycle Apprach - NIST 800-37.pdf Chapter 3 cvers assessments fr use during certificatin f infrmatin systems. Curse bjectives F1B4 F1B5

Enterprise Security Management CIS 259 General Curse Objectives 1. Assess risk based n the likelihd f adverse events and the effects n infrmatin assets when events ccur 2. Create a simple set f cntingency plans, using business impact analysis 3. Define and describe infrmatin assurance with regards t accreditatin, planning, design, implementatin and plicy develpment 4. Define and describe security dmains applicable t rganizatinal plicies 5. Define and Discuss emerging trends in the certificatin and accreditatin plicy f U.S. federal and ther rganizatin IT systems 6. Define and explain cnfiguratin cntrl (management) 7. Define and utline rganizatinal accuntability plicies, prcesses and prgrams 8. Define defense in depth and give examples f defense in depth methds and plicy 9. Define generally accepted security principles, gals, missin and bjectives f the rganizatin 10. Define infrmatin security plicy and understand its central rle in a successful infrmatin security prgram 11. Define magnetic media degaussing, marking, handling, string and destrying sensitive infrmatin and media, media management, identify infrmatin resurce wner and secure data deletin fr media reuse 12. Define risk management and its rle in the rganizatin 13. Describe the cmpnents f a security educatin, training, and awareness prgram and explain hw rganizatins create and manage these prgrams 14. Describe the dminant infrmatin security blueprints, framewrks, and infrmatin security management mdels, including U.S. gvernment sanctined mdels 15. Describe the ethical fundatins and appraches that underlie mdern cdes f ethics 16. Describe the imprtance f the manager s rle in securing an rganizatin s use f infrmatin technlgy and understand wh is respnsible fr prtecting an rganizatin s infrmatin assets 17. Describe the key cmpnents f a security metrics prgram 18. Describe the majr cmpnents f cntingency planning Describe the OCTAVE Methd and ther appraches t managing risk 19. Describe the rle f culture as it applies t ethics in infrmatin security 20. Describe the security practices used t cntrl emplyee behavir and prevent misuse f infrmatin 21. Describe the three majr types f infrmatin security plicy and explain what ges int each type 22. Describe the varius access cntrl appraches, including authenticatin, authrizatin, and bimetric access cntrls 23. Describe wrkstatin security plicies 24. Determine hw t plan and staff an rganizatin s infrmatin security prgram based n its size 25. Develp, implement, and maintain varius types f infrmatin security plicies 26. Differentiate between law and ethics 27. Differentiate between strategic rganizatin infrmatin security planning and specialized cntingency planning 28. Differentiate infrmatin security management frm general management 29. Discuss and define hw assessments fr use during certificatin f infrmatin systems are prepared 30. Discuss and implement infrmatin security cnstraints n the general hiring prcesses 31. Discuss emerging trends in the certificatin and accreditatin f U.S. federal IT systems 32. Discuss hw assessments fr use during certificatin f infrmatin systems are prepared 33. Discuss NSTISSP 11 (Cmmn Criteria) plicies 34. Discuss the phases f the security systems develpment life cycle management, which includes requirements definitins, develpment, demnstratin and validatin, implementatin, peratins and testing and security with regards t certificatin and accreditatin

35. Dcument the results f risk identificatin 36. Enumerate and define the key characteristics f leadership and management 37. Enumerate and discuss the current issues in dial-up access and prtectin 38. Enumerate and explain the unique cnsideratins and relatinships that exist amng the types f specialized cntingency planning IRP, DRP, and BCP 39. Evaluate risk cntrls and frmulate a cst-benefit analysis using existing cnceptual framewrks 40. Evaluate the internal and external factrs that influence the activities and rganizatin f an infrmatin security prgram 41. Explain cryptgraphy and the encryptin prcess, and cmpare and cntrast symmetric and asymmetric encryptin 42. Explain hw t maintain and perpetuate risk cntrls 43. Explain the rganizatinal appraches t infrmatin security 44. Explain the principal cmpnents f infrmatin security system implementatin planning in the rganizatinal planning scheme 45. Explain the rle f infrmatin security in emplyee terminatins 46. Explain the unified cntingency plan apprach 47. Explain why access cntrl is an essential element f infrmatin security management 48. Identify and describe the types f intrusin detectin systems and the tw strategies n which they are based 49. Identify and implement basic prject management practices and techniques 50. Identify current infrmatin n laws, regulatins, and relevant prfessinal rganizatins 51. Identify Department f Defense Directive 8500.1 plicies pr apprpriate civil agency guidance 52. Identify Infrmatin Technlgy Security Evaluatin Criteria (ITSEC) plices 53. Identify majr natinal and internatinal laws that relate t the practice f infrmatin security 54. Identify suitable strategies fr the implementatin f a security metrics prgram 55. Identify systems security standards plicies 56. Identify the rles in rganizatins that are active in the planning prcess 57. Identify the skills and requirements fr infrmatin security psitins 58. Identify the varius types f firewalls and the cmmn appraches t firewall implementatin 59. Implement the fundamental elements f key infrmatin security management practices 60. List and describe the functinal cmpnents f an infrmatin security prgram 61. List and describe the typical jb titles and functins perfrmed in the infrmatin security prgram 62. List the elements f key infrmatin security management practices 63. List the varius infrmatin security prfessinal certificatins, and identify which skills are encmpassed by each 64. Prepare and execute a test f cntingency plans 65. Recgnize and select frm the risk mitigatin strategy ptins used t cntrl risk 66. Recgnize the need fr cntingency planning 67. Select an infrmatin security management mdel and custmize it t meet the needs f a particular rganizatin as it relates t a system security architecture study 68. Understand that a successful infrmatin security prgram is the respnsibility f bth an rganizatin s general management and IT management which includes infrmatin peratins and recrds retentin 69. Use risk management techniques t identify and priritize risk factrs fr infrmatin assets 70. Using examples, demnstrate hw t perfrm marking f sensitive infrmatin prcedures and discuss plicies relating t marking f classified, unclassified and sensitive infrmatin