Examination of the Current Educational Contents in Information Assurance Bill Oblitey Indiana University of Pennsylvania Computer Science Department EPASEC 2006
OverviewOverview –The Issues in IA Education –How they are being Addresses –Can we do any Better –Should IA Have its Own Discipline? –A Look at the IA Graduate
EPASEC 2006 Issues in IA Host Computer Security Network Security CybercrimeEncryption Hacking and its Effects Operating Systems Security Dealing with Malicious Code Operational Vulnerabilities SpammingPhishing Security Tools Web Security Wireless Security
EPASEC 2006 Addressing the Issues Two approaches: –Design new courses to address IA issues Several new courses get into the program Results in new concentrations or new disciplines –Embed IA issues in existing courses May strengthen some existing courses Not all issues get addressed –Some ideas are new and cannot just be embedded in core Computer Science courses
EPASEC 2006 Topics for Stand-Alone Courses Personal & Host Computer Security Network Security Cryptography Digital/Computer Forensics Information Assurance Management Physical Security Disaster Recovery
EPASEC 2006 Topics for Embedding in Courses Wireless Security Operating Systems Security Buffer Overflow Security Tools Web Security Data Base Security Cyber Terrorism Secure Storage Systems
EPASEC 2006 The Multi-disciplinary Nature IUP’s program links the disciplines of: –Computer Science –Criminology –Management Information Systems –Technology Support Systems –Political Science Most other programs are pure Computer Science Some link Computer Science and Law or other Legal Programs
EPASEC 2006 Separate Discipline? Should IA be a separate discipline from Computer Science History of the growth of Computer Science –Mathematics spawned Computer Science –Computer Science spawned Library Science & MIS –Data Communication and Networking have been spawned into Telecommunications –AI and Expert Systems held in check –Should IA also be held in check?
EPASEC 2006 Examining the IA Graduate Her/His Background –A programmer with IA intensive knowledge? Has had the core of the Computer Science program Can develop IA tools –An IA technician who is computer literate? Knows about IA tools and can use them
EPASEC 2006 Sample Security Course Unix as Firewall –Introduction to network security and firewalls –Installing and securing Linux –The TCP/IP Suite –Packet filtering and NAT –Secure Shell and Secure Copy –Socks service –Proxy service –Securing DNS –Securing –Virtual Private Networking –Hackers' tools –Detecting and countering firewall intrusions –Good practices Source:www-304.ibm.com
EPASEC 2006 Expected Skills from Course Set up, configure and administer a Linux- based firewall Identify and counter security threats Understand packet filtering and Network Address Translation (NAT) Set up socks Use a proxy server Secure Domain Name System (DNS) Respond to a security breach
EPASEC 2006 Coping with the Course Definitely a background knowledge of Linux is required What about Computer Science background? Can a student without Computer Science background be able to cope?
EPASEC 2006 Where Are We Headed? Should we be aiming at Undergraduate issues only? Do we concentrate on Graduate issues? Should we insist on strong Computer Science background before acceptance into graduate studies in IA?