1. Examination of the Current Educational Contents in Information Assurance Bill Oblitey Indiana University of Pennsylvania Computer Science Department EPASEC 2006

2. OverviewOverview –The Issues in IA Education –How they are being Addresses –Can we do any Better –Should IA Have its Own Discipline? –A Look at the IA Graduate

3. EPASEC 2006 Issues in IA Host Computer Security Network Security CybercrimeEncryption Hacking and its Effects Operating Systems Security Dealing with Malicious Code Operational Vulnerabilities SpammingPhishing Security Tools Web Security Wireless Security

4. EPASEC 2006 Addressing the Issues Two approaches: –Design new courses to address IA issues Several new courses get into the program Results in new concentrations or new disciplines –Embed IA issues in existing courses May strengthen some existing courses Not all issues get addressed –Some ideas are new and cannot just be embedded in core Computer Science courses

5. EPASEC 2006 Topics for Stand-Alone Courses Personal & Host Computer Security Network Security Cryptography Digital/Computer Forensics Information Assurance Management Physical Security Disaster Recovery

6. EPASEC 2006 Topics for Embedding in Courses Wireless Security Operating Systems Security Buffer Overflow Security Tools Web Security Data Base Security Cyber Terrorism Secure Storage Systems

7. EPASEC 2006 The Multi-disciplinary Nature IUP’s program links the disciplines of: –Computer Science –Criminology –Management Information Systems –Technology Support Systems –Political Science Most other programs are pure Computer Science Some link Computer Science and Law or other Legal Programs

8. EPASEC 2006 Separate Discipline? Should IA be a separate discipline from Computer Science History of the growth of Computer Science –Mathematics spawned Computer Science –Computer Science spawned Library Science & MIS –Data Communication and Networking have been spawned into Telecommunications –AI and Expert Systems held in check –Should IA also be held in check?

9. EPASEC 2006 Examining the IA Graduate Her/His Background –A programmer with IA intensive knowledge? Has had the core of the Computer Science program Can develop IA tools –An IA technician who is computer literate? Knows about IA tools and can use them

10. EPASEC 2006 Sample Security Course Unix as Firewall –Introduction to network security and firewalls –Installing and securing Linux –The TCP/IP Suite –Packet filtering and NAT –Secure Shell and Secure Copy –Socks service –Proxy service –Securing DNS –Securing E-mail –Virtual Private Networking –Hackers' tools –Detecting and countering firewall intrusions –Good practices Source:www-304.ibm.com

11. EPASEC 2006 Expected Skills from Course Set up, configure and administer a Linux- based firewall Identify and counter security threats Understand packet filtering and Network Address Translation (NAT) Set up socks Use a proxy server Secure Domain Name System (DNS) Respond to a security breach

12. EPASEC 2006 Coping with the Course Definitely a background knowledge of Linux is required What about Computer Science background? Can a student without Computer Science background be able to cope?

13. EPASEC 2006 Where Are We Headed? Should we be aiming at Undergraduate issues only? Do we concentrate on Graduate issues? Should we insist on strong Computer Science background before acceptance into graduate studies in IA?