1. A First Course in Information Security
Nancy Smithfield
Computer Science and IT Department
Austin Peay State University

2. Presentation Outline Introduction Define Information Security
Principles of Information Security Course
Prerequisites
Objectives
Sample Topics
Sample Assignments
Lab Activities
Group Project
Resources
Future Directions
I plan to share lessons learned and my continuing education into this exciting and somewhat fearful world of information security
Where do you go to find information on security topics
No lack of information (Web, textbooks)
Web – NIST, ACM, SANS, searchsecurity.com

3. Introduction Securing Data on Networks and Computer Systems
Malware Attacks
Operating System Vulnerabilities
Application Software Vulnerabilities
Identity Theft
Data Theft
Botnet Hijackings
Cyberterrorism
Networks, computer systems, and the data stored, transmitted and processed on those systems is under seige
Malware such as viruses, worms, adware, spyware, spam, and trojans
Operating system and application software vulnerabilities that must be patched
Identity theft though phishing scams and social engineering (process of convincing an authorized individual to provide confidential information
Data theft due to trojans, stolen laptops,
Computers can be hacked and controlled to be the source of DDos or phishing scams
cyberterrorism is any "politically motivated attack against computer systems, computer programs, and data which results in violence against non-combatant targets by sub-national groups or clandestine agents

4. Introduction Information Security Problems Privacy legislation
Industry
Government
Academe
Other Organizations
Online User
Privacy legislation
Organizations Have Legal Responsibilities
Protect Information
Disclose Privacy Policies
Report Breaches
security problems occur in business, government, organizations, and the online user
Implementing security is more than use of technology, it is also the use of policies, procedures, standards
to detail what users and administrator need to be doing to secure systems and data
Laws have been passed HipAA (regulates collection, storage and distribution of healthcare information)
Expensive penalities for non-compliance. If your university provides health services or keeps health care info it must comply with the law
Sarbanes-Oxley (financial disclosure by public organizations)
Gramm-Leach Bliley – banks protect customer privacy

5. Introduction Computer Science and IT Department at APSU
Higher Education Addresses Security Education
Master’s programs in information security areas
Undergraduate concentrations
Specific security courses
Security topics within existing courses
Computer Science and IT Department at APSU
Two Courses in Security
Principles of Information Security
Focus of this paper
Network Security
Has prerequisite Data Communications and Networking
Incorporate Security Topics in Existing Courses
Higher education adhas responded with master’s programs in information security areas as well as undergraduate concentrations and/or specific security courses.
The Computer Science and IT Department at APSU has recently added two courses in security
Beginning course on the Principles of Information Security which is the focus of this paper
Course on Network Security that has as its prerequisite the Data Communications and Networking Class

6. Definition of Information Security
Information Security is the protection of information assets as well as the hardware and systems that store, transmit and process the information from unauthorized acquisition, modification, damage, disclosure, or loss of use.

7. Course Prerequisites Computer literacy course, or
Programming course such as CS1
Includes introductory topics
computer hardware OS
networks
Permission of instructor
Note: Students of all majors can take this class
need introductory topics hardware, OS, networks
At APSU the class is numbered CSCI 3200 and is required of Information Systems, Internet and Web, and Database Concentration students
Prerequisites - Computer literacy course, programming course such as CS1 where computer hardware is introduced or permission of instructor
Programming course such as CS1 where computer hardware, OS and networks are introduced or the permission of instructor

8. Course Objectives Understand information security issues and practices
Understand techniques to identify and prioritize information assets
Be aware of vulnerabilities and strategies for securing networked computer systems in a global environment
Identify tools and technology for combating threats to information assets
Describe legal implications of security and privacy issues
Understand risk management
Understand the development of an information security policy and architecture
Prerequisites - Computer literacy course, programming course such as CS1 where computer hardware is introduced or permission of instructor

9. Course Sample Topics History of Information Security
Information characteristics that must be protected
Security terminology
Threat and attack analysis
Legal issues
Risk management
Security Planning
Defense through management, operational and technology controls
Specific security technology such as malware detectors, firewalls, IDS, and spam filters
Cryptography and hash functions
Personal, Physical, Desktop, Network, Internet and Enterprise Security

10. Course Assessments
Exams
Assignments
Lab Activities
Group Project

11. Assignments
~ 70% of the assignments based on understanding content of two text books
Submitting written answers to questions
Taking online practice quizzes
In-class student led discussions on topics
~ 30 % of assignments based on
Security news topics
Security awareness
Investigation of NIST security documents
Approximately 70% of the assignments were based on understanding the content of the two text books.
Submitting written answers to questions
Taking online practice quizzes
In-class student led discussions on topics
Other 30 % of assignments based on security news topics, security awareness, and investigation of NIST security documents Taking online practice quizzes – can be done in Blackborad or WebCT (Web enhanced class) – take quiz as often as they like
In-class student led discussions on topics. I would pick a student to lead class discussion on a security topic that all students should have been prepared to discuss. Helps students understand terminology better, Good practice of communication skills

12. Sample Security News Topic Assignment
In 2006 a laptop with sensitive VA information was reported stolen. Over 20 million veterans were affected.
Every year over 700,000 laptops are stolen in the U.S.
Assignment - Investigate Laptop Security
Write about securing the actual laptop and the data it contains with existing hardware and software tools
What are the advantages and disadvantages of encrypting data on laptops?
What security tools and services are available to find missing laptops such as cyberangel? Describe how they work.
In 2006 a laptop with sensitive VA information was reported stolen. Over 20 million veterans were affected. Every year over 700,000 laptops are stolen in the U.S.
Assignment - Investigate Laptop Security
Write about securing the actual laptop and the data it contains with existing hardware and software tools
What are the advantages and disadvantages of encrypting data on laptops?
What security tools and services are available to find missing laptops such as cyberangel? Describe how they work.

13. Sample Security Awareness Assignment
October - cyber security awareness month
Each student was given a security protection hot-topic to investigate. Two to three students were given the same topic but it was not a group project.
Assignment - Create an illustrated one page poster on the topic.
Sample topics (strong passwords, protection against phishing, social engineering, protection against viruses, protecting software copyright)
Posters were used to create a cyber awareness display

14. Sample Lab Activities
Sample active learning during 3 to 4 labs at class times
Running a Password cracker (dictionary and brute force attacks)
Windows security settings including firewall and browser settings
Running antispyware software (Windows Defender, SpySweeper, Ad-Aware)
Running a web site detector Spoofstick
Managing Windows updates, disabling Windows services, managing windows accounts

15. Group Project Students divided into 3 person groups
Each group - different research topic
Write an 8-10 page paper
Prepare and give group presentation
Sample topics (viruses, spyware, phishing, security settings in browsers, intrusion detection and prevention systems)

16. Example Project: Security Settings in Browsers
Research security features available in three popular browsers, one of which must be IE .
Explain each of the security settings/configurations and list pros and cons for each setting.
Include possible settings for cookies, Java and ActiveX controls.
List security features of IE7.
Prepare a chart comparing and contrasting the browsers.

17. Course Resources Textbooks
Principles of Information Security Second Edition by Whitman and Mattford ISBN :
Security Awareness: Applying Practical Security in Your World by Ciampa ISBN:

18. Course Resources
Computer Security Resource Center of National Institute for Standards and Technology (
Glossary of terms
Free Special Publications such as:
SP An Introduction to Computer Security
SP Best Practices and Security Principles
SP Self Assessment Guide for IT Systems
SP Risk Management
SP Information Security Handbook for Managers

19. Course Resources
United States Computer Emergency Readiness Team
Internet Storm Center Presentations
Educause Web Site on CyberSecurity Awareness Month with links to projects at many higher education sites

20. Course Resources
Videos on cyber awareness
National Strategy to secure cyberspace
Kennesaw State’s Center for Information Security Education and Awareness
Current Security Topics

21. Lessons Learned - Future Directions
Overwhelming amount of material for course resources
Security news - source of discussion topics
Current course needs more active learning
Labs
Security analysis of small businesses or non-profit
As part of course goals, promote security awareness across the University
Questions?