USF Sarasota-Manatee - New Undergraduate Course Proposal Form

Transcription

1 USF Sarasota-Manatee - New Undergraduate Course Proposal Form 1. College/School Contact Information Tracking Number Date & Time Submitted :23:53 Discipline College/School Budget Account Number Information Technology Arts & Sciences Contact Person Phone S. Lodwig slodwig@sar.usf.edu 2. Course Information Prefix Number Full Title CIS 4368 Database Security and Audits Is the course title variable? N Is a permit required for registration? N Are the credit hours variable? N Credit Hours Section Type Grading Option 3 Class Lecture (Primarily) Regular Total Clock Hours Abbreviated Title (30 characters maximum) 45 DB Security & Audtis 5. Prerequisites Database course 6. Corequisites none 7. Co-Prerequisites none 8. Course Description An indepth look at database secruity concepts and auditing techniques. Hands-on aproach when examining security techniques. Examins different security stratgies and and advancements in implementation as well as problem solving. 9. Justification (This section is critical since the APC members will make their decision based on the information provided here. The information should be in the following outline form.) A. Indicate how this course will strengthen the Undergraduate Program. Is this course necessary for accreditation or certification?

2 Good information assurance programs advocate defense-in-depth, meaning that assets are protected by layers of defense in much the same way castles once protected the lives of its inhabitants (e.g. high, solid, walls; cannons and archers; a moat and drawbridge; a clearing around the structure; et cetera. All of which was ideally located on high ground). This course is designed to prepare students to face the challenges associated with the protection of data, arguably the most valuable asset possessed by an organization, at an introductory to intermediate level. As this topic is not covered at this level elsewhere in the curriculum it creates the opportunity for students wishing to pursue the topic and gain an advantage when entering the workforce or moving into a new vertical area of the operations of an Information Technology division. B. What specific area of knowledge is covered by this course which is not covered by courses currently listed? The first few lectures walk participants though the foundational aspects of a solid defense-in-depth strategy for data security including: security architecture, operating system fundamentals, user administration, and security models. Then it examines specific tools used for the implementation of the fundamentals such as virtual private databases and auditing constructs. Finally the course challenges the students to demonstrate mastery of the subject by walking though an end to end security audit on a database installation, following a real world penetration test methodology. While some aspects of these topics are reinforced or covered from different aspects in other courses, none provide the perspective provided by this class with its hands-on examination of auditing and relational database management system security mechanism. C. What is the need or demand for this course? (Indicate if this course is part of a required sequence in the major.) What other programs would this course service? This course is a key course in the Information Security suite of courses. Students going for a specialization in Databases or Information Security would want to take this course. ISDS students will also benefit greatly from this course. D. Has this course been offered as Selected Topics/Experimental Topics course? If yes, what was the enrollment? This course has been offered twice so far. The enrollment in Spring, 2008, was 9 and in Spring, 2010, is 8. We did not have time enough to adequately publicize this course this Spring. We expect much higher enrollment when it is offered next Spring. E. How frequently will the course be offered? What is the anticipated enrollment? Once a year. We expect the enrollment to increase given the IT Program is among the fastest growing ones at this campus.

3 F. Do you plan to drop a course if this course is added? If so, what will be the effect on the program and on the students? (If dropping/deleting a course please complete the nonsubstantive course change form.) We do not plan to drop any courses. G. What qualifications for training and/or experience are necessary to teach this course? (List minimum qualifications for the instructor.) Minimum requirements for this class include: A degree in both computer science and information assurance with one being an advanced degree, professional certifications such as a CISSP or vendor recognized DBA credentials, and at least 10 years of experience working with software applications and databases. Helpful additions for instructors would be familiarity with the legal issues facing database security professionals such as GLBA, HIPAA, SOX, etc and formal certification and accreditation programs such as those formulated by NIST and the DoD (DIACAP). 10. Other Course Information A. Objectives / Outcomes The main objectives is to give the students a foundation for information system security from a concrete and conceptual perspective but the last quarter of the classes are intestinally flexible to allow the instructor to address areas of interest or concern voiced by the students so that they can request areas germane to their specific interests and pursuits. Students will walk away with at least 6 specific software tools that they can use in their professional endeavors and an exposure to what it takes to provision information system assets and monitor resource utilization. B. Major Topics Security Architecture Operating System Security Fundamentals Administration of Users Profiles, Password Policies, Privileges, and Roles Database Applications Security Models Virtual Private Databases Database Auditing Models Application and Data Auditing Auditing Database Activities Security and Auditing Cases Project Security C. Examples of Course Textbooks and Course Readings Required: Database Security and Auditing: Protecting Data Integrity and Accessibility (Paperback) by Hassan A. Afyouni Published by Course Technology; 1 edition (April 6, 2005) ISBN-10: ISBN-13: Recommended: Implementing Database Security and Auditing: Includes Examples for Oracle, SQL Server, DB2 UDB, Sybase (Paperback) by

4 11. Syllabus Ron Ben Natan Published by Digital Press (April 18, 2005) ISBN-10: ISBN-13: Or The Database Hacker's Handbook: Defending Database Servers (Paperback) by David Litchfield, Chris Anley, John Heasman, Bill Grindlay Published by Wiley (July 14, 2005) ISBN-10: ISBN-13: Please submit an electronic copy of your syllabus to Rhonda Moraca,

5 Undergraduate Studies Program in Information Technology CIS 4932 Special Topics: Database Security & Audits Spring Credit Hours University of South Florida Sarasota/Manatee 8350 North Tamiami Trail, Sarasota, FL Telephone: Fax:

6 Course Information Course Title Database Security & Audits Course Number CIS 4932 Course Sessions Instructor Tuesdays 6:00 8:50 pm Instructor phone Course Description In this course, we will take an in depth look at database security concepts and auditing techniques. We will examine theoretical concepts that make the world of security unique. Also, this course will adopt a practical hands-on approach when examining security techniques. Along with examining different security strategies, this course will explore the advancement of security implementation, as well as, timeless problem solving strategies. This course is broken into three sections: Security, Auditing and Implementation. Students will fully understand how to implement database security on modern business databases using practical scenarios and step-by-step examples that are presented throughout the text. Hands-on projects and case projects are used to reinforce and showcase the topics learned. The final chapter of the book allows the students to apply their knowledge in a presentation of four real-world cases using security and auditing. Specific topic coverage includes: Security Architecture Operating System Security Fundamentals Administration of Users Profiles, Password Policies, Privileges, and Roles Database Applications Security Models Virtual Private Databases Database Auditing Models 2

7 Application and Data Auditing Auditing Database Activities Security and Auditing Cases Project Security Course Goals Upon completion of this course, students will be familiar with numerous threats used to attack database systems. Additionally, the student will acquire a general knowledge of methods and techniques used to detect security vulnerabilities and protect against threats to database security. The student will also understand the basic tradeoff between costs of protective methods and the values of assets, and understand how this tradeoff affects many aspects of security design. Course Learning Objectives This course provides an introduction to various database security topics. These areas will obviously not be covered in complete depth, but will be addressed sufficiently to provide you with a good understanding of what happens "under the hood" of database systems, in areas normally "out of sight" of computer users. All security disciplines are inherently practical. There is no "best" organization or architecture for system defense. Instead, the process of planning and designing secure database systems is a series of "trade-off" decisions, usually between effectiveness and cost. This will be illustrated in this course when appropriate. Course Content and Methods of Instruction Week Topics/Activities Assignments Ch. 1 Security Architecture Exercises Chapter Operating Systems Security Exercises Chapter 2 2 Fundamentals 3 Administration of Users Exercises Chapter SQL Injection Demo, Profiles, Exercises Chapter 4 4 Password Policies, Privileges, and Roles 5 Database Application Security Models Exercises Chapter 5 5 3

8 6 Virtual Private Databases Exercises Chapter Database Auditing Models Exercises Chapter Mid-term exam Spring Break 10 Application Data Auditing Exercises Chapter Auditing Database Activities Exercises Chapter Security and Auditing Project Cases Exercises Chapter Oracle Advanced Replication Demo 14 Additional topics of interest/hands-on projects/catch up on lectures 15 Additional topics of interest/hands-on projects/ catch up on lectures 16 Final Exam 1-10 Texts and Materials Class notes will be distributed as they are generated. They will be posted electronically in the form of Microsoft PowerPoint files. Required Texts: Required for CIS 4932 Special Topics: Database Security and Audits Database Security and Auditing: Protecting Data Integrity and Accessibility (Paperback) by Hassan A. Afyouni Published by Course Technology; 1 edition (April 6, 2005) ISBN-10: ISBN-13: Recommended: Recommended for CIS 4932 Special Topics: Database Security and Audits Implementing Database Security and Auditing: Includes Examples for Oracle, SQL Server, DB2 UDB, Sybase (Paperback) by Ron Ben Natan Published by Digital Press (April 18, 2005) ISBN-10: ISBN-13: Or 4

9 The Database Hacker's Handbook: Defending Database Servers (Paperback) by David Litchfield, Chris Anley, John Heasman, Bill Grindlay Published by Wiley (July 14, 2005) ISBN-10: ISBN-13: Grading and Evaluation Student performance will be evaluated based on participation, exercises and assignments. Grades are assigned using the official University of South Florida grading system, including plus & minus grades. The Chapter Exercises will count as 30% of the course The Mid-Term Exam counts as 30% of the course The Final Exam counts as 40% of the course Assignment Evaluation Criteria: All assignments will be graded on the following basis: 1. Does it meet the stated criteria of the assignment? (C grade) 2. Does it exceed these criteria in any meaningful way (Above C grade) a. Expands on the stated problem b. Draws interesting conclusions from the exercise c. Add bells and whistles to the expected result A : 93% or more A-: 90 BLT 93% B+: 87 BLT 90% B : 83 BLT 87% B-: 80 BLT 83% C+: 77 BLT 80% C: 73 BLT 77% C-: 70 BLT 73 etc. Important notes about missed exams and assignments and incomplete grades: In this course, incomplete grades are reserved for those with good reason for having missed work. Otherwise, exams not taken or assignments not turned in will receive a 5

10 zero for that grade. An Incomplete automatically changes into an "F" if the missing work is not made up within two semesters.] The policy for Incompletes in this course is as follows: If you desire an Incomplete in the course (with adequate justification), please contact your instructor before the end of the course to discuss it. Missing assignments, lack of participation in the discussion questions, and failure to take exams shall result in a grade of zero for the missing item(s), unless the student has requested an Incomplete for the course. Class Attendance Policies This class features Flex Attend sm access, with each class session being recorded and available online for asynchronous attendance, review, or makeup of missed classes, therefore, NO excuses are ever needed for attendance issues. It is the student s responsibility to attend all class sessions by utilizing whichever Flex Attend sm modes the student finds convenient. Educational research has found a strong positive correlation between class attendance and academic success. The student is advised to attend all class sessions via any convenient Flex Attend sm mode and not to fall behind in either attendance, nor in assignments and participation. EMERGENCIES: In the event of an emergency, it may be necessary for USF to suspend normal operations. During this time, USF may opt to continue delivery of instruction through methods that include but are not limited to Blackboard, Elluminate, Skype, and messaging and/or an alternate schedule. It's the responsibility of the student to monitor Blackboard site for each class for course specific communication, and the main USF, College, and department websites, s, and MoBull messages for important general information Religious Observances Students who anticipate the necessity of being absent from class due to the observation of a major religious observance are not required to provide notice of their absences, as all class sessions can be made-up via the Flex Attend sm recorded mode. 6

11 Students with Special Needs Students with disabilities are responsible for registering with the Office of Student Disabilities Services in order to receive special accommodations and services. Please notify the instructor during the first week of classes if a reasonable accommodation for a disability is needed for the course. A memorandum of accommodations from the USF Disability Services Office must accompany or follow this request during the first two weeks of the course. Verbal requests for accommodations are not authorized by the Academic Support and Accommodations for Students with Disabilities policy. A written memorandum of accommodation is required. On the USF Sarasota Campus contact Ms. Pat Lakey, Disability Services Liaison, Academic Dishonesty and Plagiarism In accordance with university guidelines as found in the USF Student Handbook, anyone found cheating during exams, submitting work that is not their own, plagiarizing or falsifying work that is submitted to represent work they have done shall receive an F grade with numerical value of zero on the item submitted, and the F shall be used to determine the final course grade. It is the option of the instructor to assign the student a grade of F or FF (the latter indicating dishonesty) in the course. The instructor may use the Safe Assignment software within the BlackBoard system to access potential plagiarism and the obligation to reference all materials taken from electronic and other sources. 7