COURSE OUTLINE. Last Amendment Edition Procedure No. Lecturer /blog Room No. Phone No. / Name.

Transcription

1 FACULTY OF COMPUTING Page 1 of 6 COURSE 0 PRE-REQUISITE none EQUIVALENCE CONTACT HOURS 4 Lecturer /blog Room No. Phone No. 1. Dr. Siti Hajar Othman hajar@utm.my / , N PREPARED BY CERTIFIED BY Name Dr. Siti Hajar Othman Name Prof. Dr. Habibollah Haron Signature Signature Date February 016 Date February 016 SYNOPSIS The subject is aimed at imparting knowledge and skill sets required to assume the overall responsibilities of administration and management of security of an enterprise information system. This subject covers issues related to administration and management of security of enterprise information systems. Topics include auditing and data management, risk management, contingency planning, incident handling and responses. The subject will study in detail principles and tools related to these topics. The subject will also cover security standards, evaluation and certification process; security planning, ethical and legal issues in information and privacy.

2 FACULTY OF COMPUTING Page of 6 COURSE COURSE LEARNING OUTCOMES 0 By the end of the course, students should be able to No. Course Learning Outcomes 1. Describe and identify security policy framework, legal and moral implication and best practices in security management. Demonstrate foundation knowledge and application of security and management concepts 3. Conduct risk analysis and assessment of enterprise systems Programme Learning Outcome(s) Addressed Taxonomies and Soft-Skills PO1 C3, P3, A A, MT Assessment Methods PO3 C1, C, P1, P, A1 A, Q, MT PO4 C4, A3 P, GP, F 4. Design detailed enterprise wide security plans and policies, and deploy appropriate safeguards (models, mechanisms and tools) PO6 C4, P6, A4 GP, F Note Q Quiz; Hw Homework; A Assignment; HBS Harvard Business School; L Lab; SB Skillbased; PR Project; GP Group Project; Pr Presentation; Peer Peer Assessment; MT Midterm Test; F Final Exam(theory) STUDENT LEARNING TIME No Teaching and Learning Activities Direct Learning - Lecture - Student Centered Learning Tutorial Group Discussion Independent Study - Indirect Learning Assignment Group Discussion Class group project - - Preparation for Exam, Test and Quiz Formal Assessment - Mid Term Exam (1) - Final Exam (1) Student Learning Time (hours) (4) 36 4 (73) () 3 Total 10

3 FACULTY OF COMPUTING Page 3 of 6 COURSE 0 TEACHING METHODOLOGY 1. Discussion. Active Learning 3. Group Presentation 4. Group study to be in smaller groups to appreciate the theories given in lectures. Students shall discuss amongst themselves and solve given assignment in class WEEKLY SCHEDULE Week Topic / Content Assessment 1 & & 7 1. Introduction to Security Management What is Security? What is Management? What is Security Management? Principles of Information Security Management Project Management - Applying Project Management to Security - Project Management Tools. Planning for Security The Role of Planning Precursors to Planning Strategic Planning Information Security Governance Planning for Information Security Implementation 3. Planning for Contingencies Fundamentals of Contingency Planning Components of Contingency Planning Business Resumption Planning Testing Contingency Plans Contingency Planning Final Thought 4. Information Security Policy Policy Enterprise Information Security Policy Issue-Specific Security Policy System-Specific Security Policy Guidelines for Effective Policy. Developing the Security Program Organizing for Security Placing Information Security within an Organization Components of the Security Program Information Security Roles and Titles Implementing Security Education, Training and Awareness Program + Assignment 1 + Quiz 1 Lecture & Group Discussion + Group Project Start

4 FACULTY OF COMPUTING Page 4 of 6 COURSE 6. Security Management Model Blueprints, Framework and Security Models Access Control Models Security Architecture Models Security Management Models 8 - ISO Series, NIST Security Models, SP 800-3A, COBIT, COSO, IT Infrastructure Library, Information Security Governance Framework 0 Lecture & Class Discussion + Mid Term 9 10 & 11 1 & Security Management Practices Benchmarking Performance Measure in Information Security Management - InfoSec Performance Measure Management, Metrics, Building, Collecting, Implementing, Reporting Emerging Trends in Certification and Accreditation - SP , SP Risk Management Identifying and Assessing Risk Risk Management Risk Identification Risk Assessment Documenting the Results of Risk Assessment 9. Risk Management Controlling Risk Risk Control Strategies Managing Risk Feasibility and Cost-Benefit Analysis Recommended Risk Control Practices - Qualitative & Hybrid Measure, Delphi Technique, Single Source Approach, OCTAVE-Method, Microsoft Risk Management Approach, FAIR, ISO 700 Standard for InfoSec Risk Management 10. Protection Mechanism Access Controls Firewalls Intrusion Detection and Prevention Systems Remote Access Protection Wireless Networking Protection Scanning & Analysis Tools Cryptography + Assignment + Quiz Lecture & Group Discussion 1 Group Presentation 16 REVISION WEEK AND FINAL EXAMINATION Group Presentation + Final Exam

5 FACULTY OF COMPUTING Page of 6 COURSE 0 REFERENCES 1. M. E. Whitman, H. J. Mattord, Management of Information Security 3 rd (Main). Whitman, Micheal E. & Mattord, Herbet J. Principles of Information Security 1 st edition. Thompson Course Technology, Boston, MA, (003). (ISBN ) 3. M. Erbschilde, Guide to Disaster Recovery 4. G. Holden, Guide to Network Defence and Countermeasures. Charles P. Pfleeger, Security in Computing nd,, Prentice Hall 6. Ross Anderson, Security Engineering A Guide to Building Dependable Distributed Systems, Wiley, John & Sons, Incorporated, (001) GRADING No. Assessment Number % each % total Weeks Assignments - Assignment - Quiz Communication Skill - Presentation - Class Participation Group Project and Presentation whole sem (A1), 4(Q1), 9 (A) & 9 (A) 1 Week 6,1 whole semester 6 until 14 1 (present) 4. Mid-Term Exam 1 8. Final Exam Overall Total 100 COURSE LEARNING OUTCOME Course Learning Outcome Assignment - Assignment 1 - Assignment - Quiz 1 - Quiz CO3 CO1 CO CO4 CO3 PO1 PO3 PO4 PO6 Group Project 10 1 Midterm Exam Final Exam Communication Skills - Presentation 1 - Class Participation (%) (%) 0

6 FACULTY OF COMPUTING Page 6 of 6 COURSE ATTENDANCE 0 The student should adhere to the rules of attendance as stated in the University Academic Regulation Students must attend not less than 80% of lecture hours as required for the course. The student is prohibited from attending any lecture and assessment activities upon failure to comply the above requirement. Zero mark will be given for the course. DEFINITIONS OF PLAGIARISM, CHEATING AND ACADEMIC DISHONESTY 1. Student plagiarism is the deliberate presentation of the writing or thinking of another as the student s own. In written or oral work a student may make fair use of quotations, ideas, images, etc., that appear in others work only if the student gives appropriate credit to the original authors, thinkers, owners or creators of that work. This includes material found on the internet and in electronic databases.. Cheating entails the use of unauthorized or prohibited aid in accomplishing assigned academic tasks. Obtaining unauthorized help on examinations, using prohibited notes on closed-note examinations, and depending on others for writing of essays or the creation of other assigned work are all forms of cheating. 3. Academic dishonesty may also include other acts intended to misrepresent the authorship of academic work. Deliberate acts threatening the integrity of library materials or the smooth operation of laboratories are among possible acts of academic dishonesty. The ultimate goal in science education is no longer just amassing a body of knowledge, but it s also developing the skills to go about answering questions independently. It is not possible for any one individual to learn that whole body of knowledge. Perhaps equally important is to be able to generate ways of thinking about questions that we have and how we might go about exploring those questions on our own. Dr. Anita Greenwood, University of Massachusetts - Lowell