COURSE OUTLINE. Course code: SCSR 4473 Academic Session/Semester: /2. Course name: Security Management Pre/co requisite (course name

Transcription

1 COURSE OUTLINE Department/ Computer Science/Computing Page: 1 of 5 Course synopsis The subject is aimed at imparting knowledge and skill sets required to assume the overall responsibilities of administration and management of security of an enterprise information system. This subject covers issues related to administration and management of security of enterprise information systems. Topics include auditing and data management, risk management, contingency planning, incident handling and responses. The subject will study in detail principles and tools related to these topics. The subject will also cover security standards, evaluation and certification process; security planning, ethical and legal issues in information and privacy. Course coordinator (if applicable) Course lecturer(s) Name Office Tel (0755) (@utm.my) Siti Hajar Othman N hajar Mapping of the Course Outcomes (CLO) to the Programme Outcomes (PLO), Teaching & (T&L) methods and Assessment methods: Weight T&L ***Assessment (%) methods methods No. CLO1 CLO2 CLO3 CLO4 CLO Prepared by: Describe and identify security policy framework, legal and moral implication and best practices in security management Demonstrate foundation knowledge and application of security and management concepts Conduct risk analysis and assessment of enterprise systems Design detailed enterprise wide security plans and policies, and deploy appropriate safeguards (models, mechanisms and tools) PLO (ICGPA CODE) PLO1 (KW) PLO2 (AP) PLO3 (PS) PLO4 (CS) Certified by: *Taxonomies and **generic skills 45 C3 30 C3 15 P3, TH5 10 CS4 Active A, Q, P, M, F A, Q, F GP, M Refer *Taxonomies of and **UTM s Graduate Attributes, where applicable for measurement of outcomes achievement ***T Test; Q Quiz; HW Homework; L Lab, LT Lab Test, GR Group Project; PR Personal Report; M Midterm Exam; F Final Exam; P Presentation etc. P, GP Name: Dr. Siti Hajar Othman Name: PM. Dr. Norafida Ithnin (Head of Department) Signature: Details on Innovative T&L practices: Signature: No. Date: Type 11 Februari 2018 Implementation Date: 1. Active Conducted through inclass activities 2. Projectbased Conducted through case study assignment. Tasks are given in sequential steps throughout the semester. Students in a group of 3 are given a case study that require computer network knowledge involving the design of a simple local area network and calculations of IPv4 subnetting. The report must comply to the case

2 Computer Science/Computing Page: 2 of 5 Details on Innovative T&L practices: No. Type Implementation 1. Active Conducted through inclass activities Community program Students are encouraged to be the mechanism of awareness and change to the community. It is hoped that this will be a catalyst for them to take on a role as a guardian of sorts to the community. Weekly Schedule: W 1 Module 1: Introduction to Security Management What is Security Management? Principles of Information Security Management W 2 Project Management Applying Project Management to Security Project Management Tools Module 2: Security Management Model Blueprints, Framework and Security Models Access Control Models W 3 Security Architecture Models Security Management Models ISO Series, NIST Security Models, SP 80053A, COBIT, COSO, IT Infrastructure Library, Information Security Governance Framework Module 3: Security Management Practices Security Management Practices in Malaysia Cyber Security Malaysia (National Cyber Security Agency) Cyber999, CyberSAFE, MyCERT, W 4 CyberGURU, MyCSC MAMPU (ISMS, Malaysia Public Sector ICT Strategic Plan) MyRAM (Public Sector Risk Management) Malaysia s National Cyber Security Policies Government Computer Emergency Response Team (GCERT) Module 4: Security Planning The Role of Planning W 5 Precursors to Planning Strategic Planning Information Security Governance Planning for Information Security Implementation W 6 MIDSEMESTER BREAK W 7 Module 5: Planning for Contingencies Fundamentals of Contingency Planning Components of Contingency Planning Business Resumption Planning Testing Contingency Plans Contingency Planning: Final Thought

3 Computer Science/Computing Page: 3 of 5 W 8 W 9 W 10 W 11 W 12 W 13 W 14 W 15 Module 6: Security Policy Policy Enterprise Information Security Policy IssueSpecific Security Policy SystemSpecific Security Policy Guidelines for Effective Policy Module 7: Developing the Security Program Organizing for Security Placing Information Security within an Organization Components of the Security Program Information Security Roles and Titles Implementing Security Education, Training and Awareness Program Module 8: Risk Management: Identifying and Assessing Risk Risk Management Risk Identification Risk Assessment Documenting the Results of Risk Assessment Module 9: Risk Management: Controlling Risk Risk Control Strategies Managing Risk Feasibility and CostBenefit Analysis Recommended Risk Control Practices Qualitative & Hybrid Measure, Delphi Technique, Single Source Approach, OCTAVE Method, Microsoft Risk Management Approach, FAIR, ISO Standard for InfoSec Risk Management Group Project Presentation Class Discussion / Exercise Transferable skills (generic skills learned in course of study which can be useful and utilised in other settings): Presenting ideas and knowledge in different methods Student time (SLT) details: Distribution of student Time (SLT) Course content outline Guided (Face to Face) Teaching and Activities Guided NonFace to Face Independent NonFace to face CLO L T P O CLO CLO TOTAL SLT

4 Computer Science/Computing Page: 4 of 5 CLO CLO Total SLT Continuous Assessment PLO Percentage Total SLT 1 Assignment 1 KW Assignment 2 KW, AP Quiz 1 KW Quiz 2 KW Presentation (1) KW Group Project (1) PS, CS Mid Term Exam KW, AP, PS 25 2 Final Assessment Percentage Total SLT 1 Final Examination KW, AP 30 3 Grand Total SLT 120h Special requirement to deliver the course (e.g: software, nursery, computer lab, simulation room): resources: References 1. M. E. Whitman, H. J. Mattord, Management of Information Security 3rd Edition (Main) 2. Whitman, Micheal E. & Mattord, Herbet J. Principles of Information Security 1st edition. Thompson Course Technology, Boston, MA, (2003). (ISBN ) 3. MyRAM website ( 4. CyberSecurity website ( 5. M. Erbschilde, Guide to Disaster Recovery 6. G. Holden, Guide to Network Defence and Countermeasures 7. Charles P. Pfleeger, Security in Computing 2nd Edition, Prentice Hall 8. Ross Anderson, Security Engineering: A Guide to Building Dependable Distributed Systems, Wiley, John & Sons, Incorporated, (2001) Online Academic honesty and plagiarism: Copying of work (texts, lab results etc.) from other students/groups or from other sources is not allowed. Brief quotations are allowed and then only if indicated as such. Existing texts should be reformulated with your own words used to explain what you have read. It is not acceptable to retype existing texts and just acknowledge the source as a reference. Be warned: students who submit copied work will obtain a mark of zero for the assignment and exams and disciplinary steps may be taken by the Faculty. It is also unacceptable to do somebody else s work, to lend your work to them or to make your work available to them to copy.

5 Computer Science/Computing Page: 5 of 5 Other additional information (Course policy, any specific instruction etc.): 1. Attendance is compulsory and will be taken in every lecture session. Student with less than 80% of total attendance is not allowed to sit for final exam. 2. Students are required to behave and follow the University s dressing regulation and etiquette while in the class, lab, and exam hall. 3. Exercises and tutorial will be given in class and some may be taken for assessment. Students who do not do the exercise will lose the coursework marks for the exercise. 4. Assignments must be submitted on the due dates. Some points will be deducted for late submissions. Assignments submitted three days after the due date will not be accepted. 5. Make up exam will not be given, except to students who are sick and submit medical certificate which is confirmed by UTM panel doctors. Make up exam can only be given within one week of the initial date of exam. Disclaimer: No one is allowed to use texts or excerpts from lectures or other teaching and activities at Universiti Teknologi Malaysia except for the purpose of his/her studies. In particular, making copies of the texts or excerpts in any form at all for the purpose of publication or distribution is strictly forbidden. While every effort has been made to ensure the accuracy of the information supplied herein, Universiti Teknologi Malaysia cannot be held responsible for any errors or omissions.