IS315T IS Risk Management and Intrusion Detection [Onsite]

Transcription

1 IS315T IS Risk Management and Intrusin Detectin [Onsite] Curse Descriptin: This curse addresses cncepts f risk management and intrusin detectin. Areas f instructin include hw t assess and manage risks t infrmatin security and identifying the activities invlved in the prcess f infrmatin security risk management fr an rganizatin. The rle f intrusin detectin in infrmatin security and different tls used t detect intrusin will als be discussed. Prerequisite(s) and/r Crequisite(s): Prerequisites: IS311T Internetwrking Infrastructure and Operatins r equivalent, IS312T Infrmatin Security Essentials r equivalent Credit hurs: 4 Cntact hurs: 60 (36 Thery Hurs, 24 Lab Hurs)

2 IS Risk Management and Intrusin Detectin SYLLABUS: IS Risk Management and Intrusin Detectin Instructr: Office hurs: Class hurs: MAJOR INSTRUCTIONAL AREAS 1. Need fr Infrmatin Security (IS) risk management 2. Risks in a prject 3. Perfrm risk analysis 4. Threat and vulnerability analysis 5. Varius security cntrls 6. Disaster recvery plan 7. Need fr an Intrusin Detectin r Preventin System (IDS/IPS) 8. Strengths and limitatins f IDS/IPS 9. Types f IDS/IPS 10. Identificatin f the apprpriate IDS/IPS fr an rganizatin 11. Deplyment f an IDS/IPS n the netwrk and n a hst cmputer ITT Educatinal Services, Inc. Date: 10/6/2006

3 IS Risk Management and Intrusin Detectin COURSE OBJECTIVES After successful cmpletin f this curse, the student will have the pprtunity t: 1. Explain the cncepts f risk, threat, and vulnerability as they apply t infrmatin systems. 2. Appraise the value f rganizatinal assets. 3. Examine the effect f threats and vulnerabilities n infrmatin systems. 4. Perfrm risk and impact analysis t determine the prbable cst f risk expsure. 5. Perfrm a risk assessment and examine cmmn risk management strategies. 6. Recmmend apprpriate IS security cntrls t secure an IS. 7. Analyze best practices t develp a practive disaster recvery plan fr an IS. 8. Describe varius aspects f Intrusin Detectin Systems (IDS) and Intrusin Preventin Systems (IPS). 9. Examine the peratin f cmmn hst-based IDS and IPS systems. 10. Apply system hardening techniques t prvide hst-based intrusin preventin. 11. Examine the need fr a layered security slutin. 12. Using the ITT Tech Virtual Library, research cmmn security practices as they apply t infrmatin system risk management, business cntinuity, and IDS/IPS. Related SCANS Objectives 1. Acquires security related data and evaluates it fr the purpse f implementing risk management and intrusin detectin fr an rganizatin. 2. Classifies risks in an rderly manner s that it can be prcessed further accrding t the specific requirements f the rganizatin. 3. Interprets risks and effectively cmmunicates the related infrmatin. ITT Educatinal Services, Inc. Date: 10/6/2006

4 IS Risk Management and Intrusin Detectin 4. Evaluates the risk infrmatin using cmputers. 5. Slves risk-related issues as a member f the team. 6. Evaluates a decisin regarding security risks f the rganizatin and ther related prblems thrugh negtiatin with thers. 7. Identifies the knwledge f security requirements f the rganizatin with the different tls used t detect intrusin. 8. Trubleshts the prblems related t the activities invlved in the prcess f infrmatin security risk management fr an rganizatin. TEACHING STRATEGIES The curriculum is designed t prmte a variety f teaching strategies that supprt the utcmes described in the curse bjectives and that fster higher cgnitive skills. Delivery makes use f varius media and delivery tls in the classrm. COURSE RESOURCES Student Textbk Package Pank, Raymnd R., Kim, Gregg, M. Bishp, and Tdd King, IS Risk Management and Intrusin Detectin, Indianaplis: Pearsn Learning Slutins, 2006 References and Resurces ITT Tech Virtual Library Lgin t the ITT Tech Virtual Library ( t access nline bks, jurnals, and ther reference resurces selected t supprt ITT Tech curricula. General References >Reference Resurces> Natinal Vulnerability Database ITT Educatinal Services, Inc. Date: 10/6/2006

5 IS Risk Management and Intrusin Detectin >Prgram Links> Infrmatin Systems Security (ISS)> Infrmatin Systems Security Assciatin (ISSA) >Prgram Links> Infrmatin Systems Security (ISS)> Cmputer Security Institute >Prgram Links> Infrmatin Systems Security (ISS)> Recmmended Links > CERT Crdinatin Center >Prgram Links> Infrmatin Systems Security (ISS)> Recmmended Links > Cmmn Vulnerabilities and Expsures >Prgram Links> Infrmatin Systems Security (ISS)> Recmmended Links > SANS Institute Reading Rm Bks The fllwing bks are related t this curse and are available thrugh the ITT Tech virtual Library: Bks > Bks 24x7 > CISSP: Certified Infrmatin Systems Security Prfessinal Study Guide, Secnd Editin > Chapter 2: Attacks and Mnitring Bks > Bks 24x7 > CISSP: Certified Infrmatin Systems Security Prfessinal Study Guide, Secnd Editin > Chapter 6: Asset Value, Plicies, and Rles > Risk Management Bks > Bks 24x7 > CISSP: Certified Infrmatin Systems Security Prfessinal Study Guide, Secnd Editin > Chapter 16: Disaster Recvery Planning Bks > Bks 24x7 > CIW Security Prfessinal Certificatin Bible > Chapter 15: Intrusin Detectin Systems Bks > Bks 24x7 > Intrusin Detectin & Preventin > Chapter 1: Understanding Intrusin Detectin Bks > Bks 24x7 > Intrusin Detectin & Preventin > Chapter 6: IDS and IPS Architecture Bks > Bks 24x7 > PMP Prject Management Prfessinal Study Guide > Chapter 11: Intrducing Prject Risk Management Bks > Bks 24x7 > Practive Risk Management ITT Educatinal Services, Inc. Date: 10/6/2006

6 IS Risk Management and Intrusin Detectin Bks > Bks 24x7 > Prtect Yur Infrmatin with Intrusin Detectin > Chapter 8: The Life Cycle, Deplyment, and Implementatin f an IDS Bks > Bks 24x7 > Risk and Decisin Analysis in Prjects, Secnd Editin > Chapter 1: Risk and Decisin Analysis Bks > Bks 24x7 > Security+ Study Guide, Secnd Editin (SYO-101) > Chapter 2: Identifying Ptential Risks Bks > Bks 24x7 > Sftware Testing Fundamentals: Methds and Metrics > Chapter 9: Risk Analysis> Benefits f Risk Analysis Bks > Bks 24x7 > The Fundamentals f Risk Measurement Peridicals Peridicals> INFORMATION SECURITY Magazine Peridicals> IT Architect Peridicals > IT Architect > The Threat Frm Within (August Issue) Peridicals > IT Architect > Anmaly Detectin On the Rise (June Issue) Other Resurces SecurityFcus Vulnerabilities List (Offers user the ability t search fr vulnerabilities by vendr, title, and versin.) SecurityFcus BugTraq (BugTraq is perhaps the mst cmprehensive list f vulnerabilities in existence. As sn as a vulnerability becmes public knwledge, it will be psted t BugTraq.) SecurityFcus Fcus n IDS - This is fcused discussin Web frum fr IDS. The majrity f psters are industry prfessinals exchanging tips, tricks, and advise. ITT Educatinal Services, Inc. Date: 10/6/2006

7 IS Risk Management and Intrusin Detectin CERT Vulnerabilities, Incidents, and Fixes (CERT is nw perated by the US department f Hmeland security, making it a primary resurce fr advisry infrmatin abut critical vulnerabilities.) All links t web references utside f the virtual library are always subject t change withut prir ntice EVALUATION & GRADING COURSE REQUIREMENTS 1. Attendance and Participatin Regular attendance and participatin are essential fr satisfactry prgress in this curse. 2. Cmpleted Assignments Each student is respnsible fr cmpleting all assignments n time. 3. Team Participatin (if applicable) Each student is respnsible fr participating in team assignments and fr cmpleting the delegated task. Each team member must hnestly evaluate the cntributins by all members f their respective teams. ITT Educatinal Services, Inc. Date: 10/6/2006

8 IS Risk Management and Intrusin Detectin Evaluatin Criteria Table The final grade will be based n the fllwing weighted categries: CATEGORY WEIGHT Writing Assignments 10% Participatin 10% Lab Assignments 15% Quizzes 10% Prject 1 15% Prject 2 15% Curse Prject 25% Ttal 100% Grade Cnversin Table Final grades will be calculated frm the percentages earned in class as fllws: A % 4.0 B % 3.5 B 80-84% 3.0 C % 2.5 C 70-74% 2.0 D % 1.5 D 60-64% 1.0 ITT Educatinal Services, Inc. Date: 10/6/2006

9 IS Risk Management and Intrusin Detectin F <60% 0.0 COURSE OUTLINE Readings: Fr all weeks, except unit 1, it is recmmended that yu cmplete the assigned readings befre attending the class. Unit 1: All the cncepts will be cvered in the class, therefre, the specified readings are merely fr yur reference. Unit # Activities fr the week 1 Read Chapter 1: A Framewrk-(abut 43 pages) Chapter 1a: Examples f Security Prblems-(abut 10 pages) 2 Read In Class Discussin(s) #1 and #2 Chapter 1: Understanding Firewalls (abut Pages) at ITT Tech Virtual Library>Bks>Bks 24x7>Firewalls 24Seven, Secnd Editin Lab #1 Quiz #1 3 Read Chapter 6: Asset Value, Plicies, and Rles-Risk Management > Risk Management (abut 10 pages) at ITT Tech Virtual Library>Bks>Bks 24x7> CISSP: Certified Infrmatin Systems Security Prfessinal Study Guide, Secnd Editin Start Prject #1 and Submit Prject #1 Part I ITT Educatinal Services, Inc. Date: 10/6/2006

10 IS Risk Management and Intrusin Detectin 4 Read Chapter 4: Vulnerability Analysis-(abut 30 pages) Chapter 19: Security Patching (Abut 10 Pages) at ITT Tech Virtual Library> Bks>Bks 24x7> Hardening Netwrk Security In Class Discussin #1 Lab #1 5 Read Chapter 15: Budget Acquisitin and Crprate Cmmitment t Security-Perfrm a Risk Assessment (abut 2 pages) at ITT Tech Virtual Library>Bks>Bks 24x7> Hardening Linux Chapter 3: Risk Assessment Methdlgies-(abut 16 pages) Chapter 2: Why Risk Assessment>Risk Assessment Best Practices- (abut 10 pages) 6 Read In Class Discussin #1 Cntinue Prject #1 and Submit Prject #1 Part II Chapter 7: Access Cntrl and Site Security-(abut 36 pages) Chapter 3: Risk Assessment Methdlgies-(abut 3 pages) 7 Read In Class Discussin #1 Writing Assignment #1 Chapter 15: Business Cntinuity Planning-(abut 15 pages) at ITT Tech Virtual Library>Bks>Bks 24x7> CISSP: Certified Infrmatin Systems Security Prfessinal Study Guide, Secnd Editin Chapter 8: Incident and Disaster Respnse-(abut 9 pages) Chapter 16: Disaster Recvery Planning-(abut 15 pages) at ITT Tech Virtual Library>Bks>Bks 24x7> CISSP: Certified Infrmatin Systems Security Prfessinal Study Guide, Secnd Editin In Class Discussin #1 ITT Educatinal Services, Inc. Date: 10/6/2006

11 IS Risk Management and Intrusin Detectin Writing Assignment #1 Lab #1 Start Prject #2 and Submit Prject #2 8 Read Chapter 9: Intrusin Detectin-(abut 30 pages) Chapter 20: Intrductin t Intrusin Detectin and Prtectin>IDS Evasive Techniques (Abut 3 Pages) at ITT Tech Virtual Library>Bks>Bks24x7> CISSP: Certified Infrmatin Systems Security Prfessinal Study Guide, Secnd Editin Chapter 5: Implementing and Maintaining a Secure Netwrk- Hardening the OS and NOS, Hardening Netwrk Devices, Hardening Applicatins (Abut 15 Pages) at ITT Tech Virtual Library>Bks>Bks24x7>Security+ Study Guide, Secnd Editin (SYO-101) In Class Discussin #1 Lab #1 9 Read Quiz #1 Lab #1 10 Read Chapter 17: The Future f Intrusin Detectin and Preventin (abut 9 pages) at ITT Tech Virtual Library>Bks> Bks24x7>Intrusin Detectin & Preventin Chapter 2: Break the Netwrk int Cmmn Areas f Functinality fr Security(Abut Pages) at ITT Tech Virtual Library>Bks>Bks24x7>Hardening Netwrk Security In Class Discussin #1 Lab #1 (Ungraded) 11 Curse Prject ITT Educatinal Services, Inc. Date: 10/6/2006

12 IS Risk Management and Intrusin Detectin INTENT/INTERFACE This curse builds n the tpics cvered in the previus curses by prviding students with a cmprehensive understanding f risks pertaining t Infrmatin Systems (IS). Students will learn hw t assess risks by measuring rganizatinal assets and evaluating threats and vulnerabilities. This curse prvides students with the skills and real wrld knwledge t evaluate, install, and cnfigure Intrusin Detectin Systems (IDS). The inclusin f additinal tpics such as business and security cntrls will help the students t develp methdlgies t manage and mitigate risk. These tpics are critical fr students t cntinue studies in the areas f security plicy develpment and frensic investigatin. The purpse f this curse is t prvide students with an in-depth understanding abut the cncepts f risk management and the applicatin f intrusin detectin. Risk assessment and intruder detectin are fundatinal IS security cncepts, which are required t supprt advanced tpics such as incident handling, security plicy develpment, and frensic investigatin. Students taking this curse are expected t pssess a rudimentary understanding f internetwrking and essential infrmatin abut security cncepts. ITT Educatinal Services, Inc. Date: 10/6/2006