Information Security Issues
 

This 2 day course is intended for:

Individuals wishing to gain a broad understanding of Information Security. The course includes a list of resources important for staying up-to-date with security issues.

Topics Covered:

• Information Security best practices
• Security components and terminology
• TCP/IP
• Risk assessment
• Incident handling

Objectives:

The class is designed to give the student a thorough grounding in the world of Information Security. Students should be able to identify the components and procedures that make up a secure environment, make some preliminary steps toward a career in Information Security and further their studies using the list of resources included with the class.

Duration: 2 days

Delivery: Class lecture

Audience: 

Individuals wishing to gain a broad understanding of Information Security

Prerequisites:

System administrator-level knowledge of UNIX, IBM mainframe or Microsoft operating systems..

Outline: 

1. A Broad Look at Information Security
   
   News from the Information Security front
   What is Information Security?
   What are the overall goals?
   Prevention
   Detection
   Response 
    
2. The Adversaries and Their Methods
   
   Hacker vs. Cracker
   Who are the players?
   What is the motivation?
   The process of attack
    
3. Risk Assessment
   
   Why risk assessment
   What are you protecting?
   What are the risks to the assets?
   Probability of the risks
   Appropriate response to the risks
   The Security Policy
    
4. TCP/IP Fundamentals
   
   The OSI model
   Hardware addressing
   IP addressing schemes
   Packet layouts
   Port numbers
    
5. The Exploits
   
   Buffer overruns
   Password guessing
   Social engineering
   CGI attacks
   Trojans
   Viruses
    
6. Best Practices
   
   Apply fixes
   Strong passwords
   Logging
   Monitoring
   Tripwire
   Backups
   Counter attack?
   Physical Security
    
7. Encryption: Keeping It Private
   
   Symmetric-key encryption
   Public-key encryption
   Hybrid Cryptosystems
   Public Key Infrastructure
   Secure Sockets Layer
   Hashes
    
8. The Tools of the Trade
   
   Webservers
   Firewalls
   Intrusion Detection systems: Network, Host
   Network address Translation
   Virtual Private Networks
   Proxies
   Switches
   Sniffers
    
9. Incident Handling
   
   Rules of evidence
   The written plan
   Practice, practice, practice
   Update your contact information
   Reporting the incident
    
10. Resources