Course Title: Introduction to Trustworthy Computing: Integrating Business and Technical

Course Syllabus

BADM 590-MS11 / BADM 395-MS12 Trustworthy Computing: Information Security and Management

Meet Time: 3- 5:50 pm Thursdays, Spring Semester 2006 Instructor: Prof. Mike Shaw, Dept. Business Administration, College of Business Classroom: 130 Wohlers Hall 4 Credit Hours or 3 Graduate Credit Units

Course Overview This is a new course partly sponsored by a grant from Microsoft. As Information Technology (IT) has become the foundation that supports the infrastructure, transactions, processes, and customer service of any business large or small, so has managing the trustworthiness of enterprise IT effectively emerged as a high priority for business administration. This focus on trustworthy computing is analogous to total quality management widely used in manufacturing and distribution a decade ago, except that the impact is potentially more pronounced because of the greater reliance on IT not only by businesses but also by the broader society. The course will provide students with a core body of knowledge-- for IT applications, management, and research-- concerning:  The state of research and business practice of trustworthy computing  Managerial issues for the prevention of business frauds and threats  The multiple perspectives of trustworthy computing and how to integrate them  The key technology for trustworthy computing for users and for businesses  Issues concerning integrity, privacy, ethics, risk management, and reliability  Best practices concerning regulatory compliance requirements  Enterprise information management issues, policies and practices

Who Should Take the Course This course is designed for students who are interested in pursuing a professional career in research, applications, or management-- in the business administration or information technology fields-- with additional skills and knowledge to manage information security, risk assessment, privacy, and recent regulatory compliance requirements. Since no prior technical background is needed, this course is also suitable for students not in the IT career path but just want to know more about business issues concerning information security, privacy management, and compliance practices. The course format will be such that students are allowed to explore their professional interest by selecting their projects and interacting with executive speakers. Students from various programs will bring their varying disciplinary perspectives to the class. This diverse approach to course delivery can create valuable synergy by integrating the various perspectives to broaden the

1 CN-44226 2 CN-45357 outlook of all of the students. The topics to be covered will follow the following structure:

Course Content

Introduction: Trustworthy Computing and Business Administration 1. Introduction: The Importance of Trustworthy Computing to Enterprise Management 2. Building Trust in Enterprise IT: Integration of IT and Business Perspectives Business Integrity, Privacy management, and Fraud Prevention 3. The Integrity Requirement for Enterprise Accounting and Financial Data 4. Prevention of Financial Frauds 5. Case Study: IT, Sarbanes-Oxley Compliance, and Trustworthy Computing; HIPPA and the Healthcare Industry 6. IT and Privacy Issues (Discussion: Managing Privacy for Competitive Advantages) Management of Threats and Vulnerabilities 7. Sources of Enterprise IT Vulnerabilities 8. Trustworthy Computing and Electronic Commerce 9. Risk Assessment Survey of Related Technology and Business Issues: A Multidisciplinary Approach 10. Survey of Enterprise IT Security: Issues, Technology, Infrastructure and Management 11. Developments in Electronic Evidence and Computer Forensics Enhancing Reliability and Integrity in Enterprise IT 12. The Life-Cycle Methodology for Trustworthy Computing & Risk Management 13. Trustworthy Computing in the Development, Adoption, Deployment, and Diffusion of IT Trust Management in the Globalization of IT 14. Managing Trust in the Diffusion of Enterprise IT 15. Case Study: Trustworthy Computing in the IT infrastructure for Global Supply Chains 16. Trust Enhancing Information Policies and Practices

Guest Speakers One of the features of the new course will be the group of guest speakers from the industry and major companies that are thought leaders on the practice of trustworthy computing, Information presented and collected will be used as the basis for a series of industrial best practices reports by the students as part of the course requirements. A number of IT managers from major organizations will visit and talk to the class as guest speakers.

Course Requirements Students are required to complete a project on selected topics in lieu of the final examination.

2 Textbook: Principles and Practices of Information Security, Volonino, L., and Robinson, S., 2004, Pearson Prentice Hall: New Jersey.

Class Schedule

Spring 2006

1. 1/19 Introduction & Overview

Chapter 1. Security in a Globally Connected Economy

“Trustworthy Computing” Microsoft White Paper, Craig Mundie et al., 2003

“Dependable Pervasive Systems,“ C. Jones and B. Randell, Technical Report CS- TR-839, University of Newcastle upon Tyne, April 2004.

“The Myth of Secure Computing” R. Austin and C. Darby, Harvard Business Review, June 2003.

2. 1/26 Business Risk Management

Jason Weile, Manager, Systems and Process Assurance, PWC --“Risk Management”

Chapter 2. Sources of Digital Liability

Trust in Cyberspace, F. B. Schneider (Ed.), Computer Science and Telecommunications Board, National Research Council, National Academic Press, 1999.

“Assessing Accounting Risk” (D. Hawkins), Harvard Business School Case 9-105- 054, Nov. 2005.

3. 2/2 Vulnerability Management and Assessment

Andrew Petrum, Protiviti --“Vulnerability Management”

Chapter 3. Threats, Vulnerabilities, and Risk Exposure

“The iPremier Company (A): Denial of Service Attack” (A. Austin), Harvard Business School Case 9-601-114,

3 Threat Modeling, F. Swiderski and W. Snyder, Microsoft Press, Redmond WA, 2004.

4. 2/9 Critical Infrastructure

Roy H. Campbell, Sohaib and Sara Abbasi Professor Siebel Center for Computer Science, UIUC --“Critical Infrastructure for the Power Grid”

Chapter 4. An Affirmative Model of Defense

Predictable Surprises, M. Bazerman and M. Watkins, Harvard Business School Press, Boston, MA 2004.

5. 2/16 Information Trust and Compliance Issues

Deron Grzetich, Protiviti -- --“IT and Sarbines-Oxley Compliance Issues”

“The Sabine-Oxley Act” (L. Paine), Harvard Business School Case 9-304-079, July 2004.

“Guide to the Sarbines-Oxley Act: IT Risks and Controls: Frequently Asked Questions” Protiviti White Paper (32 pages).

Information Nation: Seven Keys to Information Management Compliance, R. A. Kahn and B. T. Blair, AIIM, 2004.

Chapter 5. Models for Estimating Risks

6. 2/23 Dependable & Trustworthy Enterprises Systems

Chapter 6 Acceptable-Use Policies: Human Defenses

Framing the Domain of Information Technology Management, R. W. Zmud (Ed.)

“Dependable Pervasive Systems,“ C. Jones and B. Randell, Technical Report CS- TR-839, University of Newcastle upon Tyne, April 2004.

7. 3/2 Enterprise Information Security Policy

4 Peter Siegel, CIO, UIUC -- “Enterprise Information Security Issues: The Case of Higher Education Institutions”

Chapter 7 Acceptance Use Practices: Defense Best Practices

“Colleges Protest Call to Upgrade Online Systems,” New York Times, October 23, 2005.

8. 3/9 Trustworthy Systems Development

“The Trustworthy Computing Security Development Lifecycle, S. Lipner and M. Howard, Microsoft Research. 2005.

Chapter 8 Technology & Auditing Systems: Hardware and Software Defenses

9. 3/16 Technology & Auditing Systems: Hardware and Software Defenses

Mike Corn, Director, Security and Privacy Services, UIUC

Chapter 9 Electronic Evidence and Electronic Record Management

Case: University Security Infrastructure

10. 3/30 Privacy Issues

Thomas Kleyle, Senior Manager, Systems and Process Assurance, PWC Jason Weile, Manager, Systems and Process Assurance “Privacy Issues and Regulation.”

Chapter 11 Privacy and Data Protection

“A New Covenant with Stakeholders: Managing Privacy as a Competitive Advantage,” KPMG Whitepaper

“Google Inc.: Launching Gmail” (D. Darren), Ivey School of Business, Case 904E19, 2004.

11. 4/6 Managing Security in a Multinational Enterprise

Bill Boni, Chief Security Officer, Motorola

5 “Talking Security with Motorola’s William Boni, Network World, 2004.

“From IT Security to Information Management” (M. Rasmussen), Forrester Report on Best Practices, June 2005.

12. 4/13 Crisis Management and Emergency Response

Richard Jaehne, Director, the Illinois Fire Service Institute “Emergency Response and Unified Command Systems.”

“Assessing Your Organization’s Crisis Response Plans” (M. Watkins), Harvard Business School Note 9-902-064, 2001.

Chapter 10. Computer Crime, Computer Fraud, and Cyber Terrorism

13. 4/20 Risk Metrics and Models Healthcare-Industry Issues and Privacy Management Concerning HIPAA

Greg Hodges, Managing Director, Protiviti Risk Management and the Identity Theft Anthony Cutilletta, MD, Managing Director, Protiviti HIPAA

“Combating Fraud in Financial Services” (P. Gillespie and M. Rasmussen), Forrester Report on Best Practices, April 2004.

“Phishing Concerns Impact Consumer Online Financial Behavior,” (C. Graeber), Forrester Report on Best Practices, December 2004.

Chapter 11 Privacy and Data Protection Appendix. HIPAA

14./15. 4/27 & 5/4

Project Presentations; Summary and Conclusions.

Guest Speakers Schedule

1/26 Jason Weile, Manager, Systems and Process Assurance PWC --“Risk Management”

6 2/2 Andrew Petrum, Protiviti --“Vulnerability Management”

2/9 Roy H. Campbell, Sohaib and Sara Abbasi Professor Siebel Center for Computer Science, UIUC --“Critical Infrastructure for the Power Grid”

2/16 Deron Grzetich, Protiviti --“IT and Sarbines-Oxley Compliance Issues”

3/2 Peter Siegel, CIO, UIUC --“Enterprise Information Security Issues: The Case of Higher Education Institutions”

3/16 Mike Corn, Director, Security and Privacy Services, UIUC

3/30 Thomas Kleyle, Senior Manager, Systems and Process Assurance, PWC Jason Weile, Manager, Systems and Process Assurance “Privacy Issues and Regulation.”

4/6 Bill Boni, Chief Security Officer, Motorola

4/13 Richard Jaehne, Director, the Illinois Fire Service Institute “Emergency Response and Unified Command Systems.”

4/20 Greg Hodges, Managing Director, Protiviti, “Risk Management and the Identity Theft” Anthony Cutilletta, MD, Managing Director, Protiviti, “HIPAA and the Healthcare Industry.”

Readings List

Articles3 1. “The Myth of Secure Computing” R. Austin and C. Darby, Harvard Business Review, 2003. 2. “The iPremier Company (A): Denial of Service Attack” (A. Austin), Harvard

3 Copies of articles 1-6 are available at TIS Bookstore as a course package. The rest are available online at the Compass course site.

7 Business School Case 9-601-114, Oct 2005. 3. “Google Inc.: Launching Gmail” (D. Darren), Ivey School of Business, Case 904E19, 2004. 4. “Assessing Accounting Risk” (D. Hawkins), Harvard Business School Case 9-105- 054, Nov. 2005. 5. “Assessing Your Organization’s Crisis Response Plans” (M. Watkins), Harvard Business School Note 9-902-064, 2001. 6. “The Sabine-Oxley Act” (L. Paine), Harvard Business School Case 9-304-079, July 2004. 7. “From IT Security to Information Management” (M. Rasmussen), Forrester Report on Best Practices, June 2005. 8. “Guide to the Sarbines-Oxley Act: IT Risks and Controls: Frequently Asked Questions” Protiviti White Paper (32 pages). 9. “Combating Fraud in Financial Services” (P. Gillespie and M. Rasmussen), Forrester Report on Best Practices, April 2004. 10. “Phishing Concerns Impact Consumer Online Financial Behavior,” (C. Graeber), Forrester Report on Best Practices, December 2004. 11. “The Trustworthy Computing Security Development Lifecycle, S. Lipner and M. Howard, Microsoft Research. 2005. 12. “Dependable Pervasive Systems, “ C. Jones and B. Randell, Technical Report CS- TR-839, University of Newcastle upon Tyne, April 2004. 13. “A New Covenant with Stakeholders: Managing Privacy as a Competitive Advantage,” KPMG Whitepaper (36 pages), 2001. 14. “Trustworthy Computing” Microsoft White Paper, Craig Mundie et al., 2003 (10 pages)

References Books (These books will be reserved in the Library. They provide more substantial discussions on the topics as referenced in the course schedule).

 Framing the Domain of Information Technology Management, R. W. Zmud (Ed.), Pinnaflex Educational Resources: Cincinnati OH, 2000.  Information Nation: Seven Keys to Information Management Compliance, R. A. Kahn and B. T. Blair, AIIM, 2004.  Trust in Cyberspace, F. B. Schneider (Ed.), Computer Science and Telecommunications Board, National Research Council, National Academic Press, 1999.  Threat Modeling, F. Swiderski and W. Snyder, Microsoft Press, Redmond WA, 2004.  Digital Defense, T. Parenty, Harvard Business School Press, Boston, MA 2003.  Predictable Surprises, M. Bazerman and M. Watkins, Harvard Business School Press, Boston, MA 2004.

Project Description

Students are required to complete a report focused on a selected topic. There will be flexibility in the focus in terms of the disciplinary coverage (e.g., technical vs.

8 managerial) and also the orientation (e.g., application vs. research). Since the underlying vision of the course content is about integrating technical and managerial perspectives, there will be room for diverse approaches for you to take in this project.

You can choose your project from the list of the topics to be discussed in this course:

1. Business Risk Management

2. Vulnerability Management and Assessment

3. Critical Infrastructure

4. Information Trust and Compliance Issues (SOX)

5. Dependable & Trustworthy Enterprises Systems

6. Enterprise Information Security Policy

7. Trustworthy Systems Development

8. Technology & Auditing Systems: Hardware and Software Defenses

9. Privacy Issues

10. Trustworthy supply chains in multinationals

11. Crisis Management and Emergency Response

12. HIPAA

Each report should cover both the technical and business perspectives although there can be a greater emphasis on one of the perspectives. One component of the report is a summary of the related guest lecture(s), which will require adding sufficient background information either by literature research or by collecting additional information from the speaker giving the presentation.

Students from various degree programs may choose different types of individual projects. There are three basic types from which you can choose to do:

1. An academic research project. 2. An application project. 3. A survey of the state-of-the-art methodology, practices, and trends.

Students can focus on projects concerning a research topic, a real-world application, or the state of development of a given area. Examples include developing a risk metric, a

9 model for assessing the vulnerability of an enterprise, the risk analysis of an e-commerce site, enhancing the trustworthiness of the supply-chain of a multinational companies, or evaluating the maturity of the security readiness of a business. It is possible that several students can work on related problems with different but complementary focuses.