SRA111: Introduction to Security and Risk Analysis
Total Page:16
File Type:pdf, Size:1020Kb
SRA111: Introduction to Security and Risk Analysis Course Description SRA 111 is an introductory course with a broad focus, spanning primarily the areas of security, risk, and risk analysis. In addition to familiarizing the student with basic security terminology, it will also touch upon social and legal issues, risk analysis and mitigation, crime intelligence and forensics, and information warfare and assurance. This course will motivate students to understand the requirements for security in any government agency or business organization through the use of case studies. Included in this segment are cases related to cyberterrorism, bioterrorism, and critical infrastructure protection. Some concepts to be covered in the area of information security are: confidentiality, integrity, availability, and non- repudiation. Various methods of safeguarding these security concerns will be discussed, such as: single- and multi-factor authentication, encryption, digital signatures, prevention of denial of service attacks, and so forth. This course also covers social and legal issues related to security, in particular identity theft and social engineering. Topics in this section include identity theft, spam, spyware, and adware. This course also covers the basic principles and the approaches to risk analysis. Here students study vulnerability analysis, crime and intelligence analysis, forensics, techniques for risk assessment and risk mitigation. The course will prepare students for more in-depth courses such as SRA 211, SRA 221 and SRA 311. This course will incorporate collaborative and action-learning experiences wherever appropriate. Emphasis will be placed on developing and practicing writing and speaking skills through application of the concepts that define the course. Course Objectives Upon completion of the course, the student will: • Understand basic security concepts, terminology and possible solutions. • Develop an understanding of the social and legal issues of security and privacy. • Understand the basics of crime intelligence and forensics analysis. • Be able to apply risk analysis, evaluation and mitigation methods. • Understand information warfare and information assurance. • Have an awareness of current and future trends in information and cyber security. 1 Classes Information Section: 001 Class Time: MWF 11:00-11:50am Class Room: Frable 227 About the Instructor Instructor: Galen A. Grimes, Associate Professor of IST Office: Frable 213 Office Hours: See faculty website Phone/Fax: 412-675-9479 E-mail: [email protected] Web Site: http://www.personal.psu.edu/faculty/g/a/gag5/ 2 Course Materials • Security Awareness—Applying Practical Security in Your World, 4th Ed. Mark Ciampa Copyright © 2014 Course Technology ISBN-13: 978-1-111-64418-5 • Computer Forensics And Cyber Crime, An Introduction, 3rd Ed. Marjie Britz Copyright © 2013 Pearson/Prentice Hall ISBN-13: 978-0-13-267771-4 • Supplemental reading materials at the discretion of the instructor • The New York Times (newspaper) 3 Course Policies • (Any policies implemented by the instructor or campus). • Quizzes will be given throughout the semester, at a rate of approximately 1 per chapter. Quizzes will always cover the material covered since the last Quiz or Exam. The quizzes will be combinations of objective and/or short-answer questions. Makeup quizzes will not be given. Any class material missed by the student is the student's responsibility to acquire. • Students with disabilities. The Pennsylvania State University is committed to providing access to a quality education for all students. Penn State welcomes students with disabilities into the University's educational programs. If a student has a disability- related need for modifications or reasonable accommodations in this course, it is the responsibility of the student to first obtain a University accommodation letter confirming the disability and suggesting appropriate remedies. This letter should be obtained from the campus Disability Contact Liaison. The contact person at Penn State Greater Allegheny is Victoria Garwood (Frable 103, 412-675-9070, [email protected]). Students from other Penn State campuses can find their contact person at http://www.equity.psu.edu/ods/dcl.asp. It is encouraged that students request their accommodation needs early in the semester, and once identified, a reasonable accommodation will be implemented in a timely manner. Students may also access the web site for the Office of Disability Services at University Park for more information: http://www.equity.psu.edu/ods/. • PSU Statement on Academic Integrity. According to the University Advising Handbook: "Academic integrity is the pursuit of scholarly activity free from fraud and deception, and is the educational objective of this institution. Academic dishonesty includes, but is not limited to cheating, plagiarism, fabrication of information or citations, facilitating acts of academic dishonesty by others, unauthorized possession of examinations, submitting work of another person, or work previously used without informing the instructor, or tampering with the academic work of other students. Any violation of academic integrity will be thoroughly investigated, and where warranted, punitive action will be taken." Students should be aware that standards for documentation and intellectual contribution may depend on the course content and method of teaching, and should consult instructors for guidance. 4 Tentative Schedule Week Topics Readings Assignments/Tests 1 Introduction to Information Security— Wired Magazine: “Hackers Remotely Kill a Jeep on the Highway—With Me In It:”, July 21, 2015 http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ Reuters: Researcher says can hack GM OnStar app, open vehicle, start engine, July 30, 2015, http://www.reuters.com/article/2015/07/30/us-gm-hacking- idUSKCN0Q42FI20150730 NPR: All Tech Considered, “Major Flaw In Android Phones Would Let Hackers In With Just A Text”, July 27, 2015 http://www.npr.org/sections/alltechconsidered/2015/07/27/426613020/major- flaw-in-android-phones-would-let-hackers-in-with-just-a-text VIDEO: Bruce Schneier: The Security Mirage (21:05): [cc/t] http://www.ted.com/talks/bruce_schneier.html NPR/On Point, July 26, 2012, A Trade Show for Hackers—Black Hat Conference, http://onpoint.wbur.org/2012/07/26/hackers 2 ***Labor Day*** VIDEO: Nerds 2.0 Volume 1, “Networking the Nerds”, Part 1 [cc] Discussion Activity 1— Personal Security Risks VIDEO: Nerds 2.0 Volume 1, “Networking the Nerds”, Part 2 [cc] 3 Introduction to Security Chapter 1— Discussion Activity 2— Ciampa Malicious Code VIDEO: Mikko Hypponen—Fighting Viruses, Defending the Net (17:36): [cc/t] http://www.ted.com/talks/lang/eng/mikko_hypponen_fighting_viruses_defend ing_the_net.html [VIDEO-MikkoHypponen_2011g.mp4] NPR: Marketplace, How One Hack Got to Engineers with Security Clearance, Sept 10 2013, http://www.marketplace.org/topics/tech/how-one-hack-got- engineers-security-clearances 5 NPR: All Things Considered, Security Firm Hacks a Car With a Text— Chapter Review Questions— August 29, 2011 [cc/t], http://www.npr.org/2011/08/29/140042759/security- Chapter 1—Ciampa firm-hacks-a-car-with-a-text NPR: All Tech Considered, With Smarter Cars, The Doors Are Open To Hacking Dangers—July 30, 2013, http://www.npr.org/blogs/alltechconsidered/2013/07/30/206800198 /Smarter-Cars-Open-New-Doors-To-Smarter-Thieves 4 Introduction and Overview of Computer Forensics and Cybercrime Chapter 1— Discussion Activity 3— Britz Security Access Controls Discussion Questions—Chapter 1 (Britz) Discussion Questions 1-5, p.22 NPR: Morning Edition, Dear Apple: Good Luck Against The Quiz—Chapter 1 (Ciampa) Smartphone Black Market—Sept 16 2013, http://www.npr.org/blogs/alltechconsidered/2013/09/16/222125010/ dear-apple-good-luck-against-the-smartphone-black-market 5 Desktop Security Chapter 2— Discussion Activity 4— Ciampa Security Policy NPR: All Things Considered/All Tech Considered, Hunting for a Password That Only You Will Know [cc/t] http://www.npr.org/2011/07/25/138672758/hunting-for-a-password-that-only- you-will-know NPR: All Things Considered/All Tech Considered, How to Protect Yourself From Hacking [cc/t] http://www.npr.org/templates/rundowns/rundown.php?prgId=2&prgDate=7- 25-2011 60 Minutes: Cyber War, JUN 13 2010, Chapter Review Questions— http://www.cbsnews.com/video/watch/?id=6578069n&tag=mncol;lst;1 Chapter 2 (Ciampa) NPR: All Things Considered, Your PIN May Not be Uncrackable After All, [cc/t] Sept 20, 2012, http://www.npr.org/player/v2/mediaPlayer.html?action=1&t=1&islist=false&i d=161502081&m=161502066 6 www.passfault.com NPR, All Things Considered, The Most Secure Password in the World Might Be You, http://www.npr.org/blogs/alltechconsidered/2013/11/05/243060103/the-most- secure-password-in-the-world-might-be-you 6 Contemporary Computer Crime Chapter 4— Discussion Activity 5—Risk Britz Assessment Discussion Question—Chapter 4 (Britz) Discussion Question 1-5, p.111 NPR: Morning Edition, FEB 12, 2013, “In Cyberwar, Software Flaws Are A Hot Commodity”, http://www.npr.org/2013/02/12/171737191/in- cyberwar-software-flaws-are-a-hot-commodity NPR: Morning Edition, FEB 13, 2013, “Victims Of Cyberattacks Get Proactive Against Intruders”, http://www.npr.org/2013/02/13/171843046/victims-of-cyberattacks- now-going-on-offense-against-intruders NPR: The Diane Rehm Show, FEB 13, 2013, “The Growing Threat Of Cyber- Espionage”, http://thedianerehmshow.org/ Quiz—Chapter 2 (Ciampa) 7 Internet Security Chapter 3— Discussion Activity 6— Ciampa Encryption