Information Security Boot Camp Agenda

Seminar: ID# 1264239

Agenda

• Fundamental principles of information security
• Making the business case for information security
• Information security management objectives
• Risk analysis: threats, vulnerabilities, risks, and countermeasures
• Policies, standards, procedures, and guidelines
• Information classification
• Security awareness

• Computer crimes, investigations, evidence, forensics
• Laws, directives and regulations
• Types of laws
• Privacy issues and legislation
• Intellectual property, copyright laws and software piracy
• European Union Data Protection Act
• Prominent US and international laws
• Information security and auditing standards

• Enterprise information security architecture
• Computer architectures
• Operating system security
• Virtualization: operational and security considerations
• Security models
• Access control models, techniques and technologies, and methods
• Open and closed systems
• Security design standards and criteria: “Rainbow Series”, ITSEC, Common Criteria
• Certification and accreditation

• Defining a 3-layer simplified network protocol model
• Open Systems Interconnection (OSI) model
• Transmission Control Protocol/Internet Protocol (TCP/IP): IPv4, IPv6
• Network addresses and applications
• LAN and WAN technologies, topologies and protocols
• Wiring: copper, fiber optics
• Wireless networks technologies, protocols and security
• Voice over IP (VoIP)
• Network interconnection devices: functionality, risks and safeguards
• Directory services: LDAP, DNS
• Network management tools: packet sniffers, SNMP, network utility and diagnostic software
• Network security vulnerabilities, threats, risks and countermeasures
• Hacker probing and attack techniques
• Firewalls and proxy servers
• Intrusion detection/prevention systems
• VPNs and related Internet security protocols: SSL/TLS, IPSec, SSH
• Network discovery, vulnerability and penetration testing

• Demystifying the language of cryptography
• Key management: asymmetric, symmetric
• Encryption algorithms and hashing functions
• Digital signatures
• Certificate Authorities (CAs) and Public Key Infrastructure (PKI)
• Applications of cryptography
• Cryptography vs. steganography

• Authentication mechanism: passwords, tokens, smart cards, biometrics
• Point-to-point protocol (PPP) authentication: PAP, CHAP
• Extensible authentication protocol: EAP
• Enterprise authentication systems: RADIUS, TACACS+, Diameter
• Single/reduced sign-on (SSO): Kerberos, Web-based SSO

• System development life cycle methodologies
• Configuration management and change control
• Application development tools and methodologies
• Client server and middleware security
• Data types and structures
• Database management systems
• Web application security architecture: control points, attacks and defenses
• Mobile code security risks: Java, ActiveX, JavaScript, VBScript
• Malicious software and hacker attacks

• Computing center location, construction and management
• Physical security threats, vulnerabilities, risks and countermeasures
• Perimeter security, boundary protection and facilities access controls
• Electrical, temperature, water, and other environmental controls
• Fire detection, prevention and suppression
• Information storage media protection, sanitization and disposal
• Emergency procedures
• Human resources security: hiring practices, badges, terminations and transfers

• Business continuity planning requirements
• Business impact analysis
• Redundancy and fault tolerance
• Backup procedures: on-site and offsite
• Backup resources: processing sites, storage, offices, utilities, equipment and supplies
• Recovery testing procedures
• Emergency response procedures

• Includes continuous unit and course review exercises