Information Security Management

Fall 2020

Instructor
Dave Eargle (contact)
Class
See my.cu.edu for schedule
Grad student class meeting zoom link
Ugrad class meeting zoom link
Office Hours
See this canvas page
Slack
https://infosecmanagementf20.slack.com

Course Information

Course Description

This course is a broad introduction to the managerial issues of information security. Because security is multifaceted, the topics of the class range widely, including technical (e.g., cryptography), managerial (e.g., policy compliance), physical (e.g., door locks), and psychological (e.g., social engineering) issues. A key objective of the class is to develop a security mindset, in which one learns to think like an attacker for ways to exploit a system.

Class topics include the following:

Final Exam Topics Review

Learning Outcomes

Develop working knowledge of methods of protecting data
To gain a working knowledge of modern methods of protecting data: encryption, hashing, confidentiality, authentication, integrity, non-repudiation, certificates, and IP security.
Gain familiarity with attack vectors
To become familiar with attack vectors that are commonly executed in attempting to access and compromise or steal data
Learn methods of attack prevention and detection
To learn modern methods of attack prevention and detection: antivirus, firewalls, intrusion detection, and system hardening
Learn methods of threat modeling
To learn state-of-the-art methods of threat modeling.
Develop a security mindset
This goal will help you think like a security professional — how to identify threats like an attacker, and how to mitigate those threats.
Appreciate the broad disciplines required for IS security
This class will help you appreciate the broad disciplines required for information security to work. We’ll cover subjects as diverse as cryptology, physical security, psychology, and management.

Content note

Information security has heavy implications for and overlap with politics and regulations. In this class, we will at times examine the tension between security and surveillance. Know that statements from the community of information security professionals and experts are often at odds with, and directly rebut, statements from government or law enforcement representatives. I sincerely appreciate the essential function that law enforcement serves, and I am grateful for good work done by law enforcement officers at any levels of government. That said, I believe that the freedom to critique a public policy, public servant, government agent, or government agency is healthy in a democracy to the end that it helps us as citizens think critically. We can then in turn impact public policy for the better through participation in local and national politics.

During the class, we will critically analyze things that politicians and other public servants say and do that impact information security or that illustrate class topics, and I will share my own views on topics, while I will do my best to make our discussions a place where we can engage bravely, empathetically and thoughtfully with potentially-difficult content every week.

Communication

Heads up! I rely heavily on slack to be able to assist you all, and to communicate important information.

For communication, we will use Slack. Add an account at https://infosecmanagementf20.slack.com. Consider installing laptop and phone apps so that you get notifications. There is also a desktop client. Use your @colorado.edu email address for instant verification.

My intention is to put class announcements in a dedicated channel on slack, and to have other channels for homework help, current events, discussions, etc. I will try to go through and answer questions posted to slack at least once a day. You can use slack to help one another, to coordinate with your teams, etc.

Technology Requirements

Text Materials

I try to only assign readings that are available for free – for example, blog posts or news articles. I might have you buy one harvard business case at less than $10. I’ll let you know later in the semester.

Certification Option

As an option, students seeking certification may replace the final exam by passing the Security+ certification or another certification approved by the instructor. You can substitute your score on the certification (plus an adjustment — 5% for the Security+) for the final. For example, if you received an 85% on the Security+ exam you would receive a 90% for your final exam score.

To receive credit for the certification, a student must show evidence of having taken the certification exam by the last day of class. If a student doesn’t show the instructor evidence of passing the certification by this date, then he/she will be required to take the final exam.

Grading

Item Percent
Labs 20
Midterm project 15
Risk assessment project 15
Reading quizzes 4
Participation 5
Security Films 1
Final Exam 40
Extra Credit Value
Third security movie Replace 1 quiz
Security book – book report Replace 1 lab

Assignments

Labs

Labs are hands-on learning activities that will be begun in class and completed outside of class. Labs are typically due one week after they are introduced in class.

The labs can be found here, but content is subject to change before a lab is officially assigned on the semester’s Canvas page.

Go to the Labs

Midterm vulnerability assessment project

This is a group project. The midterm will be a vulnerability and penetration assessment report of a server. The report will be written for an upper management audience. Teams of students will be given an IP address of a server to assess for security weaknesses. The midterm report will be due two weeks later.

Risk assessment project

This is a group project. Details forthcoming, but it will be related to applying the NIST Cybersecurity framework action verbs to a public company, to perform a risk assessment. It will potentially incorporate current events. The report would also propose several specific controls which could mitigate specific identified vulnerabilities against organizational assets. Deliverables include a written report and a presentation.

Readings Quizzes

Most readings and videos on the schedule have associated quizzes. Quizzes are open book, open Internet and must be completed within 20 minutes. Quizzes are administered on the course LMS (Canvas).

Quizzes are typically due the night after the material is covered in class.

Security Films

Two films are required viewing for this course: “Zeros Days” and “Citizenfour.” You must watch these films on your own. To receive credit, complete one security films report quiz for each film. Simply indicate that you watched the whole film and give your brief reaction to the film.

Extra Credit

You can replace your lowest quiz score by watching a third security film from the Security Readings and Films list submitting a few sentences about what you thought about it.

Similarly, you can replace your lowest lab score by reading a security book from the Security Readings and Films list and submitting a few sentences about what you thought about it.

Classroom Policies

Participation Policy

The following list is not comprehensive, but rather an example of items considered for the class participation score:

Teamwork

In this class, you will work in teams. As a result, consider reviewing a short report on team effectiveness and establishing a team agreement (sample agreement).

Freeloader policy

It occasionally happens in class and enterprise settings that someone in a group is not prepared to do his/her share. In the case of my classes, I recommend that the team give the freeloader one warning and then fire that person from the team. That person will then do group assignments individually or find another team to join. The team should notify me of the change in team composition immediately. I distribute a form to assess team participation at the end of the semester. If a major disparity in team contribution is reported, I will adjust team project grades.

Classroom Procedures

For virtual class meetings:

For either virtual or in-person:

Late Work

All assignments and projects are to be submitted on time or early, so plan accordingly. If you must miss class, please submit your assignment early. On VERY rare occasions, an exception may be granted, allowing the student to submit the work late with a 20% penalty. Under no circumstances will anything be accepted more than a week late.

Relevant University Offices, Policies, and Procedures

Classroom Behavior

Both students and faculty are responsible for maintaining an appropriate learning environment in all instructional settings, whether in person, remote or online. Those who fail to adhere to such behavioral standards may be subject to discipline. Professional courtesy and sensitivity are especially important with respect to individuals and topics dealing with race, color, national origin, sex, pregnancy, age, disability, creed, religion, sexual orientation, gender identity, gender expression, veteran status, political affiliation or political philosophy. For more information, see the policies on classroom behavior and the Student Code of Conduct.

Requirements for COVID-19

As a matter of public health and safety due to the pandemic, all members of the CU Boulder community and all visitors to campus must follow university, department and building requirements, and public health orders in place to reduce the risk of spreading infectious disease. Required safety measures at CU Boulder relevant to the classroom setting include:

Students who fail to adhere to these requirements will be asked to leave class, and students who do not leave class when asked or who refuse to comply with these requirements will be referred to Student Conduct and Conflict Resolution. For more information, see the policies on COVID-19 Health and Safety and classroom behavior and the Student Code of Conduct. If you require accommodation because a disability prevents you from fulfilling these safety measures, please see the “Accommodation for Disabilities” statement on this syllabus.

Before returning to campus, all students must complete the COVID-19 Student Health and Expectations Course. Before coming on to campus each day, all students are required to complete a Daily Health Form. In this class, you may be reminded of the responsibility to complete the Daily Health Form and given time during class to complete it.

Students who have tested positive for COVID-19, have symptoms of COVID-19, or have had close contact with someone who has tested positive for or had symptoms of COVID-19 must stay home and complete the Health Questionnaire and Illness Reporting Form remotely. In this class, if you are sick or quarantined, please let me know.

Accommodation for Disabilities

If you qualify for accommodations because of a disability, please submit your accommodation letter from Disability Services to your faculty member in a timely manner so that your needs can be addressed. Disability Services determines accommodations based on documented disabilities in the academic environment. Information on requesting accommodations is located on the Disability Services website. Contact Disability Services at 303-492-8671 or [email protected] for further assistance. If you have a temporary medical condition, see Temporary Medical Conditions on the Disability Services website.

Preferred Student Names and Pronouns

CU Boulder recognizes that students’ legal information doesn’t always align with how they identify. Students may update their preferred names and pronouns via the student portal; those preferred names and pronouns are listed on instructors’ class rosters. In the absence of such updates, the name that appears on the class roster is the student’s legal name.

Honor Code

All students enrolled in a University of Colorado Boulder course are responsible for knowing and adhering to the Honor Code. Violations of the policy may include: plagiarism, cheating, fabrication, lying, bribery, threat, unauthorized access to academic materials, clicker fraud, submitting the same or similar work in more than one course without permission from all course instructors involved, and aiding academic dishonesty. All incidents of academic misconduct will be reported to the Honor Code ([email protected]); 303-492-5550). Students found responsible for violating the academic integrity policy will be subject to nonacademic sanctions from the Honor Code as well as academic sanctions from the faculty member. Additional information regarding the Honor Code academic integrity policy can be found at the Honor Code Office website.

The University of Colorado Boulder (CU Boulder) is committed to fostering an inclusive and welcoming learning, working, and living environment. CU Boulder will not tolerate acts of sexual misconduct (harassment, exploitation, and assault), intimate partner violence (dating or domestic violence), stalking, or protected-class discrimination or harassment by members of our community. Individuals who believe they have been subject to misconduct or retaliatory actions for reporting a concern should contact the Office of Institutional Equity and Compliance (OIEC) at 303-492-2127 or [email protected]. Information about the OIEC, university policies, anonymous reporting, and the campus resources can be found on the OIEC website.

Please know that faculty and instructors have a responsibility to inform OIEC when made aware of incidents of sexual misconduct, dating and domestic violence, stalking, discrimination, harassment and/or related retaliation, to ensure that individuals impacted receive information about options for reporting and support resources.

Religious Holidays

Campus policy regarding religious observances requires that faculty make every effort to deal reasonably and fairly with all students who, because of religious obligations, have conflicts with scheduled exams, assignments or required attendance. In this class, reach out to me if you have a concern.

See the campus policy regarding religious observances for full details.