CS 490/CIS 790 Information System Security

1. CS 490/CIS 790Information System Security Welcome to the Course! Taught By: Dr Susan Lincke (CISA)

2. Security Certifications Certified Information Security Mgr (CISM) Security Architect, Security Mgr, Security Consultant High-Level Oriented Certified Information Systems Auditor (CISA) IT Auditor High-Level & Detail Oriented Focus: Audit, Compliance Managerial Certified Information Systems Security Professional (CISSP) Auditor, Security Consultant, Security Mgr, Security Architect Detail-Oriented Technical Secure+ Security Administrator

3. CertificationOverlap CISA CISM Audit Security Program Mgmt Software Engineering Systems Life Cycle Mgmt IT Governance Network Security CISSP Data Com- munications & Networks Security Program Info Security Development Risk Physical Control Incident Response & Business Continuity & Disaster Recovery Operations Security Telecommunications Forensics Security Architecture Legal Regulations Cryptography

4. Course Material CISA CISM Audit Software Engineering Security Program Mgmt Systems Life Cycle Mgmt IT Governance Network Security CISSP Data Com- munications & Networks Security Program Info Security Development Risk Physical Control Incident Response & Business Continuity & Disaster Recovery Operations Security Telecommunications Forensics Security Architecture Legal Regulations Cryptography

5. Information Security Careers Development: Design requirements Develop applications Database Administration Security software dev. IT Auditor, Quality Assurance, Forensics Legal compliance Security recommendations Audit Forensics IT & Security Administration Protect the network Implement access control Monitor IPS/Firewall Risk Analysis Security Architecture Security Program Management

6. Control Layers

7. Course Work Lab Community Partner Lecture Case Study Presentation: PowerPoint experience Apply in Health First Requirements & Design Work Book guide

8. Health First Case Study

9. Jamie Ramon MD Doctor Chris Ramon RD Dietician Terry Medical Admin Pat Software Consultant Health First Case Study

10. Service Learning Component:Non-Disclosure Agreement Wrong Way: You: I developed a security plan for Help-The-Community Interviewer: What specifically did you do? You: I helped them to define their data security classification schemes and recommended they encrypt their back-up tapes daily, among other things. Interviewer: What did you find? You: They had no security. They were hopelessly non-technical. We introduced some security, including adding WPA to their wireless network. What is wrong with this dialogue?

11. Service Learning Component:Non-Disclosure Agreement Right Way: You: I developed a security plan for Help-The-Community Interviewer: What specifically did you do? You: Well, we worked with information security and network security using the Small Business Security Workbook. But I can’t go into more details. Interviewer: What did you find? You: I signed a non-disclosure agreement. But I can tell you more about the Health First Case Study we worked on…

12. How to Study • Do the work in class • Use the test questions (CD) in the presentations and the book for chapters covered • “Think like ISACA or ISC does” • General vocabulary and concepts at end of presentation