{"id":50,"date":"2019-03-28T11:22:29","date_gmt":"2019-03-28T15:22:29","guid":{"rendered":"https:\/\/sites.bu.edu\/braude\/?page_id=50"},"modified":"2019-03-28T11:40:41","modified_gmt":"2019-03-28T15:40:41","slug":"met-cs-684-security-policies-and-procedures","status":"publish","type":"page","link":"https:\/\/sites.bu.edu\/braude\/courses\/met-cs-684-security-policies-and-procedures\/","title":{"rendered":"MET CS 684 Security Policies and Procedures"},"content":{"rendered":"

PLEASE NOTE: THIS IS THE SYLLABUS TO A PREVIOUS FACE-TO-FACE OFFERING OF THIS COURSE<\/em><\/p>\n

IT IS NOT UP-TO-DATE<\/em><\/p>\n

IN PARTICULAR, THE TEXTBOOKS ARE NOT NECESSARILY THE ONES CURRENTLY IN USE <\/em><\/p>\n

THIS OLD SYLLABUS IS LEFT ONLINE TO PROVIDE A SENSE OF HOW THE COURSE WAS DESIGNED IN THE PAST<\/em><\/p>\n

SOME ASPECTS REMAIN INTACT<\/em><\/p>\n

FOR INFORMATION, CALL THE DEPARTMENT FOR INFORMATION<\/em><\/p>\n

(617)353-2566<\/em><\/p>\n\n\n\n\n\n\n\n\n
Background of the Instructor <\/strong>changed if this is red<\/td>\nLearning Objectives <\/strong>changed if this is red<\/td>\n<\/tr>\n
Contacting Eric Braude <\/strong>changed if this is red<\/td>\nPlagiarism Warning <\/strong>changed if this is red<\/td>\n<\/tr>\n
Evaluation of Students <\/strong>changed if this is red<\/td>\nPolicies – Miscellaneous<\/strong> changed if this is red<\/td>\n<\/tr>\n
Forums: Past and Present <\/strong>changed if this is red<\/td>\nTextbooks and Materials <\/strong>changed if this is red<\/td>\n<\/tr>\n
Home Page of Eric Braude <\/strong>changed if this is red<\/td>\nTopics, Class Dates & Readings <\/strong>changed if this is red<\/td>\n<\/tr>\n
Homework and Due Dates <\/strong>changed if this is red<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n

Description:<\/h2>\n

This course enables IT professional leaders to identify emerging security risks and implement security policies to support organizational goals. Discussion of methodologies for identifying, quantifying, mitigating and controlling risks. Students implement IT risk management plans that identify alternate sites for processing mission-critical applications, and techniques to recover infrastructure, systems, networks, data and user access. The course also discusses topics such as disaster recovery, handling information security; protection of property, personnel and facilities; protection of sensitive and classified information, privacy issues, and criminal terrorist and hostile activities.<\/p>\n

Learning Goals<\/p>\n
    \n
  • Understand the common Information Systems Security models<\/li>\n<\/ul>\n
      \n
    • Review CIA characteristics \u2013 confidentiality, integrity and availability<\/li>\n<\/ul>\n
        \n
      • Understand security measures from Technology, Policy & Practice and Education\/Training\/Awareness dimensions.<\/li>\n
      • Understand risk management \u2013 identification, quantification, response and control.<\/li>\n
      • Learn disaster recovery procedures and countermeasures for the business enterprise.<\/li>\n<\/ul>\n
        \n

        Textbook and Materials<\/h2>\n

        Information Security Policies and Procedures: A Practitioner\u2019s Reference by Thomas R. Peltier, Second edition, Auerbach, ISBN 0-8493-1958-7<\/p>\n

        Guide to Disaster Recovery<\/em> Erbschloe, M. (2003) Thomson Course Technology ISBN 9 780619 131227<\/p>\n

        Security Policies and Procedures: Principles and Practices <\/em>Sari Greene (2005) Prentice Hall ISBN 0-13-186691-5<\/p>\n

        \n

        Evaluation of Students<\/h2>\n

        Absorbing and creating security system policies will be expected of all students.\u00a0 To attain excellence, students will be expected to create original analyses and comparisons.\u00a0 The course grade will be computed from the following<\/p>\n

        Weekly assignments: 35%<\/p>\n

        Weekly quizzes: 15%<\/p>\n

        Class participation: 20%<\/p>\n

        Final: 30%<\/p>\n

        Class Participation<\/span><\/p>\n

        Students are required to participate in class or online discussions because this is an effective and, for many, an enjoyable way to learn.\u00a0 Participation is evaluated as follows.<\/p>\n

        Make a note of the substantive comments that you make in class or sent to the class via the class site.\u00a0 I often ask question of the class to encourage participation.\u00a0 You are encouraged to participate in class at all times in any case.\u00a0 At any time prior to one week before the final, submit these.\u00a0 Each should consist of the date, the context of the discussion at the time, and a short paragraph of what you said, a half page at the most.\u00a0 Here are some context<\/em> examples.<\/p>\n

          \n
        • We were discussing how to obtain buy-in from developers for security policies:<\/em><\/li>\n
        • Responding to a comment raised by another student concerning the use of UML inheritance:<\/li>\n
        • Responding to a question put to the class by the professor:<\/li>\n
        • Responding to a question by a student:<\/li>\n<\/ul>\n

          You are reminded that plagiarism is taken very seriously by the Boston University community; so don\u2019t create imaginary comments, including material from the Internet.\u00a0 The criteria<\/span> for participation are as follows:<\/p>\n

          a<\/em>. Proportion of substantive contributions. <\/em>This is the percentage<\/em> of documented contributions that have significant content.\u00a0 75% would be a good fraction.\u00a0 95% is definitely excellent<\/p>\n

          <\/em><\/p>\n

          b<\/em>. Number of substantive contributions. <\/em>This counts the number<\/em> of substantive contributions.\u00a0 In a class of 15, two per class would be good.\u00a0 Larger classes result necessarily in proportionately lower contribution per person.<\/p>\n

          g. Evenness of contributions<\/em>.\u00a0 This measures the uniformity of your contributions throughout the semester.\u00a0 A contribution every week would be good in this respect.<\/p>\n

          Late homework<\/span> will not be accepted unless there is a reason why it was impossible<\/em> to perform the work in time given work and emergency conditions.\u00a0 In that case, e-mail the written reason should be attached to the homework, which will be graded on a pass\/fail basis if the reason is accepted by me.<\/p>\n

          \n

          Warning concerning plagiarism<\/h2>\n

          Please cite all references and uses of the work of other.\u00a0 All instances of plagiarism must be reported to the College for action.\u00a0 e-mail, see or call me if you have any doubts about the proper use of others\u2019 material. In any case, clearly acknowledge all sources in the context they are used, including code, of course.<\/p>\n

          \n

          Syllabus<\/h2>\n

          1.\u00a0 Introduction and Threats to Enterprise Security<\/span><\/p>\n

          1A: Introduction and Threats<\/p>\n

            \n
          • Vulnerabilities<\/li>\n
          • The U.S. National Level<\/li>\n
          • Introduction to Risk Thinking<\/li>\n<\/ul>\n

            1B: An Overview of Security Responses<\/p>\n

            Readings: Peltier 287-306; 259-263<\/p>\n

            Greene Most Helpful: 65 \u2013 72; Additional: 72 \u2013 81<\/p>\n

            2.\u00a0 I.T. Enterprise Security Issues<\/span><\/p>\n

            2A: Common Enterprise Security Issues<\/p>\n

              \n
            • Ethical Issues<\/li>\n
            • Legal and Regulatory Issues (Sarbanes-Oxley, HIPAA, FDA, etc.)<\/li>\n
            • Asset Security<\/li>\n
            • Security Risk<\/li>\n<\/ul>\n

              2B: Specialized Security Issues<\/p>\n

                \n
              • Security in a connected world\u00a0 (India, Ireland, \u2026.)<\/li>\n
              • Runtime security<\/li>\n
              • Other security issues<\/li>\n<\/ul>\n

                Readings:\u00a0 Peltier 367-370<\/p>\n

                Greene Most Helpful: 387 \u2013 396, 425 \u2013 443<\/p>\n

                Additional: 397-423 page through: 117-137; 425-455; 463-481
                \nSee references to risks via index as needed<\/p>\n

                3.\u00a0 Security Policies, Standards and Procedures<\/span><\/p>\n

                3A: Security Policies<\/p>\n

                  \n
                • Rationale for Policies, Standards and Procedures<\/li>\n
                • Preparing and Gathering Information<\/li>\n
                • Policy Parameters<\/li>\n
                • Policy Tiers<\/li>\n
                • Enterprise-Tier Policies<\/li>\n
                • Topic-Tier Policies<\/li>\n
                • Application-Tier Policies<\/li>\n
                • Asset Classification<\/li>\n<\/ul>\n

                  3B: Security Standards and Procedures<\/p>\n

                  Readings: Peltier 47-80, 113-162 and 199-241<\/p>\n

                  Greene Most Helpful: 1-25, 35 \u2013 51, 91-106, 185 – 203<\/p>\n

                  4.\u00a0 I.T. Operational Security Management<\/span><\/p>\n

                  4A: Common Operational Security Management<\/p>\n

                    \n
                  • Quality Assurance in Software Development<\/li>\n
                  • Security in system development<\/li>\n<\/ul>\n

                    4B: Specialized Issues in Operational Security Management<\/p>\n

                      \n
                    • The Need to Communicate Security Policies<\/li>\n
                    • Program Planning Principles<\/li>\n
                    • Scope and Approvals<\/li>\n
                    • Assessment of Security State and Needs<\/li>\n
                    • Program Aspects<\/li>\n
                    • Implementation<\/li>\n
                    • Maintenance<\/li>\n<\/ul>\n

                      Readings: Peltier 325-358<\/p>\n

                      Greene Most Helpful: 311 \u2013 325; Additional: 325-337<\/p>\n

                      5.\u00a0 I.<\/span> T. <\/span>B<\/span>usiness Continuity: Preparation<\/span><\/p>\n

                      5A: An introduction to business continuity and disaster recovery<\/p>\n

                        \n
                      • Reviewing business continuity concepts<\/li>\n
                      • Establishing principles of disaster recovery planning<\/li>\n
                      • Reviewing steps for disaster recovery planning<\/li>\n
                      • Preparing to develop a disaster recovery plan<\/li>\n<\/ul>\n

                        5B: Preparing for I.T. continuity<\/p>\n

                          \n
                        • Assessing risks<\/li>\n
                        • Prioritizing assets for recovery<\/li>\n
                        • Developing plans and procedures<\/li>\n
                        • Learning organizational relationships<\/li>\n<\/ul>\n

                          Readings: Erbschloe Chapters 1-6<\/p>\n

                          Greene Most Helpful: 351 – 365<\/p>\n

                          6.\u00a0 Implementation of Disaster Recovery and Continuing Operations<\/span><\/p>\n

                          6A: Recovering from disasters<\/p>\n

                            \n
                          • Responding to attacks<\/li>\n
                          • Implementing recovery plans<\/li>\n<\/ul>\n

                            Reading: Erbschole Chapter 12 (page 317-343)<\/p>\n

                            6B: Ongoing Quality<\/p>\n

                              \n
                            • Learning from disasters<\/li>\n
                            • Measuring quality<\/li>\n
                            • Managing ongoing quality processes<\/li>\n<\/ul>\n

                              Review for Final<\/p>\n

                              Readings: Erbschloe Chapter 12 (317-343);\u00a0 Chapter 3 is background reading for the first part of\u00a0 lecture 6B<\/p>\n

                              Greene Most Helpful: 365 – 375<\/p>\n","protected":false},"excerpt":{"rendered":"

                              PLEASE NOTE: THIS IS THE SYLLABUS TO A PREVIOUS FACE-TO-FACE OFFERING OF THIS COURSE IT IS NOT UP-TO-DATE IN PARTICULAR, THE TEXTBOOKS ARE NOT NECESSARILY THE ONES CURRENTLY IN USE THIS OLD SYLLABUS IS LEFT ONLINE TO PROVIDE A SENSE OF HOW THE COURSE WAS DESIGNED IN THE PAST SOME ASPECTS REMAIN INTACT FOR INFORMATION, […]<\/p>\n","protected":false},"author":2828,"featured_media":0,"parent":22,"menu_order":5,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"_links":{"self":[{"href":"https:\/\/sites.bu.edu\/braude\/wp-json\/wp\/v2\/pages\/50"}],"collection":[{"href":"https:\/\/sites.bu.edu\/braude\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sites.bu.edu\/braude\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sites.bu.edu\/braude\/wp-json\/wp\/v2\/users\/2828"}],"replies":[{"embeddable":true,"href":"https:\/\/sites.bu.edu\/braude\/wp-json\/wp\/v2\/comments?post=50"}],"version-history":[{"count":1,"href":"https:\/\/sites.bu.edu\/braude\/wp-json\/wp\/v2\/pages\/50\/revisions"}],"predecessor-version":[{"id":51,"href":"https:\/\/sites.bu.edu\/braude\/wp-json\/wp\/v2\/pages\/50\/revisions\/51"}],"up":[{"embeddable":true,"href":"https:\/\/sites.bu.edu\/braude\/wp-json\/wp\/v2\/pages\/22"}],"wp:attachment":[{"href":"https:\/\/sites.bu.edu\/braude\/wp-json\/wp\/v2\/media?parent=50"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}