 An Overview of IE 4382/5382 Cybersecurity for Information Systems Susan D. Urban, Ph.D Department of Industrial Engineering Texas Tech University Lubbock, Texas This research was supported by the National Science Foundation (Grant No ). Opinions, findings, and conclusions/recommendations are those of the authors and do not necessarily reflect the views of the NSF. 5/1/15TTU Faculty Workshop on Cybersecurity for Critical Infrastructure 1

Cybersecurity for Information Systems  A core course in the Cybersecurity for Critical Infrastructure certificate program  Covers a wide breadth of practices for assuring information systems security  Fundamentals of Information Systems Security, by D. Kim and M. Solomon, Jones & Bartlett, Information Systems Security & Assurance Series,  Covers the seven domains of the International Information Systems Security Certification Consortium (ISC) 2 TTU Faculty Workshop on Cybersecurity for Critical Infrastructure5/1/15 2

Seven Domains of an IT Infrastructure From Fundamentals of Information Systems Security, D. Kim and E. Solomon, 2 nd Edition, Jones and Bartlett, TTU Faculty Workshop on Cybersecurity for Critical Infrastructure5/1/15 3

Topics Covered  Access Controls  Security Operations and Administration  Auditing, Testing, and Monitoring  Risk, Response, and Recovery  Cryptography  Networks and Telecommunications  Malicious Code and Activity  IS Standards, Education, Certifications, and Laws TTU Faculty Workshop on Cybersecurity for Critical Infrastructure5/1/15 4

Additional Topics Covered  Case Studies  TJX Case, Maroochy Water Breach, Stuxnet, Other high- profile cases, Current events  Biometrics  Legal Issues  Freedom of Information Act, Einstein NIS, US Patriot Act, Computer Fraud and Abuse Act  Compliance Laws  Federal Information Systems Management Act, Gramm- Leach –Bliley Act, Sarbannes-Oxley Act, Family Educational Rights and Privacy Act TTU Faculty Workshop on Cybersecurity for Critical Infrastructure5/1/15 5

Virtual Security Cloud Lab  Hands-on lab in a cloud computing environment using cutting edge technology  Students can test their skills with realistic security scenarios that they will encounter in their careers  The mock IT infrastructure was designed to mimic a real-world IT infrastructure consisting of the seven domains of a typical IT infrastructure  Each lab provides learning objectives, step-by-step instructions, evaluation criteria, and lab assessment questions TTU Faculty Workshop on Cybersecurity for Critical Infrastructure5/1/15 6

VSCL Mock IT Infrastructure From Fundamentals of Information Systems Security, D. Kim and E. Solomon, 2 nd Edition, Jones and Bartlett, TTU Faculty Workshop on Cybersecurity for Critical Infrastructure5/1/15 7

VSCL Lab Topics  Performing Reconnaissance and Probing Using Common Tools  Performing a Vulnerability Assessment  Enabling Windows Active Directory and User Access Controls  Using Group Policy Objects and MS Baseline Security Analyzer for Change Control  Performing Packet Capture and Traffic Analysis  Implementing a Business Continuity Plan TTU Faculty Workshop on Cybersecurity for Critical Infrastructure5/1/15 8

VSCL Topics  Using Encryption to Enhance Confidentiality and Integrity  Performing a Website and Database Attack by Exploiting Identified Vulnerabilities  Eliminating Threats with a Layered Security Approach  Implementing an Information Systems Security Policy  TTU Faculty Workshop on Cybersecurity for Critical Infrastructure5/1/15 9

Assessment Activities  Exams  Virtual Cloud Labs  Lab deliverables and assessment worksheets  Students present lab deliverables and assessment  In-class, team-led discussions of case studies and related topics  Information systems security policy project  Graduate research papers and presentations TTU Faculty Workshop on Cybersecurity for Critical Infrastructure5/1/15 10