1. General
Course Information
Course: Strateg
Thinking for CyberSec
Course Number (section): ISA 797 –
Special Topics in Information Security
Location: AB 2003, Fairfax Campus
Time: Wednesdays as schedule (normally 19:20 –
22:00) Sept 2, 2015 through Dec 2, 2015
Course Homepage: Blackboard
Prerequisites: ISA 656, ISA 562
2. Instructor Information
Professor: Richard Guidorizzi, Angelos
Stavrou (supervision)
Office: Engineering Building Rm 5332
Tel. 571-225-4983
Email: TBD
Office Hours: Mondays and Wednesdays 17:00
– 18:00 (and by appointment)
3. Course Descriptions and Objectives
�
One of the
primary concerns today relate to �cyber security challenges and real-world
problems� – currently, there is little substantive information on exactly
what �cyber security� is about let alone the challenges and problems is that is
creating today�s IT breaches.
�
The course will delve into the specific
aspects of the cybersecurity field and attempt to provide a strategic
understanding of the source of the current concerns relating to cyber security
and potential directions of how to address the core problems which are deeply
rooted in our (mis)understanding of how cybersecurity happens in practical
scenarios.
�
The course
will address the problem at a strategic level, while driving down to specific
technical details to ground the strategic understanding in technical reality.
�
Core to the
course is to provide familiarity and working experience of the more common
enterprise tool set, lessons learned in deployment, balancing value with cost,
the emerging trends, and when technology may not be the only answer.
�
The course
will have two components: lectures and advanced labs where students will be
exposed to tools and delve into research ideas a practical environment.
�
Students will
o Develop an understanding of the cyber
security field including current practices and the primary challenges that are bringing
focus to the field
o Compare IT management approaches and
gain an understanding of their intended and unintended impact on an
organization�s security posture
o Learn how to evaluate and balance
positive security impact with negative operational impact
o Become familiar with the differences
between defensive and offensive cyber
o Learn how an organization�s
perspectives and operational choices can have unintended security consequences
and how to avoid this.
o Being able toto
evaluate cyber security (technology, procedures, and training) in the context
of the field and in the context of an organization�s specific needs
o Get hand�s on exposure
to new and emerging Cyber-security threats through lecture, discussion, and Lab
exercises.
4. Required Course Materials
�
Textbook: None
�
Readings: Optional Readings and discussion board topics may be used during
the duration of the class. Those
will be posted to Blackboard.
� Surviving on a Diet of Poisoned Fruit, Richard Danzig, July 2014,
available at:
http://www.cnas.org/sites/default/files/publications-pdf/CNAS_PoisonedFruit_Danzig_0.pdf
� Vasa Case Study
� HBGary Case Study
� Deconstructing The Cyber Kill Chain, Giora Engel, November 2014,
available at:
http://www.darkreading.com/attacks-breaches/deconstructing-the-cyber-kill-chain/a/d-id/1317542
� 2015 Verizon Data Breach Investigations Report, Verizon (authors not provided),
available at:
www.verizonenterprise.com/DBIR/
�
Audio Visual
Resources
�
Speaker:
Peiter "Mudge" Zatko, DARPA, the Defense Advance Research Project
Agency, directs billions of dollars towards research. One of these research
areas is Cyber. This is a keynote
delivered at 2011 �ShmooCon� www.youtube.com/watch?v=xo1YUEn49WA. (if this link does not work, then
copy and paste the following into your browser:
� Blackboard: This course will use Blackboard to deliver course materials such as lecture notes, announcements, online discussions, and assignments, etc. Additional materials beyond the textbook may also be posted on Blackboard. It is important for you to visit Blackboard (http://mymason.gmu.edu) regularly for course materials and announcements.
5.
Tentative Course Schedule
|
Class 1: Sept 2, 2015 |
What
is the current Cyber Security State and Challenges �
An
overview of the main cyber security field with a discussion on Cyber Security,
Information Assurance, and Information Technology, their meaning and their
relationships �
Learn
what are the current research challenges and the difference is between the
goals of IT Operations and Cyber Security, how they relate and how they conflict
(from the CIO/CISO perspective). Being secure and being usable/operational
has become untenable and students will be exposed to different alternatives
to overcome that dilemma. |
|
Asignments: |
1)
Presentation (Research):
Find an article discussing the state of cyber in an industry and
present 1 slide describing the relevance of this issue Due Class 2 (9 Sept) 2)
Group Presentation: Develop a method of how to objectively evaluate
risk in the field of cyber security and provide an example of the relative
risk in two scenarios Due Class 4 (23 Sept) 3)
Reading: Surviving on a
Diet of Poisoned Fruit Complete by Class |
|
Class 2: Sept 9, 2015 |
What
is the current Cyber Security State in Practice �
Gain an
understanding of the current state of cyber within the private and public
sectors �
Understand
the breakdown and relevance of the 14 competency areas within DHS�s Essential
Body of Knowledge for Cyber Security and why it is relevant to you. |
|
Assignments: |
1)
Homework: Map out how the
DHS Essential Body of Knowledge connects to the goals of the CIO/CISO (as
defined in class) Due Class 3 (16 Sept) 2)
Reading: White Paper about
the VASA Complete by Class 3 (16 Sept) |
|
Class 3: Sept 16, 2015 |
What
makes management of IT and IT security (�cyber�) so challenging? �
Discussion of the complicated technologies and processes that make up
IT operations and the inherent challenges �
A discussion of the challenges presented to software developers and how
their primary incentivizes increases the overall complexity of software and
reduces security posture |
|
Assignments: |
1)
Present: Develop a pitch to
take over the cyber security functions for an organization (based on hand out
information). Develop a Cyber Security agenda for research and operations for
the target company. Due Class 11 (11 Nov) |
|
Class
4: Sept
23, 2015 |
What
is �Risk� in the terms of Cyber Security? �
Gain an understanding of why traditional risk evaluation methods fail
when applied to Cyber Security �
Discussion of valuable methods of how to evaluate risk in Cyber
Security �
Discussion risks, threats, and vulnerabilities �
Understand how to manage risks in an environment where all the
necessary information is not available |
|
Assignments: |
1)
Homework: Define the
comparative value of two similar technologies Due Class 5 (30 Sept) 2)
Reading: HBGary and Anonymous Complete by Class 7 (14 Oct) |
|
Class
5: Sept
30, 2015 |
Cost
of Security vs the Value of Security �
Discussion of the costs of security technology, the actual and hidden �
Understand how to evaluate TCO and ROI on security improvements �
Discussion of the actual value security provides |
|
Assignments: |
1)
Presentation: Define the attackers business process (2 slides max) Due Class 7 (14 Oct) 2)
Reading: Deconstructing the Cyber Kill Chain Complete by Class 7 (14 Oct) |
|
Class
6: Oct
7, 2015 |
Mid-Term
Exam |
|
|
1)
Lab exercise: Download and use Hacker tools (details provided in Class
6&7) Complete by end of Class 7 (14 Oct) |
|
Class
7: Oct
14, 2015 |
Cyber
Defense vs Cyber Offense �
Review the aspects of IT Operations that make up the cyber defensive �
Discussion of the actual mission and activities performed by a
cyber-adversary �
Discussion of the different types of adversaries, and what risks and
threats they each bring �
Develop an understanding of the interrelationship between offense and
defense and the tradeoffs that are made |
|
Assignments: |
1)
Homework: Understanding the
CIO/CISO priorities, define the type of threat vectors that offer the
greatest opportunities for the adversary Due Class 8 (21 Oct) 2)
Lab exercise: Download and use Hacker tools (details provided in Class
6&7) Complete by end of this Class |
|
Class
8: Oct
21, 2015 |
Cyber
Threats �
Discuss the most significant threat vectors in Cyber �
A detailed discussion of what makes up an �Advanced Persistent Threat� �
An evaluation of potential threat vectors, as compared to the most
expeditious threat vectors, and potential new threat vectors �
Detailed discussion of the cyber-attack process, and why the �cyber
kill chain� offers a limited understanding on reality |
|
|
1)
Presentation: Explain one of the major threats in Cyber Due Class 9 (28 Oct) 2)
Team Presentation: Define a security protection suite that will provide
protection to selected avenues of attack, with a limited budget. This will be
your project that you will assumed to have completed by the end of the class. Due Class 12 (18 Nov) |
|
Class
9: Oct
28, 2015 |
What
actions can we take to make things better? �
Discussion the steps security professionals can take to improve
security �
Comparative evaluation of the value of security technology and
processes as compared to organization�s size and scale �
Understand how the security answer for a small organization is not the
same as for a large organization |
|
Assignments: |
1)
Group Presentation: Develop
a pitch to get your (fictional) business to purchase and deploy a cyber
security tool. Due Class 10 (4 Nov) |
|
Class
10: Nov
4, 2015 |
Why
is Communication such a challenge in the field of Cyber? �
Evaluation of the challenges facing communicating technological issues
to senior management �
Discussion of how to communicate technical security issues with
non-technical people |
|
Assignments: |
None |
|
Class
11: Nov
11, 2015 |
What
is the Security Workforce? �
Be able to understand what a �Hacker� is and why you might want one
working for you �
Understand the different levels of skill covered in the term �red team� �
Develop an understanding of the necessary skills required for each of
the security roles in the cyber field �
Learn how the development of the most effective security team for an
organization is tied to its size and scale |
|
Assignments: |
None |
|
Class
12: Nov
18, 2015 |
Managing
a Cyber Security Team �
Understand how to develop a cyber-security team for an organization �
Discuss how to attract and manage top talent in this field �
Learn the basic functions required to be performed by a cyber security
team and how they interact with the operational staff |
|
Assignments: |
None |
|
Class
13: Nov
25, 2015 |
Final
Exam: Team Project Presentation |
|
Class
14: Dec
2, 2015 |
Cyber
Security from the Strategic Perspective �
Draw conclusions from the subject areas addressed throughout the class
to understand the primary issues and concerns presented in the field of cyber
security |
|
Assignments: |
None |
6. Grading and Assessment
Grading for the course will be based on total points earned
by the end of the course. Final course letter grade assignments, will be as
follows:
� Grade
Percentage
A exceptional
students that are >98%
A greater
than or equal to 93% but less than 98%
A- greater
than or equal to 88% but less than 93%
B+ greater
than or equal to 83% but less than 88%
B greater
than or equal to 78% but less than 83%
B- greater
than or equal to 75% but less than 78%
C+ greater
than or equal to 70% but less than 75%
C greater
than or equal to 65% but less than 70%
C- greater than or equal to 60% but less than 65%
F less
than 60%
� Peer
evaluation. Team will be required
to evaluate the quality of effort, work product and general contribution to
group assignments by all team members.
� Graded
Assignments
|
Element |
Weight |
Individual or Group |
|
Participation |
10% |
I |
|
Homework |
5% |
|
|
Lab
(Class 7) |
5% |
I |
|
Presentation
(Class 2) |
5% |
I |
|
Presentation
(Class 4) |
5% |
G |
|
Presentation
(Class 7) |
5% |
I |
|
Presentation
(Class 9) |
5% |
I |
|
Presentation
(Class 10) |
5% |
G |
|
Presentation
(Class 11) |
10% |
G |
|
Presentation
(Class 12) |
10% |
G |
|
Mid-Term |
15% |
G |
|
Final
Exam/Project Presentation |
20% |
G |
|
|
100% |
Assignments - To be successful in this course, assignments
will be an integral part of learning the course material. It is in the best
interest of the student and of student teams to complete each and every individual
and group assignment.
Homework
will only be accepted through Blackboard submission. Scanned, hand written work
will not be accepted.
Presentations
done in class also must be submitted through Blackboard by the start time of
the presentation.
� Late Assignments
Late assignment submissions are subject to penalties:
o 1 day late (within
24 hours) ........................ 30%
o penalty after the
2nd day (24 hours) ...........not accepted
7. Student Responsibilities
Students are expected to attend class each Class and to
participate in class discussions and exercises. Students are expected to
complete assignments on time. Students are expected to respect their instructor
and fellow classmates, both in and out of the classroom environment. Students
are expected to turn off or silence their mobile phones during class time.
Attendance Policy:
Attendance in this class is highly
recommended in order to be successful in learning the course content. The
student is solely responsible for all assignments and material presented in
class even if missed due to absence.
8. Email Communication
By policy of the University and to help protect confidentiality,
students are must use their official George Mason email accounts for
communication with the instructor and other students in the class. All emails
from the instructor will be sent to your official George Mason email email
addresses.
9. Learning Goals
1.
Apply knowledge of information technology and
business functions to understand its application in assessing, designing and
improving business processes.
2.
Use knowledge of computer networks as part of
the IT solutions for improving business processes. They will also have option
of developing more advanced skills in the areas of network and security.
3.
Effectively manage information technology
projects.
4.
Understand the overall systems development
life cycle and be able to recommend IT system solutions accordingly. They will
also have option of learning appropriate development tools to develop prototype
of IT solutions for business management.
10. George Mason Standards of Behavior:
The mission of the George Mason University is
to create and deliver high-quality educational programs and research. Students,
faculty, staff, and alumni who participate in these educational programs
contribute to the well-being of society. High-quality educational programs
require an environment of trust and mutual respect, free expression and
inquiry, and a commitment to truth, excellence, and lifelong learning.
Students, program participants, faculty, staff, and alumni accept these
principles when they join the School of Business community. In doing so, they
agree to abide by the following standards of behavior:
o
Respect for the rights,
differences, and dignity of others
o
Honesty and integrity in dealing with
all members of the community
o
Accountability for personal
behavior
Integrity is an essential ingredient of a successful learning
community. Ethical standards of behavior help promote a safe and productive
community environment, and ensure every member the opportunity to pursue
excellence. To this end, community members have a personal responsibility to
integrate these standards into every aspect of their experience. Through our
personal commitment to these Community Standards of Behavior, we can create an
environment in which all can achieve their full potential.
11. Honor Code Statement:
Honor
System and Code: The Honor System and Code
adopted by George Mason University will be enforced for this class:
http://oai.gmu.edu/the-mason-honor-code/
In your work on all written assignments, keep
in mind that you may not present as your own the words, the work, or the
opinions of someone else without proper acknowledgement. You also may not
borrow the sequence of ideas, the arrangement of material, or the pattern of
thought of someone else without proper acknowledgement. Please note: Faculty
are obligated to submit any Honor Code violations or suspected violations to
the Honor Committee without exception.
The appropriate version of the School of
Business �Recommendations for Honor Code Violations� should be attached.
13. Disability: If you have a disability and you need academic accommodations,
please see me and contact the Office of Disability Services (ODS) at
703-993-2474. All academic accommodations must be arranged through the ODS.
Please take care of this during the first two weeks of the semester. More
information about ODS is available at http://www.gmu.edu/student/drc
14. Religion: Students who will miss class for religious reasons should inform
me of their anticipated absences as soon as possible.
15. Counseling center: George Mason University has a counseling center that can provide
assistance if you find yourself overwhelmed by life, want training in academic
or life skills, or the like. More information is available at http://www.gmu.edu/departments/csdc/
16. Writing Guidelines (if relevant
for the course): Unless otherwise specified, all
writing assignments should be formatted as follows: double-spaced, Times New
Roman, 12-point font, and 1-inch margins. To cite and reference professional or
academic sources, please use APA style.
Specific instructions for in-text citations and referencing are found in
the Publication Manual of the American
Psychological Association, 6th Edition or at http://owl.english.purdue.edu/owl/resource/560/01/ .
To help manage the citations and seamlessly create reference
lists, Mason supports a free software called Zotero. Please go to https://www.zotero.org/
This program offers:
- Centralized
bibliography management
- Ability
to sync across computers
- Ability
for teams to combine contributions to the references
- Word
plug-in that allows citation management within MS word
George Mason University has a writing center that can help you
improve your English writing skills. More information is available at http://writingcenter.gmu.edu/
17. Inclement weather
& campus emergencies: Information
regarding weather related changes in the University�s schedule (e.g., closing
or late opening) will be provided on the GMU website and via MasonAlert. Students sign up for the Mason Alert system to
provide emergency information of various sorts at https://alert.gmu.edu.
18. Emergencies: An
emergency poster exists in each classroom explaining what to do in the event of
crises and that further information about emergency procedures exists on http://www.gmu.edu/service/cert.