TITLE: Information Policy and Security Auditing

1. CATALOG DESCRIPTION:
   A detailed study of security auditing and policy making, which will serve as a capstone to the security option. The entire process of information policy writing and security auditing will be examined including: inspection, protection, detection, reaction, and reflection.
   
   
2. PURPOSE:
   Build a foundation for students to understand the issues of protecting the security of a company by analyzing the process of security policy writing and auditing from start to finish.
   
   
3. COURSE OBJECTIVES:
   The Telecommunications student will be able to implement from start to finish information security by analyzing the critical risks and threats, defining an information security strategy and architecture, planning for and responding to intruders, and looking at the legal and public relations implications.
   
   
4. CONTENT OUTLINE:
   
   1. Inspection
      
      1. Resource Inventory
         
      2. Threat Assessment
         
      3. Loss Analysis
         
      4. Identifying Vulnerabilities
         
      5. Assigning Safeguards
         
      6. Evaluation of Current Status
   2. Protection
      
      1. Awareness
         
      2. Access
         
      3. Identification
         
      4. Authentication
         
      5. Authorization
         
      6. Availability
         
      7. Accuracy
         
      8. Confidentiality
         
      9. Accountability
         
      10. Administration
   3. Detection
      
      1. Intruder Types
         
      2. Intrusion Methods
         
      3. Intrusion Process
   4. Reaction
      
      1. Incident Determination
         
      2. Incident Notification
         
      3. Incident Containment
         
      4. Assessing the Damage
         
      5. Incident Recovery
         
      6. Automated Response
   5. Reflection
      
      1. Incident Documentation
         
      2. Incident Evaluation
         
      3. Public Relations
         
      4. Legal Prosecution
   
   
5. INSTRUCTIONAL ACTIVITIES:
   Lecture & Discussion.
   
   
6. FIELD, CLINICAL, AND/OR LABORATORY EXPERIENCES:
   None.
   
   
7. RESOURCES:
   Web-Page references.
   
   
8. GRADING PROCEDURES:
1. GRADING FACTORS:
      Six exams, equally weighted. The lowest test score will be dropped.
   
   
2. GRADING SCALE

   Average		Grade
   90 or above		A
   80 - 89%		B
   70 - 79%		C
   60 - 69%		D
   Below 60%		E

3. ATTENDANCE POLICY:
   This course will adhere to the policy published in the MSU Undergraduate Bulletin. Attendance will not be recorded each day, but students are expected to be regular in attendance. Provisions will be made for making up necessary absences from labs. Late homework or lab reports without valid reason will have a grade reduction. No make-ups are given for pop tests. The lowest one-hour exam grade will be dropped, and normally no make-up exams will be given. Any make-up exams will be at the discretion of the instructor, and will require that advance notice be received before a test is given, stating the reasons for the absence. Supporting documentation will be required.
   
   
4. ACADEMIC HONESTY POLICY:
   Cheating, plagiarism (submitting another person's material as one's own), or doing work for another person which will receive academic credit are all impermissible. This includes the use of unauthorized books, notebooks or other sources in order to secure or give help during an examination; the unauthorized copying of examinations, assignments, reports or term papers; or the presentation of unacknowledged material as if it were the student's own work. Disciplinary action may be taken beyond the academic discipline administered by the faculty member who teaches the course in which the cheating took place.
   
   
5. TEXT AND REFERENCES:
   Information Security, Protecting the Global Enterprise by Donald L. Pipkin. ISBN #: 0-13-017323-1
   
   
6. PREREQUISITES:
   TSM 340, TSM 352, and ACC 201.