Secure Operations
Instructor
David Johnson, Assistant Professor of Industrial Engineering and Political Science
Course Description:
This course will provide you with a better understanding of how security principles should be integrated into operations once an application or cyber system has been deployed into production. To begin, we will provide an overview of the cyber threat landscape and discuss general frameworks for conceptualizing intrusions and defenses. Topics include both proactive (e.g., monitoring, patching) and reactive (e.g., incident response) processes, as well as approaches to end-of-life processes such as decommissioning and disposal. As part of the course, you will also learn about the current legislative and regulatory environment within which production systems operate, such as laws governing data privacy and security controls. While we focus primarily on the United States, companies increasingly operate across national boundaries, so we will also discuss relevant international regulations, directives, and agreements. Finally, we will examine risk assessment and risk management as a framework for navigating the economic trade-offs associated with securing operations.
By the end of the course, students should be able to:
- Identify weaknesses in hypothetical security protocols and recommend improvements
- Summarize the similarities and differences in various approaches to monitoring, patching, and incident response
- Assess the implications of security related policies, laws, and norms on system operations
- Evaluate what changes would be required to comply with proposed new policy requirements
- Structure an analysis of economic impacts associated with best practices and regulatory compliance
Web Content:
Anatomy of an Intrusion, and the Cyber Kill Chain Framework, Defense-in-Depth, Red Teams, Blue Teams, Threat Actors, Legal and Regulatory Environment, Risk Analysis and Economic Decision-Making
Textbooks:
J. Sherwood, A. Clark, D. Lynas. 2005. Enterprise Security Architecture: A Business-Driven Approach. San Francisco, CA: CMP Books. D. Clark, T. Berson, and H. S. Lin, editors. 2014. At the Nexus of Cybersecurity and Public Policy: Some Basic Concepts and Issues. National Academies Press.
Content Includes:
Anatomy of an Intrusion, attack vectors, credential theft, privilege escalation, reconnaissance, lateral movement, Cyber Kill Chain framework, reconnaissance, weaponization, delivery, exploitation, installation, command and control, action on objectives; perimeter security, network security, endpoint security, application security, data security, prevention, monitoring and response; misuse, anomaly, and intrusion detection models, IDS vs. IPS vs. UTM;ghost images, patching, service migration; CERT/CSIRT – containment and monitoring, forensics, incident response, guidelines for evidence handling and processing, law enforcement interaction, relevant organizations, end-of-life, documentation, decommissioning and disposal; nationstate, stuxnet, petya/sony, advanced persistent threats, organized crime; hacktivists; Legal and Regulatory Environment; Laws and directives governing information security, United States - FISMA 2014 44 U.S.C. § 3541 et seq., European Union - GDPR, International - Common Criteria (ISO/IEC 15408), Healthcare – HIPAA, Finance - PCI DSS; GLBA, Higher education - FERPA; What does it mean to be compliant?, Documentation, validation, accreditation processes; ethics of information security; Cyber threat information sharing (NIST SP 800-150 (2016)); Public versus private sector regulations and best practices; Risk assessment and management as a framework for navigating tradeoffs, Developing risk management plans for information assurance, economic tradeoffs at multiple scales; resolving conflicting guidelines (e.g., HIPAA and CMS with respect to storage and retention of protected health information (PHI)); dedicated, isolated hardware vs. cloud storage and virtualization; implications on IT governance and enterprise security architecture