Information Security

Course outline

1. Unit 1 · Week 1

   What we are protecting

   1. Assets and the CIA triad
   2. The CIA triad in a JazzCash transfer
   3. Threat, vulnerability, attack and control
   4. Passive and active attacks
   5. Labelling a scenario with the vocabulary
2. Unit 2 · Week 2

   Who attacks, and why security is a business problem

   1. Adversaries and the attack surface
   2. Adversaries: insiders and outsiders
   3. Motives: criminals, activists and states
   4. Attack surface and the need for security
   5. Security as a business need
3. Unit 3 · Week 3

   Rules a secure system should obey

   1. Security design principles
   2. Least privilege, fail-safe defaults, complete mediation
   3. Defence in depth, separation of privilege, economy of mechanism
   4. Open design and psychological acceptability
4. Unit 4 · Week 4

   Risk as one picture

   1. Risk
   2. Likelihood, impact and the 3×3 grid
   3. A risk register
   4. Controls and residual risk
   5. Treating a risk: reduce, transfer, avoid or accept
5. Unit 5 · Week 5

   Cryptography job 1: hide

   1. Symmetric encryption
   2. Plaintext, ciphertext, key and Kerckhoffs's principle
   3. Brute force: trying every key
   4. Block and stream ciphers, AES and key length
6. Unit 6 · Week 6

   Cryptography jobs 2 and 3: detect change, prove origin

   1. Detecting change and proving origin
   2. Hash functions and MACs
   3. The key-distribution problem
   4. Public-key cryptography and hybrid encryption
   5. Digital signatures and non-repudiation
7. Unit 7 · Week 7

   Authentication: proving you are who you claim

   1. User authentication
   2. Identification, authentication, authorisation and factors
   3. Storing passwords: salted hashes, and passkeys
   4. Multi-factor authentication
   5. Passkeys: logging in without a password
8. Unit 8 · Week 8

   Access control: deciding what you may do

   1. Access control
   2. Subjects, objects and the reference monitor
   3. The access matrix, ACLs and capabilities
   4. DAC, MAC, RBAC and ABAC
   5. RBAC and ABAC at work
9. Unit 9 · Week 9

   Malware: software that works against you

   1. Malware
   2. Viruses, worms and trojans
   3. Malware payloads
   4. Signature and behaviour detection
   5. Payloads, detection and countermeasures
10. Unit 10 · Week 10

    Software security: programs that trust the wrong input

    1. Software security
    2. Trust boundaries and input validation
    3. Injection: when data becomes a command
    4. Buffer overflow as a broken trust boundary
    5. Defences against buffer overflow
11. Unit 11 · Week 11

    Network security as a black box

    1. Network security
    2. Firewalls and default deny
    3. Stateful inspection
    4. IDS and IPS
    5. TLS, VPNs and Zero Trust
    6. Zero Trust: checking every request
12. Unit 12 · Week 12

    Policy: the organisation's written rules

    1. Security policy
    2. Policy, standard, guideline, procedure
    3. EISP, ISSP and SysSP
    4. Asset identification, acceptable use and types of control
    5. Types of control: kind and timing
13. Unit 13 · Week 13

    Risk method: doing the picture from Week 4

    1. Risk assessment
    2. Assets, threats and vulnerabilities
    3. Scoring a scenario
    4. Treating risk: avoid, mitigate, transfer, accept
    5. The risk register: before and after controls
14. Unit 14 · Weeks 14–15

    Law, ethics and privacy

    1. Law and ethics in security
    2. Cybercrime, jurisdiction and evidence
    3. Digital evidence and the chain of custody
    4. PECA 2016 and responsible disclosure
    5. Ethics and privacy
    6. Privacy principles in practice
15. Unit 15 · Week 16

    One case: the whole vocabulary used once

    1. Incident response
    2. Responding to a phishing incident
    3. Reading a breach with the course vocabulary
    4. A breach timeline and the controls that break it