Policy Development in Information Assurance (IAP301)
Vietnamese title: Phát triển chính sách an toàn thông tin
Credits: 3
Prerequisites: IAA202

Description:
This course delivers a logical sequence of discussions about major concepts and issues related to information assurance policy implementation. Organizational objectives,, threats, risk mitigation and cost-benefit analysis will be explored. The student will utilize industry accepted methodologies to create practical security policy that will communicate the organization’s asset protection objectives.

Learning outcomes:
Identify the role of an ISS (Information Systems Security) policy framework in overcoming business challenges.
Describe the different issues related to defining, tracking, monitoring, reporting, automating, and organizing compliance systems and emerging technologies.
Analyze how security policies help mitigate risks and support business processes in various domains in the IT infrastructure.
Describe the components and basic requirements for creating a security policy framework.
Describe the different methods, roles, responsibilities, and accountabilities of personnel, along with the governance and compliance of security policy framework.
Describe the different ISS policies associated with the User Domain.
Describe the different ISS policies associated with the IT infrastructure.
Describe the different ISS policies associated with risk management.
Describe the different ISS policies associated with IRTs (Incident Response Teams).
Describe different issues related to implementing and enforcing ISS policies.

Student tasks:
- Students must attend at least 80% of contact sessions in order to be accepted to the final examination.
- Students are responsible to do all exercises, assignments and labs given by instructor in class or at home and submit in time
- Use laptop in class only for learning purpose
- Promptly access to the FPTU LMS at https://flm.fpt.edu.vn/

Tools:
Internet access, MS Office 2007 or higher, Adobe PDF reader.

Materials:
description: Security Policies and Implementation Issues
(online: http://library.books24x7.com/toc.aspx?bookid=69823)
author: Rob Johnson
publisher: Jones and Bartlett Learnin
published_date: 2015
edition: 2nd
isbn: 9781284055993
description: https://jblcourses.com/moodle/course_01.html,
https://is4550at077.foliotek.me/home
description: Computer Security Handbook
author: Seymour Bosworth, M.E. Kabay, Eric Whyne
publisher: John Wiley & Sons
published_date: 2014
edition: 6th
description: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
author: Ron Ross, Patrick Viscuso, Gary Guissanie, Kelley Dempsey, Mark Riddle
publisher: NIST Special Publication
published_date: 2016
description: Information Security Policy Development for Compliance: ISO/IEC 27001, NIST SP 800-53, HIPAA Standard, PCI DSS V2.0, and AUP V5.0
author: Barry L. Williams
publisher: CRC Press
published_date: 2013

Assessments:
category: Group Presentation
type: on-going
weight: 20.0
duration: Option 1: 15’-20’/each Option 2 (For Constructivism Approach only): Follow lecturer's proposal
no_question: Option 1: practical exercise Option 2 (For Constructivism Approach only): Follow lecturer's proposal
knowledge_and_skill: Option 1: N/A; Option 2 (For Constructivism Approach only): Follow lecturer's proposal
note: Team-present a topic chosen among 10 Discussions and Assignments
category: Lab
type: on-going
weight: 30.0
duration: Option 1: 60-90' Option 2 (For Constructivism Approach only): Follow lecturer's proposal
no_question: Option 1: practical exercises Option 2 (For Constructivism Approach only): Follow lecturer's proposal
knowledge_and_skill: Option 1: N/A; Option 2 (For Constructivism Approach only): Follow lecturer's proposal
grading_guide: technical aspect of studied topics
note: Guided by instructor
- 10 Labs are arranged relevant to the chapter theory
- Student must finish labs and submit the results to the lecturer in class.
- An average point of all labs could be evaluated and published to students at the end of the semester
category: Midterm Progress Test
type: on-going
weight: 10.0
duration: Option 1: 30'-40' Option 2 (For Constructivism Approach only): Follow lecturer's proposal
no_question: Option 1: Multiple choices Option 2 (For Constructivism Approach only): Follow lecturer's proposal
knowledge_and_skill: Option 1: 20-25 Option 2 (For Constructivism Approach only): Follow lecturer's proposal
grading_guide: cover Lectures 1-5
note: in class, by instructor
category: Participation in Discussions
type: on-going
weight: 10.0
category: Final Exam
type: Final exam
weight: 30.0
duration: 60'
question_type: LO1, LO2, LO3, LO4, LO5, LO6, LO7, LO8, LO9, LO10
no_question: Multiple choices
Marked by Computer
knowledge_and_skill: 40-50
grading_guide: concepts, algorithms;
all studied Chapters
note: by exam board,
using computer

Schedule:
session: Lecture 1. Information Assurance Policy Management
- ISS and information assurance in organizations
- ISS policies and their importance in organizations
- Four information security controls
learning_outcomes: T
materials: mat1
session: Lecture 1. Information Assurance Policy Management (cont)
- Business drivers that create the need for ISS policy framework
- U.S. compliancy laws and industry standards
learning_outcomes: T
materials: mat2
session: Discussion 1: Importance of Security Policies
learning_outcomes: U
materials: mat3
session: Assignment 1: Security Policies Overcoming Business Challenges
learning_outcomes: U
materials: mat4
session: Lab 1: Craft an Organization-Wide Security Management Policy for Acceptable Use
learning_outcomes: U
session: Lab 1: Craft an Organization-Wide Security Management Policy for Acceptable Use (cont)
learning_outcomes: U
session: Lecture 2. Risk Mitigation and Business Support Processes
- Business challenges in each IT domain
- Risk mitigation in seven IT domains
- Organizational hurdles to policy implementation
learning_outcomes: T
session: Lecture 2. Risk Mitigation and Business Support Processes
- Policy implementation issues related to humans in the workplace
- Executive management
learning_outcomes: T
session: Discussion 2: Risk Mitigation
learning_outcomes: U
session: Assignment 2: Good Policy Implementation
learning_outcomes: U
session: Assignment 2: Good Policy Implementation (cont)
learning_outcomes: U
session: Assigned Reading (or a Guest Speaker): - How will Brexit affect the cyber-security industry in UK and Europe?
- The Social Dilemma of Self-Driving Cars
- ISO/IEC27001 for Mobile Devices, Access Controls
learning_outcomes: U
session: Lab 2: Develop an Organization-Wide Policy Framework Implementation Plan
learning_outcomes: U
session: Lab 2: Develop an Organization-Wide Policy Framework Implementation Plan (cont)
learning_outcomes: U
session: Lecture 3. Policies, Standards, Procedures, and Guidelines
- Key building blocks of security policy framework
- Types of documents for a security policy framework
learning_outcomes: T
session: Lecture 3. Policies, Standards, Procedures, and Guidelines
- Information systems security (ISS) and information assurance considerations
- Process to create a security policy framework
- Best practices for policy management and maintenance
learning_outcomes: T
session: Discussion 3: Business Considerations
learning_outcomes: U
session: Assignment 3: Security Policy Frameworks
learning_outcomes: U
session: Lab 3: Define an Information Systems Security Policy Framework for an IT Infrastructure
learning_outcomes: U
session: Lab 3: Define an Information Systems Security Policy Framework for an IT Infrastructure
learning_outcomes: U
session: Lecture 4. Information Systems Security Policy Framework
- Different methods and best practices for approaching a security policy framework
- Importance of defining roles, responsibilities, and accountability for personnel
learning_outcomes: T
session: Lecture 4. Information Systems Security Policy Framework
- Separation of duties (SOD)
- Importance of governance and compliance
learning_outcomes: T
session: Discussion 4: Separation of Duties (SOD)
learning_outcomes: U
session: Assignment 4: Security Policy Creation
learning_outcomes: U
session: Lab 4: Craft a Layered Security Management Policy - Separation of Duties
learning_outcomes: U
session: Lab 4: Craft a Layered Security Management Policy - Separation of Duties (cont)
learning_outcomes: U
session: Lecture 5. User Policies
- Reasons for governing users with policies
Regular and privileged users
- Acceptable use policy (AUP) and privileged-level access agreement (PAA)
learning_outcomes: T
session: Lecture 5. User Policies
- Security awareness policy (SAP)
Differences between public and private user domain policies
learning_outcomes: T
session: Discussion 5: Best Practices for User Policies
learning_outcomes: U
session: Assignment 5: Create User Policy
Assigned Reading: - Ultrasound theft results in data breach at health care company Kaiser Permanente, Second Circuit rules in favor of Microsoft, gov't can't force access to email on Irish server (SC Magazine, July 2016)
- Office of Budget and Management: Federal Cybersecurity Workforce Strategy (July 2016)
learning_outcomes: U
session: Lab 5: Craft an Organization-Wide Security Awareness Policy
learning_outcomes: U
session: Lab 5: Craft an Organization-Wide Security Awareness Policy (cont)
learning_outcomes: U
session: Review for Midterm
learning_outcomes: U
session: Midterm Progress Test
learning_outcomes: U
session: Lecture 6. IT Infrastructure Security Policies
- Policies unique to the workstation domain
- Policies associated with local area network (LAN) and wide area network (WAN) domains
learning_outcomes: T
session: Lecture 6. IT Infrastructure Security Policies
- Policies related to telecommunications
- Policies specific to remote access, systems, and applications
- Differences between public and private IT infrastructure security policies
learning_outcomes: T
session: Discussion 6: IT Infrastructure Security Policies
learning_outcomes: U
session: Assignment 6: IT Infrastructure Policies
Assigned Reading: Cyber Attack on Ukrainian Power Grid
learning_outcomes: U
session: Lab 6: Define a Remote Access Policy to Support Remote Healthcare Clinics
learning_outcomes: U
session: Lab 6: Define a Remote Access Policy to Support Remote Healthcare Clinics (cont)
learning_outcomes: U
session: Lecture 7. IA Policies Associated with Risk Management
Discussion 7: Fear of Hacking Survey
learning_outcomes: TU
session: Assignment 7: Risk Management in a Business Model
learning_outcomes: TU
session: Lab 7: Identify Necessary Policies for Business Continuity – BIA & Recovery Time Objectives, Focusing on Three Additional Security Requirements Identified in ref.[3]:
Incident Response (3.6), Risk Assessment (3.11), Security Assessment (3.12)
learning_outcomes: U
session: Lab 7: Identify Necessary Policies for Business Continuity – BIA & Recovery Time Objectives, Focusing on Three Additional Security (cont) Requirements Identified in ref.[3]:
Incident Response (3.6), Risk Assessment (3.11), Security Assessment (3.12)
learning_outcomes: U
session: Lecture 8. Incident Response Team Policies
Discussion 8: Support Services
learning_outcomes: TU
session: Assigned Reading: - Illinois hospital chain to pay record $5.5M for exposing data about millions of patients
- Famed hacker creates new ratings system for software
learning_outcomes: TU
session: Lab 8: Craft a Security or Computer Incident Response Policy – CIRT Response Team
learning_outcomes: U
session: Lab 8: Craft a Security or Computer Incident Response Policy – CIRT Response Team (cont)
learning_outcomes: U
session: Lecture 9. Implementing and Maintaining an IT Security Policy Framework
Discussion 9: Information Dissemination - How to Educate Employees
learning_outcomes: TU
session: Assignment 9: Policy Monitoring and Enforcement Strategy
learning_outcomes: TU
session: Lab 9: Assess and Audit an Existing IT Security Policy Framework Definition
learning_outcomes: U
session: Lab 9: Assess and Audit an Existing IT Security Policy Framework Definition (cont)
learning_outcomes: U
session: Lecture 10. Automated Policy Compliance Systems
Discussion 10: Tracking, Monitoring, and Reporting
learning_outcomes: TU
session: Assignment 10: Automated Policy Compliance Systems (Software Evaluation Criteria spreadsheet)
Assigned Reading: Ransomware as a service business booming and growing, Settlement expected for 50M Home Depot customers (SC Magazine, Aug. 2016)
learning_outcomes: TU
session: Lab 10: Align an IT Security Policy Framework to the 7 Domains of a Typical IT Infrastructure
learning_outcomes: U
session: Lab 10: Align an IT Security Policy Framework to the 7 Domains of a Typical IT Infrastructure (cont)
learning_outcomes: U
session: Group Assignment Presentation: a Topic Chosen among 10 Discussions and Assignments
learning_outcomes: U
session: Group Assignment Presentation: a Topic Chosen among 10 Discussions and Assignments (cont)
learning_outcomes: U
session: Course Review
learning_outcomes: U
session: Course Review (cont)
learning_outcomes: U