[major=IA | course_id=IAP301 | syllabus_id=11198 | semester=7 | combo=core | title=Policy Development in Information Assurance]
Course ID: IAP301
Title EN: Policy Development in Information Assurance
Title VI: Phát triển chính sách an toàn thông tin
Credits: 3.0
Prerequisites: IAA202
Description: This course delivers a logical sequence of discussions about major concepts and issues related to information assurance policy implementation. Organizational objectives,, threats, risk mitigation and cost-benefit analysis will be explored. The student will utilize industry accepted methodologies to create practical security policy that will communicate the organization’s asset protection objectives.
Student tasks: - Students must attend at least 80% of contact sessions in order to be accepted to the final examination.
- Students are responsible to do all exercises, assignments and labs given by instructor in class or at home and submit in time
- Use laptop in class only for learning purpose
- Promptly access to the FPTU LMS at https://flm.fpt.edu.vn/
Tools: Internet access, MS Office 2007 or higher, Adobe PDF reader.
Course type: traditional
Decision: 358/QĐ-ĐHFPT dated 04/03/2024
Approved date: 2024-04-03
CLO1: Identify the role of an ISS (Information Systems Security) policy framework in overcoming business challenges.
[1] category=Group Presentation; type=on-going; weight=20.0; duration=Option 1: 15’-20’/each Option 2 (For Constructivism Approach only): Follow lecturer's proposal; question_type=; grading_guide=; completion_criteria=; clos=>0
[2] category=Lab; type=on-going; weight=30.0; duration=Option 1: 60-90' Option 2 (For Constructivism Approach only): Follow lecturer's proposal; question_type=; grading_guide=technical aspect of studied topics; completion_criteria=; clos=4
[3] category=Midterm Progress Test; type=on-going; weight=10.0; duration=Option 1: 30'-40' Option 2 (For Constructivism Approach only): Follow lecturer's proposal; question_type=; grading_guide=cover Lectures 1-5; completion_criteria=; clos=>0
[4] category=Participation in Discussions; type=on-going; weight=10.0; duration=; question_type=; grading_guide=; completion_criteria=; clos=>0
[5] category=Final Exam; type=Final exam; weight=30.0; duration=60'; question_type=LO1, LO2, LO3, LO4, LO5, LO6, LO7, LO8, LO9, LO10; grading_guide=concepts, algorithms;
all studied Chapters; completion_criteria=; clos=4
[1] desc=Security Policies and Implementation Issues
(online: http://library.books24x7.com/toc.aspx?bookid=69823); author=Rob Johnson; publisher=Jones and Bartlett Learnin; edition=2nd; isbn=9781284055993; main=True; online=True; note=
[2] desc=https://jblcourses.com/moodle/course_01.html,
https://is4550at077.foliotek.me/home; author=; publisher=; edition=; isbn=; main=; online=True; note=
[3] desc=Computer Security Handbook; author=Seymour Bosworth, M.E. Kabay, Eric Whyne; publisher=John Wiley & Sons; edition=6th; isbn=; main=; online=; note=
[4] desc=Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations; author=Ron Ross, Patrick Viscuso, Gary Guissanie, Kelley Dempsey, Mark Riddle; publisher=NIST Special Publication; edition=; isbn=; main=; online=; note=
[5] desc=Information Security Policy Development for Compliance: ISO/IEC 27001, NIST SP 800-53, HIPAA Standard, PCI DSS V2.0, and AUP V5.0; author=Barry L. Williams; publisher=CRC Press; edition=; isbn=; main=; online=; note=
Session 1: Lecture 1. Information Assurance Policy Management
- ISS and information assurance in organizations
- ISS policies and their importance in organizations
- Four information security controls
Topic: Offline; Teaching type: LO1; LO: T
ITU: Syllabus
Chapters 1, 2, 3
Slide and Lecture Note
Labs Requirement
Materials: mat1
Download: Explain Labs, Assignment and Group Presentation Requirements
Read Chapters 1-3
Study and Review Lecture 1

Session 2: Lecture 1. Information Assurance Policy Management (cont)
- Business drivers that create the need for ISS policy framework
- U.S. compliancy laws and industry standards
Topic: Offline; Teaching type: LO1; LO: T
ITU: Syllabus
Chapters 1, 2, 3
Slide and Lecture Note
Labs Requirement
Materials: mat2
Download: Explain Labs, Assignment and Group Presentation Requirements
Read Chapters 1-3
Study and Review Lecture 1

Session 3: Discussion 1: Importance of Security Policies
Topic: Offline; Teaching type: LO1; LO: U
ITU: Slide and Lecture Note
Internet Resources
Materials: mat3
Download: Discuss themes for the Group Presentation
Review Assignment

Session 4: Assignment 1: Security Policies Overcoming Business Challenges
Topic: Offline; Teaching type: LO1; LO: U
ITU: Slide and Lecture Note
Internet Resources
Materials: mat4
Download: Discuss themes for the Group Presentation
Review Assignment
CLO10: Describe the different issues related to defining, tracking, monitoring, reporting, automating, and organizing compliance systems and emerging technologies.
Session 1: Lab 1: Craft an Organization-Wide Security Management Policy for Acceptable Use
Topic: Offline; Teaching type: LO1; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 1

Session 2: Lab 1: Craft an Organization-Wide Security Management Policy for Acceptable Use (cont)
Topic: Offline; Teaching type: LO1; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 2

Session 3: Lecture 2. Risk Mitigation and Business Support Processes
- Business challenges in each IT domain
- Risk mitigation in seven IT domains
- Organizational hurdles to policy implementation
Topic: Offline; Teaching type: LO2; LO: T
ITU: Chapters 4, 5
Slide and Lecture Note
Download: Read Chapters 4-5
Study and Review Lecture 2

Session 4: Lecture 2. Risk Mitigation and Business Support Processes
- Policy implementation issues related to humans in the workplace
- Executive management
Topic: Offline; Teaching type: LO2; LO: T
ITU: Chapters 4, 5
Slide and Lecture Note
Download: Read Chapters 4-5
Study and Review Lecture 3
CLO2: Analyze how security policies help mitigate risks and support business processes in various domains in the IT infrastructure.
Session 1: Discussion 2: Risk Mitigation
Topic: Offline; Teaching type: LO2; LO: U
ITU: Slide and Lecture Note
Internet Resources
Download: Discuss and form Teams with Leaders for the Presentation
Review Assignment

Session 2: Assignment 2: Good Policy Implementation
Topic: Offline; Teaching type: LO2; LO: U
ITU: Slide and Lecture Note
Internet Resources
Download: Discuss and form Teams with Leaders for the Presentation
Review Assignment

Session 3: Assignment 2: Good Policy Implementation (cont)
Topic: Offline; Teaching type: LO2; LO: U
ITU: Slide and Lecture Note
Internet Resources
Download: Discuss and form Teams with Leaders for the Presentation
Review Assignment

Session 4: Assigned Reading (or a Guest Speaker): - How will Brexit affect the cyber-security industry in UK and Europe?
- The Social Dilemma of Self-Driving Cars
- ISO/IEC27001 for Mobile Devices, Access Controls
Topic: Offline; Teaching type: LO2; LO: U
ITU: Slide and Lecture Note
Internet Resources
Download: Discuss and form Teams with Leaders for the Presentation
Review Assignment
CLO3: Describe the components and basic requirements for creating a security policy framework.
Session 1: Lab 2: Develop an Organization-Wide Policy Framework Implementation Plan
Topic: Offline; Teaching type: LO2; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 2

Session 2: Lab 2: Develop an Organization-Wide Policy Framework Implementation Plan (cont)
Topic: Offline; Teaching type: LO2; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 3

Session 3: Lecture 3. Policies, Standards, Procedures, and Guidelines
- Key building blocks of security policy framework
- Types of documents for a security policy framework
Topic: Offline; Teaching type: LO3; LO: T
ITU: Chapters 6, 7, ref.[3]
Slide and Lecture Note
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapters 6, 7, ref.[3]Study and Review Lecture 3

Session 4: Lecture 3. Policies, Standards, Procedures, and Guidelines
- Information systems security (ISS) and information assurance considerations
- Process to create a security policy framework
- Best practices for policy management and maintenance
Topic: Offline; Teaching type: LO3; LO: T
ITU: Chapters 6, 7, ref.[3]
Slide and Lecture Note
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapters 6, 7, ref.[3]Study and Review Lecture 4
CLO4: Describe the different methods, roles, responsibilities, and accountabilities of personnel, along with the governance and compliance of security policy framework.
Session 1: Discussion 3: Business Considerations
Topic: Offline; Teaching type: LO3; LO: U
ITU: Slide and Lecture Note
Internet Resources
Download: Review Assignment

Session 2: Assignment 3: Security Policy Frameworks
Topic: Offline; Teaching type: LO3; LO: U
ITU: Slide and Lecture Note
Internet Resources
Download: Review Assignment

Session 3: Lab 3: Define an Information Systems Security Policy Framework for an IT Infrastructure
Topic: Offline; Teaching type: LO3; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 3

Session 4: Lab 3: Define an Information Systems Security Policy Framework for an IT Infrastructure
Topic: Offline; Teaching type: LO3; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 4
CLO5: Describe the different ISS policies associated with the User Domain.
Session 1: Lecture 4. Information Systems Security Policy Framework
- Different methods and best practices for approaching a security policy framework
- Importance of defining roles, responsibilities, and accountability for personnel
Topic: Offline; Teaching type: LO4; LO: T
ITU: Chapter 8 and ref.[3]
Slide and Lecture Note
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapter 8 and ref.[3]Study and Review Lecture 4

Session 2: Lecture 4. Information Systems Security Policy Framework
- Separation of duties (SOD)
- Importance of governance and compliance
Topic: Offline; Teaching type: LO4; LO: T
ITU: Chapter 8 and ref.[3]
Slide and Lecture Note
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapter 8 and ref.[3]Study and Review Lecture 5

Session 3: Discussion 4: Separation of Duties (SOD)
Topic: Offline; Teaching type: LO4; LO: U
ITU: Slide and Lecture Note
Internet Resources
Download: Review Assignment

Session 4: Assignment 4: Security Policy Creation
Topic: Offline; Teaching type: LO4; LO: U
ITU: Slide and Lecture Note
Internet Resources
Download: Review Assignment
CLO6: Describe the different ISS policies associated with the IT infrastructure.
Session 1: Lab 4: Craft a Layered Security Management Policy - Separation of Duties
Topic: Offline; Teaching type: LO4; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 4

Session 2: Lab 4: Craft a Layered Security Management Policy - Separation of Duties (cont)
Topic: Offline; Teaching type: LO4; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 5

Session 3: Lecture 5. User Policies
- Reasons for governing users with policies
Regular and privileged users
- Acceptable use policy (AUP) and privileged-level access agreement (PAA)
Topic: Offline; Teaching type: LO5; LO: T
ITU: Chapter 9 and ref.[3]
Slide and Lecture Note
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapter 9 and ref.[3]Study and Review Lecture 5

Session 4: Lecture 5. User Policies
- Security awareness policy (SAP)
Differences between public and private user domain policies
Topic: Offline; Teaching type: LO5; LO: T
ITU: Chapter 9 and ref.[3]
Slide and Lecture Note
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapter 9 and ref.[3]Study and Review Lecture 6
CLO7: Describe the different ISS policies associated with risk management.
Session 1: Discussion 5: Best Practices for User Policies
Topic: Offline; Teaching type: LO5; LO: U
ITU: Slide and Lecture Note
Internet Resources
Download: Discuss and choose themes for the Group Presentation
Review Assignment

Session 2: Assignment 5: Create User Policy
Assigned Reading: - Ultrasound theft results in data breach at health care company Kaiser Permanente, Second Circuit rules in favor of Microsoft, gov't can't force access to email on Irish server (SC Magazine, July 2016)
- Office of Budget and Management: Federal Cybersecurity Workforce Strategy (July 2016)
Topic: Offline; Teaching type: LO5; LO: U
ITU: Slide and Lecture Note
Internet Resources
Download: Discuss and choose themes for the Group Presentation
Review Assignment

Session 3: Lab 5: Craft an Organization-Wide Security Awareness Policy
Topic: Offline; Teaching type: LO5; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 5

Session 4: Lab 5: Craft an Organization-Wide Security Awareness Policy (cont)
Topic: Offline; Teaching type: LO5; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 6
CLO8: Describe the different ISS policies associated with IRTs (Incident Response Teams).
Session 1: Review for Midterm
Topic: Offline; Teaching type: LO1, LO2, LO3, LO4, LO5; LO: U
ITU: Slides and Lecture 1-5 Notes
Progress Test Guide

Session 2: Midterm Progress Test
Topic: Offline; Teaching type: LO1, LO2, LO3, LO4, LO5; LO: U
ITU: Slides and Lecture 1-5 Notes
Progress Test Guide

Session 3: Lecture 6. IT Infrastructure Security Policies
- Policies unique to the workstation domain
- Policies associated with local area network (LAN) and wide area network (WAN) domains
Topic: Offline; Teaching type: LO6; LO: T
ITU: Chapter 10 and ref.[3]
Slide and Lecture Note
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapter 10 and ref.[3]Study and Review Lecture 6

Session 4: Lecture 6. IT Infrastructure Security Policies
- Policies related to telecommunications
- Policies specific to remote access, systems, and applications
- Differences between public and private IT infrastructure security policies
Topic: Offline; Teaching type: LO6; LO: T
ITU: Chapter 10 and ref.[3]
Slide and Lecture Note
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapter 10 and ref.[3]Study and Review Lecture 7
CLO9: Describe different issues related to implementing and enforcing ISS policies.
Session 1: Discussion 6: IT Infrastructure Security Policies
Topic: Offline; Teaching type: LO6; LO: U
ITU: Slide and Lecture Note
Internet Resources
Download: Review Assignment
Prepare for the Group Presentation

Session 2: Assignment 6: IT Infrastructure Policies
Assigned Reading: Cyber Attack on Ukrainian Power Grid
Topic: Offline; Teaching type: LO6; LO: U
ITU: Slide and Lecture Note
Internet Resources
Download: Review Assignment
Prepare for the Group Presentation

Session 3: Lab 6: Define a Remote Access Policy to Support Remote Healthcare Clinics
Topic: Offline; Teaching type: LO6; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 6

Session 4: Lab 6: Define a Remote Access Policy to Support Remote Healthcare Clinics (cont)
Topic: Offline; Teaching type: LO6; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 7
Session 1: Lecture 7. IA Policies Associated with Risk Management
Discussion 7: Fear of Hacking Survey
Topic: Offline; Teaching type: LO7; LO: TU
ITU: Chapter 11 and ref.[3]
Slide and Lecture Note
Internet Resources
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapter 11 and ref.[3]Study and Review Lecture 7Review AssignmentPrepare for the Group Presentation

Session 2: Assignment 7: Risk Management in a Business Model
Topic: Offline; Teaching type: LO7; LO: TU
ITU: Chapter 11 and ref.[3]
Slide and Lecture Note
Internet Resources
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapter 11 and ref.[3]Study and Review Lecture 7Review AssignmentPrepare for the Group Presentation

Session 3: Lab 7: Identify Necessary Policies for Business Continuity – BIA & Recovery Time Objectives, Focusing on Three Additional Security Requirements Identified in ref.[3]:
Incident Response (3.6), Risk Assessment (3.11), Security Assessment (3.12)
Topic: Offline; Teaching type: LO7; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 7

Session 4: Lab 7: Identify Necessary Policies for Business Continuity – BIA & Recovery Time Objectives, Focusing on Three Additional Security (cont) Requirements Identified in ref.[3]:
Incident Response (3.6), Risk Assessment (3.11), Security Assessment (3.12)
Topic: Offline; Teaching type: LO7; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 8
Session 1: Lecture 8. Incident Response Team Policies
Discussion 8: Support Services
Topic: Offline; Teaching type: LO8; LO: TU
ITU: Chapter 12 and ref.[3]
Slide and Lecture Note
Internet Resources
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapter 12 and ref.[3]Study and Review Lecture 8Review AssignmentPrepare for the Group Presentation

Session 2: Assigned Reading: - Illinois hospital chain to pay record $5.5M for exposing data about millions of patients
- Famed hacker creates new ratings system for software
Topic: Offline; Teaching type: LO8; LO: TU
ITU: Chapter 12 and ref.[3]
Slide and Lecture Note
Internet Resources
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapter 12 and ref.[3]Study and Review Lecture 8Review AssignmentPrepare for the Group Presentation

Session 3: Lab 8: Craft a Security or Computer Incident Response Policy – CIRT Response Team
Topic: Offline; Teaching type: LO8; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 8

Session 4: Lab 8: Craft a Security or Computer Incident Response Policy – CIRT Response Team (cont)
Topic: Offline; Teaching type: LO8; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 9
Session 1: Lecture 9. Implementing and Maintaining an IT Security Policy Framework
Discussion 9: Information Dissemination - How to Educate Employees
Topic: Offline; Teaching type: LO9; LO: TU
ITU: Chapters 13, 14 and ref.[3]
Slide and Lecture Note
Internet Resources
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapters 13, 14 and ref.[3]Study and Review Lecture 9Review AssignmentPrepare for the Group Presentation

Session 2: Assignment 9: Policy Monitoring and Enforcement Strategy
Topic: Offline; Teaching type: LO9; LO: TU
ITU: Chapters 13, 14 and ref.[3]
Slide and Lecture Note
Internet Resources
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapters 13, 14 and ref.[3]Study and Review Lecture 9Review AssignmentPrepare for the Group Presentation

Session 3: Lab 9: Assess and Audit an Existing IT Security Policy Framework Definition
Topic: Offline; Teaching type: LO9; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 9

Session 4: Lab 9: Assess and Audit an Existing IT Security Policy Framework Definition (cont)
Topic: Offline; Teaching type: LO9; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 10
Session 1: Lecture 10. Automated Policy Compliance Systems
Discussion 10: Tracking, Monitoring, and Reporting
Topic: Offline; Teaching type: LO10; LO: TU
ITU: Chapter 15, ref.[3]
Slide and Lecture Note
Internet Resources
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapter 15, ref.[3]Study, Review Lecture 10Review AssignmentFinalize Materials for the Group Presentation

Session 2: Assignment 10: Automated Policy Compliance Systems (Software Evaluation Criteria spreadsheet)
Assigned Reading: Ransomware as a service business booming and growing, Settlement expected for 50M Home Depot customers (SC Magazine, Aug. 2016)
Topic: Offline; Teaching type: LO10; LO: TU
ITU: Chapter 15, ref.[3]
Slide and Lecture Note
Internet Resources
Download: https://flm.fpt.edu.vn/gui/role/student/Read Chapter 15, ref.[3]Study, Review Lecture 10Review AssignmentFinalize Materials for the Group Presentation

Session 3: Lab 10: Align an IT Security Policy Framework to the 7 Domains of a Typical IT Infrastructure
Topic: Offline; Teaching type: LO10; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 10

Session 4: Lab 10: Align an IT Security Policy Framework to the 7 Domains of a Typical IT Infrastructure (cont)
Topic: Offline; Teaching type: LO10; LO: U
ITU: Slide and Lecture Note
Lab Manual
Download: Practice and Review Lab 11
Session 1: Group Assignment Presentation: a Topic Chosen among 10 Discussions and Assignments
Topic: Offline; Teaching type: LO1, LO2, LO3, LO4, LO5, LO6, LO7, LO8, LO9, LO10; LO: U
ITU: Group Presentation Materials
Download: Team-present the chosen topic

Session 2: Group Assignment Presentation: a Topic Chosen among 10 Discussions and Assignments (cont)
Topic: Offline; Teaching type: LO1, LO2, LO3, LO4, LO5, LO6, LO7, LO8, LO9, LO10; LO: U
ITU: Group Presentation Materials
Download: Team-present the chosen topic

Session 3: Course Review
Topic: Offline; Teaching type: LO1, LO2, LO3, LO4, LO5, LO6, LO7, LO8, LO9, LO10; LO: U
ITU: All Slides and Lecture Notes
Download: Review the course

Session 4: Course Review (cont)
Topic: Offline; Teaching type: LO1, LO2, LO3, LO4, LO5, LO6, LO7, LO8, LO9, LO10; LO: U
ITU: All Slides and Lecture Notes
Download: Review the course