522 Information Security Essentials (3:3:0) Prerequisites: an introductory information systems class or permission of instructor. This course covers basic concepts and techniques in applied information security. The course begins introducing the student to basic concepts of security including confidentiality, integrity, availability, and current concerns of anonymity, privacy and safety of web-based transactions, forensics investigations etc. It also covers the main safeguards available in security such as authentication, authorizations, network security. The course shows how these techniques are applied to the concerns of business, health care, nursing, sociology and law. This course does not count for MS programs in the Computer Science Department.
562 Information Security Theory and Practice (3:3:0) Prerequisites: INFS 501, 515, 519, and SWE 510, or permission of instructor. This course is a technical introduction to the theory and practice of information security. It serves as the first security course for the MS-ISA degree, is required as a prerequisite for all subsequent ISA courses (at the 600 and 700 levels) and subsumes most topics covered by the CISSP examination. It also serves as an entry-level course available to non-ISA students, including MS-CS, MS-ISE, and MS-SWE students.
563 Fundamentals of Systems Programming (3:3:0) Prerequisites: An intermediate programming language course or permission of instructor. Introduces systems and network programming for UNIX and Windows using lectures and hands-on Labs. Covers ANSI C programming, system libraries and APIs, forking and threads, inter-process communications, synchronization, Windows API, and code debugging.
564 Security Laboratory (3:3:0) Prerequisites: ISA 562 and ISA 563 or permission of instructor. This course provides hands-on experience in configuring and experimenting with commodity-networked systems and security software in a live laboratory environment, with the purpose of understanding real-world security threats. This course will take both offensive and defensive approaches and expose students to a variety of real-world attacks, including viruses, worms, rootkits, and botnets. Possible mitigation and defending mechanisms, such as firewalls and intrusion detection software, will also be covered.
640 Programming Language Security (3:3:0) Prerequisites: CS 540 and ISA 562 or permission of instructor. This course describes language- based techniques to provide security for executing code. Topics include a discussion on the need for and the advantages of language-based security, security principles and properties, memory and type safety, encapsulation and access control, certifying compilers and their verification methods, security types and information flow, and applying programming language-inspired techniques to enforce security in the semantic-web based languages.
650 Security Policy (3:3:0) Prerequisites: ISA 562 or permission of instructor. The course focuses on security policy and its management for information systems having national and international connectivity. Issues include legal, international, cultural, and local factors. Students are expected to participate regularly in presenting material, in discussion of recent security issues, and by writing short papers on major current issues.
652 Security Audit and Compliance Testing (3:3:0) Prerequisites: ISA 562 or ISA 522 or permission of instructor. This course presents the fundamental concepts of the IT-security audit and control process that is being conducted in a plethora of environments, including government, financial industry, and healthcare industry. The goal of this course is to enable the students to structure and perform audits based on the specifications of Sarbanes-Oxley, HIPAA, and FISMA audit programs. The course covers all the CISA certification requirements in depth and the students completing the course are encouraged to attempt the certification exam on their own.
656 Network Security (3:3:0) Prerequisites: ISA 562 and CS 555 or permission of instructor. This course is an in-depth introduction to the theory and practice of network security. It assumes basic knowledge of cryptography and its applications in modern network protocols. The course studies firewalls architectures and virtual private networks and provides deep coverage of widely used network security protocols such as SSL, TLS, SSH, Kerberos, IPSec, IKE, and LDAP. It covers countermeasures to distributed denial of service attacks, security of routing protocols and the Domain Name System, e-mail security and spam countermeasures, wireless security, multicast security, and trust negotiation.
673 Operating Systems Security (3:3:0) Prerequisites: CS 571 and ISA 562 or permission of instructor. This course covers fundamentals and advanced topics in operating system (OS) security. They include OS-level security mechanisms and policies in investigating and defending against real-world attacks on computer systems, such as self-propagating worms and large-scale botnets. Basic OS security techniques, such as logging, system call auditing, and memory protection, will be discussed. Recent advanced techniques, such as honeypots and honeyfarms, system randomization, vulnerability fingerprinting, and virtualization, will also be introduced.
674 Intrusion Detection (3:3:0) Prerequisites: ISA 562 and 650 or permission of instructor. Studies methodologies, techniques, and tools for monitoring events in computer system or network, with the objective of preventing and detecting unwanted process activity and recovering from malicious behavior. Topics include types of threats, host-based and network-based information sources, vulnerability analysis, denial of service, deploying and managing intrusion detection systems, passive vs. active responses, and designing recovery solutions.
681 Secure Software Design (3:3:0) Prerequisite: SWE 619 or permission of instructor.Theory and practice of software security, focusing in particular on some common software security risks, including buffer overflows, race conditions and random number generation, and the identification of potential threats and vulnerabilities early in the design cycle. The emphasis is on methodologies and tools for identifying and eliminating security vulnerabilities, techniques to prove the absence of vulnerabilities, and ways to avoid security holes in new software and on essential guidelines for building secure software. Explores how to design software with security in mind from the ground up and integrate analysis and risk management throughout the software life cycle. This course is also cross-listed as SWE 781.
697 Topics in Information Security (3:3:0) Prerequisite: permission of instructor. Special topics in information security and assurance not occurring in regular ISA sequence. May be repeated for credit when distinct offerings of course differ in subject.
763 Security Protocol Analysis (3:3:0) Prerequisites: ISA 650 or permission of instructor. This course teaches how to design, understand, verify, and test communication protocols so that they meet their objectives of recognizing the basic components of a communication protocol; specifying security properties accurately; modeling actors and mal-actors against which a protocol ought to be secure; discussing verification and testing methods and their limitations by ensuring that the specified protocol satisfies stated security objectives in the presence of intended mal-actions; designing a medium-sized protocol that satisfies a specification of requirement; using existing tools to specify and verify security protocols; and testing protocols for satisfying their security objectives.
764 Security Experimentation (3:3:0) Prerequisite: ISA 562, ISA 564, ISA 674, or permission of instructor. This course teaches how to conduct security experimentations and how to empirically demonstrate, validate, and evaluate security vulnerabilities, exploits, and defense mechanisms. By the end of the course, students will gain a deeper understanding and first hand experience on capturing packets of interests from both wired and wireless networks, and replying interested network flows and how shellcode various buffer overflows attacks, worms, spyware, rootkits, botnets, anonymous communication and traceback mechanisms work.
765 Database and Distributed Systems Security (3:3:0) Prerequisites: INFS 614 and ISA 562, or permission of instructor. Science and study of methods of data protection: discretionary and mandatory access controls, secure database design, data integrity, secure architectures, secure transaction processing, information flow controls, inference controls, and auditing. Covers security models for relational and object-oriented databases; security of databases in distributed environments; statistical database security; and survey of commercial systems and research prototypes.
767 Secure Electronic Commerce (3:3:0) Prerequisites: ISA 562 and 656, or permission of instructor. Cryptography review, cryptographic protocols, secure electronic transactions, public key certificates and infrastructures, authentication and authorization certificates, secure credential services and role-based authorization, mobile code security, security of agent-based systems, electronic payment systems, intellectual property protection, secure time stamping and notarization.
785 Digital Forensics (3:3:0) Prerequisites: ISA 562, CS 571 and CS 555 or permission of instructor. This course provides an in depth introduction to the principles, techniques and tools in digital forensics. While it covers current established techniques, tools and practice of digital forensics, it focuses on the following fundamental aspects of digital forensics: (1) fundamental and practical limitations of current forensics techniques; (2) countermeasures against digital forensics; and (3) open problems in current digital forensics.
796 Directed Readings in Information Security (3:3:0) Prerequisite: graduate standing in information security and assurance, with at least 12 prior credits in MS. To register, students must complete independent study form, available in department office. It must be initialed by faculty sponsor and approved by department chair. Research and analysis of contemporary problem in information security. Prior approval required by faculty sponsor who supervises student’s work. Written report also required. Maximum 6 credits may be earned.
797 Advanced Topics in Information Security (3:3:0) Prerequisite: permission of instructor. Special advanced topics not occurring in regular ISA sequence. May be repeated for credit when distinct offerings of course differ in subject.
798 Research Project (3:3:0) Prerequisite: 18 credits applicable toward MS. To register, students must complete independent study form, available in department office. It must be initialed by faculty sponsor and approved by department chair. Research project chosen under guidance of full-time graduate faculty member, resulting in written technical report. Prior approval required by faculty sponsor who supervises student’s work.
799 Thesis (6:3:0) Prerequisite: 18 credits applicable toward MS or permission of instructor. To register, students must complete independent study form, available in department office. It must be initialed by faculty sponsor and approved by department chair. Original or expository work chosen and completed under supervision of graduate faculty member, which results in technical report accepted by three- member faculty committee. Report must be defended in oral presentation.