Computer Science (COMP) 660

Overview

In this course, students will study various security issues associated with the development and deployment of information systems, including Internet-based e-commerce, e-business, and e-service systems, as well as the technologies required to develop secure information systems for enterprises. Students will also learn about the policies and regulations essential to the security of enterprise information systems.

Outline

Unit 1: Introduction to Enterprise Information Security

• This unit provides an overview of general security concepts, terminologies, issues, and some technical background such as computer networks and security models. After this unit, students should understand the concept of information security and the information security risks an enterprise may face, and be able to explain important concepts and terminologies related to enterprise information security.

Unit 2: Cryptography and Cryptology

• Cryptography is about encryption and decryption. It sits at the centre of information security, and can be used for different purposes. In this unit, students will study both symmetric and asymmetric cryptography, including public key cryptography, data encryption standard (DES), international data encryption algorithm (IDEA), advanced encryption standard (AES), as well as algorithms for hashes and message digests. The focus will be on both the principles and the mechanisms of operation. After this unit, students should be able to describe the principles and features of some classical and modern cryptographic systems and algorithms. Students should also be able to choose the correct cryptographic scheme when needed.

Unit 3: Authentication and Access Control

• Information security means protecting information resources from unauthorized access while keeping them available to authorized users. To achieve this essential goal of information security, we must first authenticate users, and then authorize their rights of access to specific resources. In this unit, students will learn the meaning of authentication, how various authentication schemes work, and how access to information resources can be controlled in various access control models. After this unit, students should be able to explain how various authentication schemes work, as well as their strengths and weaknesses. Students should also be able to choose an appropriate authentication scheme for a given application.

Unit 4: Security Standards, Protocols and Systems

• In a networked environment (like the Internet), certain security goals can only be achieved through the collaboration of clients and servers. These computers collaborate by following certain standards and protocols, with the assistance of security systems. In this unit, students will learn about some well-known security systems, standards, and protocols: the Kerberos protocol; public key infrastructure (PKI); and security protocols for different network layers, particularly secure IP protocol (IPSec), Secure Socket Layer (SSL), and transport layer security (TLS). Protocols specially designed for e-commerce will also be covered, as will firewalls and VPNs that can be used to achieve certain security goals. After this unit, you should be able to describe some well-known security standards, explain how some well-known security protocols and systems work and how they are used, and interpret new security protocols when you encounter them.

Unit 5: Systems Security

• Today’s enterprises are heavily dependent on many types of computer-based systems, which store or transmit their information assets. The security of such systems is essential and critical to enterprises. In this unit, students will study security issues, and the technological requirements of systems commonly deployed and used by enterprises. After this unit, students should be able to explain the principle of firewalls. Students should also be able to describe the main security features of some well-known systems, as well as their weaknesses.

Unit 6: Information Security Management

• Securing the information asset of an enterprise can be very technical and costly; however, even with all the technologies, systems, and personnel in place, the security of an enterprise’s information assets cannot be guaranteed if the technologies and systems are not used properly, or the personnel is poorly trained. In this unit, students will study various management issues, technologies, and systems related to information security management at enterprises.

Learning Outcomes

After successfully completing this course, students should be able to

• Explain various security issues associated with the development and deployment of information systems, including internet-based e-commerce, e-business and e-service systems.
• Explain and use essential technologies such as algorithms and protocols for encryption/decryption, authentication, and key management required in developing secure information systems for enterprises.
• Explain and use some important tools, systems policies, and regulations that are necessary for ensuring the security of enterprise information systems.
• Analyze, design, and implement security protocols, policies, tools, and systems to achieve certain security goals.
• Identify research problems related to computer, network, and information security and conduct research and write publishable technical papers.

Evaluation

To receive credit for COMP 660, you must achieve a cumulative course grade of B- (70 percent) or better, and must achieve an average grade of at least 60% on the assignments and 60% on the final examination. Your cumulative course grade will be based on the following assessment.