Fundamentals of Information SecuritySillabus

Fənn kodu

IF-2203y

Kredit

6

Tələbənin iş yükü

129

Semestr

Payız semestri

Akademik il

1

Fənnin tipi

Məcburi

Təhsil forması

Əyani

Tədris dili

İngilis

Auditoriyadaxili saatlar

a) 30 hours – lectures; b) 15 hours – seminars; c) 15 hours – laboratory sessions

Auditoriyadan kənar saatlar

a) 80 hours – preparation for lectures, seminars and laboratory sessions; b) 30 hours – independent study; c) 10 hours – consultations

The course is designed to introduce students to the field of information security and to develop fundamental knowledge of its basic concepts, principles, objectives, and scope. The course covers information security threats, cyberattacks, malware, ethical hacking, and the main areas of information warfare. Students are introduced to information security risk and incident management, methods of ensuring security, and information security architectures. Organizational aspects of information security, standardization, certification, and auditing processes are among the key areas of the course. The course also provides an introduction to the fundamental concepts of cryptography, public-key cryptography, and digital signature schemes. The course aims to develop students' systematic thinking characteristic of information security professionals and to provide the foundational knowledge and skills required for their future professional activities.

• mühazirə
• laboratoriya işi
• seminar
• təqdimatlar
• komanda işi
• interaktiv müzakirə

1. 1

   CLO 1: Understand the essential concepts and terminology of information security, including terminology used in documentation and professional discussions. Understand the fundamentals of general and specific requirements in the field of information security and the principles underlying their development.

2. 2

   CLO 2: Understand the conceptual model of information security and demonstrate basic reasoning skills for formulating appropriate requirements to ensure information security.

3. 3

   CLO 3: Understand the key legal and regulatory acts governing information security, their requirements, and application procedures, and be able to monitor their development. Understand global, regional, and national regulations, standards, and best practices in information security, be able to follow their development, and have a general understanding of their application.

4. 4

   CLO 4: Understand the organizational forms and methods used to ensure information security. Understand the fundamental principles of information security and the basic technical methods and tools used to protect information.

5. 5

   CLO 5: Have general knowledge of information security risks, their characteristics, and risk management approaches. Understand the relevance, development, and implementation of information security policies, as well as the methods used to ensure their implementation. Have general knowledge of the fundamentals, characteristics, relevance, and procedures of information security auditing.

6. 6

   CLO 6: Have general knowledge of the legal, organizational, and technical foundations of information protection tools, their areas of application, and the principles of their development and certification in accordance with applicable requirements. Understand the procedures for recognizing foreign certificates issued for information protection tools.

1. 1.
   Fundamental Concepts of Information SecurityMühazirə

   This topic covers the concept, objectives, scope, and fundamental principles of information security. Fundamental concepts such as information and information assets, threats, vulnerabilities, risks, and security incidents are introduced. The principles of ensuring the confidentiality, integrity, and availability of information are examined. The relationship between information security and other fields, as well as the main areas of activity of information security professionals, are also discussed.

2. 2.
   Main Areas of Information WarfareMühazirə

   This topic covers the concept of information warfare, its objectives, key characteristics, and role in the modern information environment. The main areas, methods, and tools of information warfare are examined. The characteristics of information influence, disinformation, propaganda, and psychological operations are explained. Activities targeting information systems and information resources, as well as general principles of protection against such activities, are also examined.

3. 3.
   Cyberattack Process Model and the Concept of Ethical HackingMühazirə

   This topic covers the stages of cyberattacks and their process models. The main stages, including attack preparation, target identification, information gathering, vulnerability identification, and exploitation, are explained. The concept and objectives of ethical hacking and its role in assessing the security of information systems are examined. The legal and ethical boundaries of ethical hacking activities, as well as the key differences between cyberattacks and ethical hacking, are also discussed.

4. 4.
   Malware ThreatMühazirə

   This topic covers the concept of malware, its main characteristics, and the threats it poses to information systems. Major types of malware, including viruses, worms, Trojans, ransomware, spyware, and other malicious software, are examined. Malware propagation, system infiltration, and damage mechanisms are explained. The fundamental principles of detecting, preventing, and protecting against malware threats are also examined.

5. 5.
   Information Security Risk ManagementMühazirə

   This topic covers the concept of information security risk and the main stages of the risk management process. The identification of information assets, threats, and vulnerabilities, as well as the principles of assessing risks in terms of likelihood and impact, are explained. Key risk treatment approaches, including risk mitigation, acceptance, transfer, and avoidance, are examined. Continuous risk monitoring and reassessment in response to changes in the security environment are also discussed.

6. 6.
   Information Security Incident ManagementMühazirə

   This topic covers the concept of information security incidents and the main stages of the incident management process. The principles of detecting, recording, analyzing, and classifying security events are explained. Incident response, containment, eradication, and system recovery processes are examined. Lessons learned from security incidents and the identification of preventive measures to reduce the likelihood of similar incidents in the future are also discussed.

7. 7.
   Methods of Ensuring Information SecurityMühazirə

   This topic covers the main methods and approaches used to ensure information security. Organizational, technical, software-based, and legal security measures applied to protect information assets are examined. The characteristics and areas of application of preventive, detective, and corrective security measures are explained. The interaction between different security methods and their role in developing a comprehensive protection system are also examined.

8. 8.
   Information Security ArchitecturesMühazirə

   This topic covers the concept, objectives, and main components of information security architecture. The placement and interaction of security mechanisms at different levels of information systems are examined. Security approaches based on the principles of defense in depth, least privilege, and zero trust are explained. The role of security architectures in the comprehensive protection of information assets, systems, and networks is also examined.

9. 9.
   Organizational Aspects of Information SecurityMühazirə

   This topic covers the fundamental principles and organizational aspects of managing information security within organizations. The development and implementation of information security policies, procedures, and internal rules are examined. The assignment of security roles and responsibilities, employee awareness, and the development of a security culture are discussed. The management of information security within organizational structures and the coordination of security measures are also examined.

10. 10.
    Information Security Standards and CertificationMühazirə

    This topic covers major standards used in information security and the concept of certification. The role of standards in information security management and in defining security requirements is examined. The principles of assessing the conformity of information systems, security products, and management processes with established requirements are discussed. The objectives, main stages, and importance of certification in ensuring information security assurance are also examined.

11. 11.
    Information Security AuditingMühazirə

    This topic covers the concept, objectives, and fundamental principles of information security auditing. The assessment of information systems, security controls, policies, and procedures against established requirements is examined. The stages of the audit process, including planning, evidence collection, identification of deficiencies, and documentation of results, are explained. The improvement of security levels and identification of corrective measures based on audit findings are also discussed.

12. 12.
    Public-Key CryptographyMühazirə

    This topic covers the concept, operating principles, and role of public-key cryptography in information security. The generation of public and private keys, their relationship, and their use for different purposes are explained. Asymmetric encryption and decryption processes, as well as the application of public-key cryptography in secure key exchange, are examined. The role of public-key cryptography in ensuring data confidentiality, authenticity, and secure communication is also discussed.

13. 13.
    Digital Signature SchemesMühazirə

    This topic covers the concept of digital signatures and the principles of their generation and verification. The main components of digital signature schemes and their relationship with public-key cryptography are explained. The role of digital signatures in ensuring data authenticity and integrity, as well as non-repudiation, is examined. The application of digital signature schemes in electronic documents and secure digital communications is also discussed.

1. Imamverdiyev, Y.N. Fundamentals of Information Security – Lectures. 2022, 124 p. (electronic educational resource).
2. Aliquliyev, R.M., Imamverdiyev, Y.N. Information Security Incidents. Baku: “Information Technologies” Publishing House, 2012, 212 p.
3. Imamverdiyev, Y.N. Explanatory Dictionary of Information Security Terms. Baku: “Information Technologies” Publishing House, 2015, 160 p.
4. Diogenes, Y., Ozkaya, E. Cybersecurity – Attack and Defense Strategies. Packt Publishing, 2019, 356 p.
5. Stallings, W. Cryptography and Network Security: Principles and Practice, 7th Edition. Pearson, 2016, 768 p.
6. Kenyon, B. ISO 27001 Controls – A Guide to Implementing and Auditing. IT Governance Ltd., 2019, 180 p.