Fundamentals of information securitySyllabus

Subject code

İF-61403y

Credits

6

Student workload

120

Semester

Autumn semester

Academic year

1

Subject type

Mandatory

Form of education

Full-time

Language of instruction

Azerbaijani

In-class hours

a) 30 saat - mühazirə b) 15 saat - seminar c) 15 saat - laboratoriya

Out-of-class hours

a) 80 saat – mühazirə, seminar və laboratoriya dərslərinə hazırlıq b) 30 saat – sərbəst iş c) 10 saat – məsləhət

The subject involves introducing students to the specialty of information security and forming fundamental knowledge of the main concepts, principles, goals and scope of this field. within the subject, information security threats, cyber attacks, malicious programs, ethical hacking and the main directions of information warfare are studied. students are introduced to information security risk and incident management, security assurance methods, and information security architectures. organizational issues of information security, standardization, certification and audit processes are among the main directions of the subject. basic concepts of cryptography, public key cryptography and digital signature schemes are also introduced. the subject is aimed at forming in students the systematic way of thinking typical of an information security specialist and the initial knowledge and skills that will be used in future professional activities.

• lecture
• laboratory work
• seminar
• presentations
• teamwork
• interactive discussion

1. 1

   CLO 1: Must know important concepts in the field of information security, as well as terminology used in documents or business discussions. he should know the basics of general and special requirements in the field of information security, as well as their formation characteristics.

2. 2

   CLO 2: He should know the conceptual model of information security, he should have a simple mind for the formation of relevant requirements for the purpose of ensuring information security.

3. 3

   CLO 3: In the field of information security, a manager must know legal acts, their requirements and rules of application, and also be able to monitor the development of such acts. he should know global, regional and national norms, standards and best practices in the field of information security, be able to follow their development and have ideas about their application.

4. 4

   CLO 4: He should know organizational forms and methods for ensuring information security. to ensure information security, he should know the basic principles, as well as learn technical methods and tools.

5. 5

   CLO 5: Must have general knowledge of information security risks, their characteristics, and management. must have general knowledge of relevance, formation features and application of information security policy, as well as methods of ensuring it. must have general knowledge of information security audit basics, features, relevance, and procedural rules.

6. 6

   CLO 6: Must have general knowledge of the legal, organizational and technical basis of information protection tools, application areas, as well as the creation and certification of these tools in accordance with the rules. he should know the rules of recognition of foreign certificates issued to information protection means.

1. 1.
   Basic concepts of information securityLecture

   Within the framework of the topic, the concept, goals, scope and basic principles of information security are studied. fundamental concepts such as information and information assets, threat, vulnerability, risk and security incident are explained. the principles of ensuring confidentiality, integrity and availability of information are reviewed. information is also provided about the relationship of information security with other areas and the main activities of an information security specialist.

2. 2.
   The main directions of the information warLecture

   Within the framework of the topic, the concept of information war, its goals, main characteristics and role in the modern information environment are studied. the main directions of information warfare, application methods and used tools are reviewed. the characteristics of information influence, disinformation, propaganda and psychological operations are explained. also, activities directed against information systems and information resources and general principles of protection against them are examined.

3. 3.
   Process model of cyber attacks. the concept of ethical hackingLecture

   Within the framework of the topic, the stages of cyber attacks and their process model are studied. basic stages of cyber attack preparation, target identification, data collection, vulnerability detection and exploitation are explained. the concept of ethical hacking, its goals, and its role in assessing the security of information systems are reviewed. it also examines the legal and ethical boundaries of ethical hacking, as well as the key differences between cyber attacks and ethical hacking.

4. 4.
   Malware threatsLecture

   Within the scope of the topic, the concept of malicious software, their main characteristics and the threats they pose to information systems are studied. viruses, worms, trojans, ransomware, spyware, and other major types of malware are reviewed. the mechanisms of spread, entry into the system and damage of malicious programs are explained. basic principles of detecting, preventing, and protecting against malware threats are also explored.

5. 5.
   Information security risk managementLecture

   Within the framework of the topic, the concept of information security risk and the main stages of the risk management process are studied. the principles of identifying information assets, threats and vulnerabilities, assessing risks in terms of probability and impact are explained. key processing approaches such as risk mitigation, acceptance, transfer and prevention are reviewed. issues of continuous risk monitoring and reassessment in accordance with the changing security environment are also explored.

6. 6.
   Information security incident managementLecture

   Within the topic, the concept of information security incident and the main stages of the incident management process are studied. the principles of detection, registration, analysis and classification of security incidents are explained. processes of responding to incidents, locating them, eliminating their consequences and restoring systems are reviewed. also, the analysis of the results obtained from the incidents and the determination of preventive measures to prevent similar incidents in the future are investigated.

7. 7.
   Methods of ensuring information securityLecture

   Within the framework of the topic, the main methods and approaches used in ensuring information security are studied. organizational, technical, software and legal security measures applied to protect information assets are reviewed. the features and fields of application of preventive, detection and restorative security methods are explained. also, the interaction of various security methods and their role in the formation of a complex security system are investigated.

8. 8.
   Information security architecturesLecture

   Within the subject, the concept of information security architecture, its purpose and main components are studied. placement and interaction of security mechanisms at different levels of information systems is considered. security approaches based on the principles of multi-level protection, least authority and trust are explained. the role of security architectures in comprehensive protection of information assets, systems and networks is also explored.

9. 9.
   Organizational issues of information securityLecture

   The main principles and organizational issues of information security management in organizations are studied within the subject. the development and implementation of information security policies, procedures and internal rules are reviewed. the issues of defining safety roles and responsibilities, educating employees and forming a safety culture are explained. also, the management of information security within the organizational structure and the coordination of security measures are investigated.

10. 10.
    Information security standards and certificationLecture

    Within the framework of the topic, the basic standards applied in the field of information security and the concept of certification are studied. the role of standards in information security management and defining security requirements is reviewed. the principles of assessing the compliance of information systems, security products and management processes with the specified requirements are explained. the purpose of the certification process, its main stages and its importance in ensuring the reliability of information security are also examined.

11. 11.
    Information security auditLecture

    Within the subject, the concept, purpose and basic principles of information security audit are studied. in the audit process, the assessment of compliance of information systems, security controls, policies and procedures with the established requirements is considered. the stages of planning the audit process, collecting evidence, identifying existing deficiencies and documenting the results are explained. also, based on the audit results, issues of improving the security level and determining corrective measures are investigated.

12. 12.
    Public key cryptographyLecture

    Within the scope of the topic, the concept of public key cryptography, its working principle and its role in information security are studied. the creation, interaction, and use of public and private keys for various purposes is explained. asymmetric encryption and decryption processes, as well as the application of public-key cryptography in secure key exchange, are considered. also, the role of this approach in ensuring data confidentiality, authenticity and secure communication is investigated.

13. 13.
    Digital signature schemesLecture

    Within the scope of the subject, the concept of digital signature, principles of its creation and verification are studied. the basic components of digital signature schemes and their interaction with public-key cryptography are explained. the role of digital signature in ensuring the authenticity and integrity of information, as well as in preventing signature rejection, is considered. also, the application of digital signature schemes in electronic documents and secure digital communication is investigated.

1. Imamverdiyev y.n., basics of information security - lectures. 2022, 124 p. (electronic means).
2. Aliguliyev r.m., imamverdiyev y.n., information security incidents. baku: "information technologies" publishing house, 2012, 212 p.
3. Imamverdiyev y.n., explanatory dictionary of information security terms. baku: "information technologies" publishing house, 2015, 160 p.
4. Diogenes y., ozkaya e. cybersecurity – attack and defense strategies. packt publishing, 2019, 356 p.
5. Stallings w., cryptography and network security: principles and practice (7th edition). pearson, 2016, 768 p.
6. Kenyon b. ISO 27001 controls – a guide to implementing and auditing. IT governance ltd., 2019, 180 p.