Fundamentals of Information SecuritySyllabus

Subject code

MM-1401-EN

Credits

6

Student workload

135

Semester

Autumn semester

Academic year

1

Subject type

Mandatory

Form of education

Full-time

Language of instruction

English

In-class hours

a) 30 hours – Lectures; b) 15 hours – Seminars, etc.

Out-of-class hours

135 hours

The course Fundamentals of Information Security explores the fundamental concepts and principles of information security, as well as methods for protecting information systems against modern cyber threats. The course covers information confidentiality, integrity, and availability (the CIA triad); information assets; threats, vulnerabilities, and risks; authentication and authorization; access control; the fundamentals of cryptography; malware; social engineering; and network and system threats. It also examines key approaches to developing security policies, assessing risks, protecting data, preventing cybersecurity incidents, and ensuring the security of information systems.

• lecture
• project-based learning
• seminar
• teamwork
• interactive discussion
• problem-based learning
• case study
• presentations

1. 1

   CLO 1: Define and list the fundamental concepts of information security, including the CIA triad, risks, threats, and vulnerabilities; symmetric and asymmetric encryption algorithms; and basic network protocols

2. 2

   CLO 2: Explain types of malware, social engineering attacks, and network vulnerabilities, and distinguish their potential impacts on an organization's information assets.

3. 3

   CLO 3: Implement and configure security mechanisms such as firewalls, intrusion detection systems (ids), intrusion prevention systems (ips), and multi-factor authentication (mfa) to protect networks and systems.

4. 4

   CLO 4: Apply the defense in depth (did) strategy as a multi-layered approach to information infrastructure security.

5. 5

   CLO 5: Identify and classify cybersecurity incidents and security breaches by analyzing log files, security information and event management (siem) alerts, and network traffic.

6. 6

   CLO 6: Compare and analyze an organization's security gaps against international standards, including iso/iec 27001 and NIST frameworks, and applicable legislation, including the general data protection regulation (gdpr) and personal data protection legislation.

7. 7

   CLO 7: Conduct risk assessments for an organization's IT infrastructure and evaluate vulnerability scan results and the effectiveness of security policies.

8. 8

   CLO 8: Develop a preliminary incident response plan and a business continuity plan (bcp) strategy to address potential cyberattacks and disasters.

1. 1.
   Introduction to information security and fundamental conceptsLecture

   This topic introduces the fundamental concepts, objectives, and principles of information security. it develops foundational knowledge of confidentiality, integrity, and availability (the CIA triad), information assets, threats, vulnerabilities, risks, and security controls.

2. 2.
   Threats, malware, and types of cyberattacksLecture

   This topic examines the main types of modern cyber threats, their characteristics, and their impact on information systems. it covers viruses, worms, trojans, ransomware, spyware, and other forms of malware, as well as dos/ddos attacks, phishing, password attacks, and other cyberattack techniques.

3. 3.
   Social engineering and the human factorLecture

   This topic explores the role of the human factor in cybersecurity and the techniques used in social engineering attacks. it examines phishing, pretexting, baiting, impersonation, and other manipulation techniques, as well as methods for improving user security awareness and protecting against social engineering attacks.

4. 4.
   Defense in depth (did) strategyLecture

   This topic examines the multi-layered defense approach used to protect information systems against various threats. it explores the implementation of security mechanisms at the network, application, data, user, and physical security levels, emphasizing how complementary security controls strengthen overall protection.

5. 5.
   Cybersecurity of artificial intelligence and autonomous systemsLecture

   This topic examines cyber threats affecting artificial intelligence and autonomous systems, along with methods for protecting them. it explores the use of AI to detect and prevent cyber threats, as well as attacks targeting AI systems, data manipulation, and model security issues.

6. 6.
   Identification, authentication, and access controlLecture

   This topic examines the principles of identifying and authenticating users and systems and managing access rights to resources. it covers password policies, multi-factor authentication (mfa), biometric authentication, role-based access control (rbac), and other access control models.

7. 7.
   Network and email security: protocols and essential protection mechanismsLecture

   This topic explores the principles of securing networks and email environments. it examines secure communication protocols, encryption, firewalls, virtual private networks (vpns), intrusion detection and prevention systems (ids/ips), email filtering mechanisms, and methods for protecting against email-based attacks.

8. 8.
   Wireless network (wi-fi) securityLecture

   This topic examines the security characteristics, common vulnerabilities, and protection mechanisms of wireless networks. it covers wi-fi security standards, encryption and authentication methods, attacks targeting wireless networks, and secure configuration principles.

9. 9.
   Operating system and application securityLecture

   This topic explores the principles of securing operating systems and software applications. it examines vulnerability detection, patch and update management, restriction of user privileges, secure programming, and essential application-level security mechanisms.

10. 10.
    Data loss prevention (dlp) and data protectionLecture

    This topic examines methods for preventing unauthorized access to, use of, and transmission of sensitive and confidential information. it covers the operating principles of DLP systems, data classification, encryption, and security measures for protecting data during storage and transmission.

11. 11.
    Cyber law, ethics, and international standardsLecture

    This topic explores the legal and ethical aspects of information security. it examines personal data protection, the lawful use of information resources, cybercrime, copyright, and international standards and frameworks related to information security.

12. 12.
    Risk management and assessmentLecture

    This topic examines methods for identifying, analyzing, assessing, and managing information security risks. it covers asset identification, threat and vulnerability analysis, risk level assessment, and the selection of appropriate security measures to mitigate identified risks.

13. 13.
    Incident management and monitoring (soc and siem)Lecture

    This topic examines the processes of detecting, analyzing, responding to, and recovering from cybersecurity incidents. it covers the functions of a security operations center (soc), the operating principles of SIEM systems, log collection and correlation, threat monitoring, and the stages of incident response.

14. 14.
    Digital forensics and business continuityLecture

    This topic explores the principles of collecting, preserving, and analyzing digital evidence following cybersecurity incidents. it examines evidence acquisition from disks, memory, network traffic, and other digital sources, as well as the development of business continuity and disaster recovery plans.

15. 15.
    Modern cybersecurity trendsLecture

    This topic examines current developments and emerging threats in cybersecurity. it covers cloud security, iot security, zero trust, ai-based security, automated defense, mobile security, and other relevant technologies and approaches

1. Whitman, michael e., and herbert j. mattord. principles of information security. 7th edition. relevant chapters.
2. Sikorski, m., and a. honig. practical malware analysis: the hands-on guide to dissecting malicious software. no starch press.
3. Kim, d., and m. g. solomon. fundamentals of information systems security. chapter 3.
4. Adnagy, christopher. social engineering: the science of human hacking. 2nd edition.
5. Sans institute. security awareness training and white papers. available at:(opens in a new tab)
6. Stallings, william. cryptography and network security: principles and practice. 8th edition, chapters 2–9.