FAC-P/PM-IT: Security, Accessibility and Quality

• Applying defense in depth: tools, techniques and people
• Comprehending FISMA and OMB oversight
• Assimilating Risk Management Framework Security Life Cycle

Multi-tiered risk management

• Organization: Strategic risk management
• Mission/Business: Tactical approach to risk
• Information Systems

Defining roles and responsibilities

• Distinguishing hierarchy and key roles of risk management
• Defining responsibilities assigned to specific roles
• Separating roles and areas of responsibility

Phases of risk management

• Categorizing information systems
• Selecting security controls
• Implementing security controls
• Assessing security controls
• Authorizing information systems
• Monitoring security controls

Introducing information assurance

• Assuring security throughout the data life cycle
• Integrating information assurance into software development
• Building in “secure by design”
• Implementing information assurance best practices
• Ensuring component security

Penetration testing and vulnerability assessments

• Validating security functions and configuration
• Finding weaknesses within systems before the attacker does

Keeping current with information assurance

• Full disclosure vs. responsible disclosure
• Exploring vulnerability databases

Modularization (the OSI 7 Layer Model)

• Networking principles powering the Internet
• Modeling a packet

Confidentiality, integrity and availability across the network

• Encrypting for confidentiality
• Sniffing the network and protocol analysis
• Modifying data via man-in-the-middle attacks

Networking services and security

• Poisoning the DNS cache
• Incorporating core services including DHCP, ICMP and ARP
• Hardening the TCP/IP stack

Authenticating users

• Managing factors of authentication (something you know, have, or are)
• Attacking passwords
• Comprehending PKI and public key authentication systems
• Evaluating the suitability of biometrics
• Integrating multi-factor authentication

Authenticating hosts

• Incorporating ARP, DHCP, DNS and protocol insecurities
• Performing and detecting MAC and IP address spoofing
• Achieving strong host authentication
• Analyzing Kerberos and IPSec

Encrypting and exercising integrity functions

• Caplitalizing on asymmetric or Public Key cryptography
• Applying symmetric cryptography
• Exercising message digest functions for integrity

Certificates and Certification Authorities

• Clarifying PKI and certificate fields
• Publishing certificate revocation and certificate security

Digital signatures

• Digitally signing for strong authentication
• Proving authentication, integrity and non-repudiation

• Promoting open data policies
• Removing barriers to enhance accessibility for people
• Enabling IT accessibility