FAC-P/PM-IT Training: Security, Accessibility and Quality (FPM 512)

FPM 212 Course Outline

• Introduction

  • Applying defense in depth: tools, techniques and people
  • Comprehending FISMA and OMB oversight
  • Assimilating Risk Management Framework Security Life Cycle

• Risk Management Framework

  Multi-tiered risk management

  • Organization: Strategic risk management
  • Mission/Business: Tactical approach to risk
  • Information Systems

  Defining roles and responsibilities

  • Distinguishing hierarchy and key roles of risk management
  • Defining responsibilities assigned to specific roles
  • Separating roles and areas of responsibility

  Phases of risk management

  • Categorizing information systems
  • Selecting security controls
  • Implementing security controls
  • Assessing security controls
  • Authorizing information systems
  • Monitoring security controls

• Information Assurance

  Introducing information assurance

  • Assuring security throughout the data life cycle
  • Integrating information assurance into software development
  • Building in “secure by design”
  • Implementing information assurance best practices
  • Ensuring component security

  Penetration testing and vulnerability assessments

  • Validating security functions and configuration
  • Finding weaknesses within systems before the attacker does

  Keeping current with information assurance

  • Full disclosure vs. responsible disclosure
  • Exploring vulnerability databases

• Information Systems and Network Security

  Modularization (the OSI 7 Layer Model)

  • Networking principles powering the Internet
  • Modeling a packet

  Confidentiality, integrity and availability across the network

  • Encrypting for confidentiality
  • Sniffing the network and protocol analysis
  • Modifying data via man-in-the-middle attacks

  Networking services and security

  • Poisoning the DNS cache
  • Incorporating core services including DHCP, ICMP and ARP
  • Hardening the TCP/IP stack

• Authentication and Access Control

  Authenticating users

  • Managing factors of authentication (something you know, have, or are)
  • Attacking passwords
  • Comprehending PKI and public key authentication systems
  • Evaluating the suitability of biometrics
  • Integrating multi-factor authentication

  Authenticating hosts

  • Incorporating ARP, DHCP, DNS and protocol insecurities
  • Performing and detecting MAC and IP address spoofing
  • Achieving strong host authentication
  • Analyzing Kerberos and IPSec

• Cryptography

  Encrypting and exercising integrity functions

  • Caplitalizing on asymmetric or Public Key cryptography
  • Applying symmetric cryptography
  • Exercising message digest functions for integrity

  Certificates and Certification Authorities

  • Clarifying PKI and certificate fields
  • Publishing certificate revocation and certificate security

  Digital signatures

  • Digitally signing for strong authentication
  • Proving authentication, integrity and non-repudiation

• Accessibility

  • Promoting open data policies
  • Removing barriers to enhance accessibility for people
  • Enabling IT accessibility