BITM Information Security
bitmsemester 5
Information Security
Subject Code: IT244
Course Title: Information Security
Course No: IT244
Nature of Course: Theory & Practical
Full Marks: 60
Pass Marks: 30
Credit Hours: 3
Course Description
This course introduces the basic concepts of computer and information security. This course prepares the students to meet the new challenges in the world of increasing threats to computer security by providing them with an understanding of the various threats and countermeasures. This course includes cryptographic algorithms, authentication systems, intrusion detection and prevention, malicious logics, network security and security audits.
Course Objective
The objective of this course is to familiarize the students with the theoretical and practical concepts of information security, different security measures, policies and security mechanisms, security audits so that students will be able to design, implement and manage the secure computer system.
Course Contents
| Course Contents | Teaching Methodology | Teaching Hours |
|---|---|---|
| Unit 1: Introduction (5 Hrs.) | ||
| Computer Security Concepts | Lecture/Lab | |
| Threats, Attacks and Assets | ||
| Security Functional Requirements | ||
| Security Design Principles | ||
| Attack Surfaces and Attack Trees | ||
| Computer Security Strategy | ||
| Access Control Principles | ||
| Subjects, Objects and Access Rights | ||
| Discretionary Access Control | ||
| Role Based Access Control | ||
| Attribute Based Access Control | ||
| Identity, Credential and Access Management | ||
| Trust Frameworks | ||
| Overview of the Bell-LaPadula Model and Biba integrity model | ||
| Unit 2: Symmetric and Asymmetric Cryptographic Algorithms (13 Hrs.) | ||
| Classical Cryptosystems: Substitution and Transposition Ciphers | Lecture/Lab | |
| Block Cipher Vs Stream Ciphers | ||
| Symmetric Encryption Principles | ||
| Fiestel Cipher Structure | ||
| Data Encryption Standards (DES) | ||
| Basic concepts of fields | ||
| Modular Arithmetic | ||
| Galois Fields | ||
| Polynomial Arithmetic | ||
| Advanced Encryption Standards (AES) | ||
| Prime Numbers | ||
| Fermat’s Theorem | ||
| Primality Testing: Miller-Rabin Algorithm | ||
| Euclidean Algorithm | ||
| Extended Euclidean Algorithm | ||
| Euler Totient Function | ||
| Asymmetric Encryption | ||
| Diffie-Hellman Protocol | ||
| RSA Algorithm | ||
| Unit 3: Message Authentication and Hash Functions (6 Hrs.) | ||
| Message Authentication | Lecture/Lab | |
| Hash Functions | ||
| Message Digests: MD4 and MD5 | ||
| Secure Hash Algorithms: SHA-1, SHA-2 | ||
| Hash Based MAC (HMAC) | ||
| Digital Signature | ||
| Unit 4: User Authentication (5 Hrs.) | ||
| User Authentication Principles | Lecture/Lab | |
| Password-Based Authentication | ||
| Token-Based Authentication | ||
| Biometric Authentication | ||
| Two Factor Authentication | ||
| Kerberos Protocol | ||
| Kerberos 5 | ||
| Security Issues for User Authentication | ||
| Unit 5: Intrusion Detection and Prevention (5 Hrs.) | ||
| Intruders | Lecture/Lab | |
| Intrusion Detection | ||
| Intrusion Detection Analysis Approaches | ||
| Host-Based Intrusion Detection | ||
| Network-Based Intrusion Detection | ||
| Hybrid Intrusion Detection | ||
| Intrusion Detection Exchange Format | ||
| Honeypots | ||
| Intrusion Prevention System | ||
| Unit 6: Malicious Software (4 Hrs.) | ||
| Malicious Software | Lecture/Lab | |
| Types of Malicious Software | ||
| Advanced Persistent Threat | ||
| Virus | ||
| Worms | ||
| Spam E-mail | ||
| Trojans | ||
| System Corruption | ||
| Zombie | ||
| Bots | ||
| Key loggers | ||
| Phishing | ||
| Spyware | ||
| Backdoors | ||
| Rootkits | ||
| Countermeasures for Malwares | ||
| Unit 7: Network Security (5 Hrs.) | ||
| Overview of Network Security | Lecture/Lab | |
| Digital Certificates and X.509 certificates | ||
| Certificate Life Cycle Management | ||
| PKI trust models | ||
| PKIX | ||
| Secure Socket Layer (SSL) | ||
| Transport Layer Security (TLS) | ||
| IP Security | ||
| Email Security | ||
| PGP and its Services | ||
| Firewalls its applications and types | ||
| VPN | ||
| Unit 8: IT Security Management, Risk Assessment and Security Auditing (5 Hrs.) | ||
| IT Security Management | Lecture/Lab | |
| Organizational Context and Security Policy | ||
| Security Risk Assessment | ||
| Security Risk Analysis | ||
| Security Auditing Architecture | ||
| Security Audit Trails | ||
| Implementing Logging Function | ||
| Audit Trail Analysis |
Text Books
1. William Stallings, cryptography and network security principles and practice eighth edition, 2023, Pearson
2. William Stallings and Lawrie Brown, Computer Security: Principles and Practice, fifth edition, Pearson
3. Mark Stamp, Information Security: Principles and Practices, Wiley
4. Matt Bishop, Introduction to Computer Security, Addison Wesley
5. Matt Bishop, Computer Security, Art and Science, Addison Wesley
Lab Works
The laboratory work covers implementing programs for following;
- Classical ciphers like Caeser, Railfence
- DES, AES
- Primality Testing, Euclidean Algorithms, Deffie-Hellman RSA
- MD5, SHA-1, SHA-2
- Authentication systems like password based, token based, two factor authentication etc.