MCA-126
Information Security
Security as a management problem as much as a technical one — threats and ethics, risk management and policy, access control and intrusion detection, then implementation and forensics.
- Semester
- Semester 2
- Credits
- 4
- Scheme
- 3 lectures + 1 tutorial a week
- Contact hours
- 42 across four units
- Category
- Core Elective - I
What the paper is
Information Security is taught from Whitman and Mattord, which means it is a governance paper with technology in it rather than the other way round. The first two units are about identifying what could go wrong and deciding what to do about it; only Unit III is about the controls themselves.
That framing is the thing to internalise early, because it is how the exam is set. “Identify the threats and countermeasures for this organisation” and “outline a risk control strategy” are the recurring shapes of question, and neither is answered by naming a firewall.
Unit II carries twelve hours — the most in the paper — and covers risk identification, assessment and control strategies plus the standards landscape, ISO and NIST. It is also the material that transfers most directly to work, because it is what a security policy is actually made of.
What to concentrate on
- Learn the four risk control strategies and be able to say when each is the right choice. Nearly every long question in Unit II can be answered through them.
- The CIA triad plus authenticity and accuracy is the vocabulary the whole paper uses. Being able to classify any given threat against it makes Unit I's long list of attacks much easier to handle.
- For Unit III, concentrate on the firewall processing modes and architectures and on the difference between intrusion detection and intrusion prevention. Biometrics is a small, factual add-on to the same unit.
Syllabus, unit by unit
Summarised from the approved scheme. Hours are the contact hours the scheme allots, which is a fair guide to where the marks sit.
Unit I · Introduction, threats and ethics
10 hours- Definition of information security: availability, confidentiality, accuracy, integrity and authenticity
- Security threats: vulnerabilities, threats, attacks and countermeasures; secure software development
- Ethical issues: law and ethics in information security, international law and legal bodies, codes of ethics
Unit II · Managing IT risk and the security plan
12 hours- Risk management: risk identification, risk assessment, risk control strategies
- Quantitative and qualitative risk control
- Information security planning and governance; policies, standards and practices
- Information security with ISO and NIST models
- Security education, training and awareness
Unit III · Security technologies
10 hours- Access control: identification, authentication, authorisation and accountability
- Firewalls: processing modes, structure, architecture, configuration, remote user connections
- Intrusion detection and prevention systems
- Operating system fundamentals and security tools, biometric access controls
Unit IV · Implementation and maintenance
10 hours- Remote computing security, security project management, technical aspects of implementation
- Information security certifications
- Security management maintenance models
- Vulnerability assessment and an introduction to digital forensics
How it is examined
- Question 1 is compulsory, covers the whole syllabus, and is made of objective or short-answer questions. It carries 12 marks.
- The rest of the paper is four units matching the four above. Each unit sets two questions and you attempt one, so there are four more answers at 12 marks each.
- Examiners are asked to map every question to a course outcome using Bloom's taxonomy, which is why questions are phrased as “apply”, “analyse” or “evaluate” rather than only “explain”.
The pass mark is 40 out of 100 in every paper.
Learning objectives
- The technical and management aspects of information security
- Security requirements within an organisation
- Threats and malware, through the analysis of worms, viruses and Trojans
- Awareness of the technologies used to implement security measures in an organisation
Assumed beforehand
- Fundamentals of computer systems
- Basics of information systems and security
Paired in the scheme with MCA-168 Lab based on Core Elective I.
Books it is taught from
- TB1Michael E. Whitman and Herbert J. Mattord, “Principles of Information Security”, Cengage Learning, 4th edition, 2003
- TB2Mark Merkow and James Breithaupt, “Information Security: Principles and Practices”, Pearson Education, 1st edition, 2007
- TB3Micki Krause and Harold F. Tipton, “Information Security Management Handbook”, CRC Press, 6th edition, 2004
Notes for MCA-126
Lecture notes, question papers and assignments filed against MCA-126 are in the library. Everything there has been checked by a moderator before it appears, and an account is free — new ones are approved by hand, which is what keeps the shelf clean.