In this course we will use a systematic process for analyzing security. The process is based on continuous improvement concepts, like those associated with Shewart and Deming. We will use that process to understand classic examples of non-computing security failures as well as computer- and network-based failures.

An important part of this is to distinguish between what we are trying to do (our requirements or "security policy") and what we actually do (our implementation). Many security problems arise as the environment forces changes to the policy while the implementation remains unchanged.

The course will cover the information security environment incrementally. The first half of the course starts with a single computer and user. Then we add more users, with access control and authentication. We look at cryptography as a way to protect files, flash drives, and hard drives. We will also look at forensic analysis of drive data.

The second half of the course looks at networking, starting with local networks. Then we incorporate Internet technology and learn how to examine the network environment and its traffic. We will also look at email forgery, firewall bypassing, and SQL injection. If there is time, we will also examine US government-specific security topics.

The textbook is called "Elementary Information Security," published last fall by Jones and Bartlett Learning (JBLearning.com). You may retrieve sample chapters 3 and 9 from the JBL web site. Chapter 3 illustrates some simple policy issues we will address, while Chapter 9 illustrates the building-block approach we will use for studying cryptography. You may also want to visit the "cryptosmith.com" web site for a detailed outline of the book's chapters and for other information.