e-Security

LESSON I
Why e-Security is necessary

• Threats to e-business
• Security goals
• Quantitative and technical analysis of threats
• Spoofing
• Denial-of-service attacks
• Sniffing, hacking

LESSON II
Security Architecture

• Security policy: firewall policy, e-mail and Internet policy, security architecture
• Security principles (least privilege)
• Technical security measures: network segmentation, firewalls, intrusion detection, secure configurations, secure application architectures
• Division of duties
• Security architecture components

LESSON III
Firewalls

• Firewall architectures
• Router, bastion host
• DeMilitarised Zone (DMZ)
• Packet filtering
• Application level filtering

LESSON IV
Securing Websites (inbound access)

• Website architectures
• Server security: web server, application and data(base) servers, WAP server and DNS server
• Transaction security

LESSON V
Secure Internet Use (outbound access)

• Internet and e-mail usage policy
• Mailserver security
• Proxy server
• Scanning: e-mail traffic for viruses, browser connections (Java applets, Java script, ActiveX)

LESSON VI
Identification, authentication, authorisation and encryption techniques

• Public Key Infrastructure (PKI) concepts
• Directory Services
• Single Sign-On (SSO)
• Trusted Third Party

LESSON VII
Security Management

• Security organisation: information strategy, plan, policy, security roles and responsibilities
• Security management processes
• Preventive, detective and corrective security measures
• Setting up security logging, monitoring and reporting
• Questions and answers

LESSON VIII
Legal Issues

• Outsourcing contracts (site development, site hosting, content management, personnel)
• Securing personal data
• Computer crime
• Legal aspects of e-commerce

LESSON IX
Dealing with Hackers

• Policy and legal measures
• Collecting evidence
• Using intrusion detection
• Honey pots and their uses