0x010088F6312065A70A44B630A6848498EAD80093CFEAFE161DC94D83C7C5C9A5A748B8

In this part, course evaluation process of the Information Security course in Autumn 2020, will be introduced. <h2> Procedure</h2> In order to perform the course evaluation, the students select two students to form the reference group, to represent them in the course evaluation meetings, and lately in the course, one of them withdraw from the reference group.  The class group is 27 students, but not many students accepted to be in the reference group.  However, the students in the course have their own closed group on Facebook to discuss the course and the class group is small, then it was enough to have a reference group with only two students. The evaluation meetings are distributed among the semester. Since the class group is small, we have a short discussion in the class weekly. These short meetings provide a good opportunity for students to tell their opinions early in the course, to help the teacher to improve and fix the problems early in the course. We have two fixed meetings, on in the middle of the course and a final meeting at the end of the semester to discuss the whole course (course materials, lectures, teaching methods, and the evaluation method).    <h2>Feedback from reference group</h2> Relevance: The students find the course relevant to their study and useful overall. Security is a hot topic in the media in Norway / EU in recent years. Feedback: There were many meetings where we discussed all the issues (in the class). Then, there were several improvements during the course. The course was well structured and clear what we were going to do week by week. The students were satisfied with class, course materials, and teaching method. Teaching method: There were uploaded notes in BB and reference to the book. Videos and examples from online sources were used. We run an open discussion about each topic. Kahoot was used to review the previous topics. Good wise assignments and feedback. The student asked for more practical examples to link them to the theory, and practical exercises to work on them in groups.   Assignments:  Some students had difficulties in the assignments, because it is first time for them to get open assignments where they need to analyze, search and build the solutions. The teacher showed interest in student’s assignments solutions. <h2>Attendance</h2> The attendance wasn’t good in general. They were very few students present in the lectures. In the exercise hours, not many were attending. The students preferred to work from home. The teacher tried to help by recording some of the lectures. <h2>Exam results</h2> The final exam was an individual portfolio (collection) assessment. The grades are shown below. All the students must pass at least four mandatory assignments, in order to submit the collection for final assessment. Only 4 students didn’t get passed the prior assignments. 23 students submitted their portfolios for the final assessment. One student didn’t pass the course. The grades were good distributed as following: <ul><li>A (3)</li><li>B (5)</li><li>C (4)</li><li>D (7)</li><li>E (2)</li><li>F (2)</li></ul><h1> </h1><h2>﻿Conclusion </h2> The course was successful in achieving the learning outcomes. The results are good and the students developed their skills in the field. I have found that challenging the students to work on big assignments and a term paper, is very effective method in achieving the learning outcomes. The students applied their knowledge from other courses in the study program in this course, and they found the useful link between different courses (e.g. Computer Network, Web technology, Operating systems and database). I think the course materials and the evaluation method are very good. the students improve their skills massively during the course. At the end of the course, the students were able to lead an information security project for small and medium organizations.  I included few practical labs, but the students want more practical exercises to work on them in the class and include group works as well. I didn’t success in recruiting any teaching assistants because this course is running in the last year of the study program.  One of the important issues that we couldn’t work on because the COVID-19, the active-based learning method.

<h2>Course Objectives</h2> This course provides the foundation for understanding the key issues associated with protecting information assets, determining the levels of protection and response to security incidents, and designing a consistent, reasonable information security system, with appropriate intrusion detection and reporting features. The purpose of the course is to provide the student with an overview of the field of information security and assurance. <h2>Topics</h2> The course topics are: 1.    Introduction to IS ·     Threats and risks ·     Relative theory  ·     Related laws and regulations  2.    Planning for Security  ·     IS planning and Governance·     IS policy, standards and practices.·     IS blueprint.·     Continuity Strategies 3.    Risk Management  	·    Risk Identification. 	·    Risk Assessment. 	·    Risk Control 	·    Recommended Risk Control Practices. 4.    Physical Security. 5.    Security Technology. ·     Access Control and authorization·     Firewalls·     Intrusion Detection and Prevention systems·     Wireless Security. 6.    Cryptography 7.    Implementation Information Security. 8.    Information Security Levels. <h2>Learning outcome</h2> Knowledge: ·     Understand the meaning of information security ·     Know and understand the key concepts within the area ·     Have a good understanding of the value of information and information systems in organizations·     Know current threats to information security ·     Have a good knowledge of the laws and regulations of the area ·     Be familiar with recognized methods and standards for improved information security ·     Have knowledge of relevant technical and organizational means to improve information security Skills: ·     Do a risk analysis for a hypothetical organization (case).·     Recommend appropriate and effective measures to improve information security.·     Prepare a contingency plan for a hypothetical business (case).·     Establish adequate security in restricted operating environment (lab) Competence: ·     Be able to update their knowledge about information security ·     Communicate their knowledge of information security also to persons without ICT background ·     Be able to communicate on the subject with an organization's strategic management

<h2>Teaching method and activities</h2> ·     Lectures, discussion at group and class level, case studies and assignments ·     Discussion board in Blackboard. ·     Four mandatory assignments are related to the final delivery (Portfolio) ·     Four mandatory assignments are to be handed in and approved in order to get access to the exam. ·     Practical exercises to be done in the class. <h2>Curriculum</h2> The books listed below will be followed during the course. <ul><li>Principles of Information Security (6th ed)</li></ul>Course Technology-Cengage Learning, 2018, ISBN-13 9781337102063.Michael E. Whitman and Herbert J. Mattord. <ul><li>Håndbok i datasikkerhet - informasjonsteknologi og risikostyring (4. utgave)</li></ul>Vigmostad &amp; Bjørke AS, 2019, ISBN 978-82-450-2789-1.Torgeir Daler, Roar Gulbrandsen, Tore Audun Høie og Torbjørn Sjølstad. “Principles of Information Security” was actively used in all classes and mandatory assignments.  Topics covering Norwegian laws and rules can be followed with “Håndbok i datasikkerhet”. However, more up-to-date contents was offered online from different governmental / institutional web sites. Online sources were mainly used in class regarding laws and rule

Individual portfolio assessment. The portfolio consists of case studies and assignments completed during the course and a term paper. The portfolio must include all case studies, assignments and the term paper in order to be evaluated. All mandatory cases / assignments must be delivered in order to qualify for evaluation. The assessment is an overall evaluation of the portfolio. If there are doubts during the evaluation process, students may be called in for a clarifying oral examination to defend the contents of the portfolio.

NTNU:TIA:REST

Institutt for IKT og realfag

Department of ICT and Natural Sciences

Alle trykte og håndskrevne hjelpemidler tillatt. Alle kalkulatorer tillatt.

Engelsk

Norsk

Anbefalte forkunnskaper

Læringsutbytte fra datastudiets to første år.

Mer om vurdering

Mappevurdering. Mappen skal bestå av et gitt antall casestudier/øvinger og en semesteroppgave/prosjekt. Karakteren settes ut fra en helhetsvurdering av mappen. Dersom det er tvil om karaktersettingen kan studenten bli innkalt til en avklarende muntlig eksamen for å forsvare innholdet i mappen.

Faglig innhold

Grunnleggende om informasjonssikkerhet:
Terminologi
- Integritet, konfidensialitet og tilgjengelighet

Tekniske vurderinger knyttet til informasjonssikkerhet:
- Lagring og bruk av digitale opplysninger
- Brannmurer, bakdører, virus, sikkerhetshull osv.
- Krav til sikkerhetssystemer
- Risikovurderinger
- "Single point of failure", sikkerhetskopiering og fysiske sikringstiltak

Organisatoriske problemstillinger knyttet til informasjonssikkerhet:
- Identifisere den menneskelig faktoren innen informasjonsikkerhet
- Sikkerhet som del av bedriftsledelsen
- Risikovurdering og "information assets management"
- Bredden i trusler og sikkerhetsproblemer
- Konflikten mellom sikkerhet og brukervennlighet

Forankre sikkerhetsarbeidet i hele organisasjonen:
- Standarder, lover og forskrifter

Kursmateriell

Obligatorisk:
1. Principles of Information Security (6th ed) Course Technology-Cengage Learning, 2018, ISBN-13 9781337102063. Michael E. Whitman and Herbert J. Mattord.

2. Håndbok i datasikkerhet - informasjonsteknologi og risikostyring (4. utgave) Tapir Akademisk Forlag, 2019, ISBN 978-82-450
2789-1.Torgeir Daler, Roar Gulbrandsen, Tore Audun Høie og Torbjørn Sjølstad.

Læringsformer og aktiviteter

Pedagogiske metoder:
Temaforelesninger, casestudier og øvinger.   

Obligatoriske arbeidskrav:
Alle obligatoriske case/øvinger og semesteroppgaven/prosjektet skal være levert for å få mappen vurdert til eksamen.

Obligatoriske aktiviteter:
3-5 obligatoriske oppgaver. Alle obligatoriske oppgaver må godkjennes for å få tilgang til eksamen, og de er en del av mappen.

Læringsutbytte

Kunnskaper:
- vite hva informasjonssikkerhet betyr 
- kjenne til og forstå de sentrale begrepene innenfor området
- ha god forståelse for den verdien informasjon og velfungerende informasjonssystemer representerer for virksomheter
- vite om aktuelle trusler mot informasjonssikkerheten
- ha gode kunnskaper om lover og forskrifter for informasjonssikkerhet
- kjenne til anerkjente metoder og standarder for arbeid med informasjonssikkerhet
- vite om relevante tekniske og organisatoriske sikkerhetstiltak 

Ferdigheter:
- gjennomføre en risikoanalyse for en tenkt virksomhet (case)
- anbefale relevante og effektive tiltak for å øke informasjonssikkerheten
- utarbeide en beredskapsplan for en tenkt virksomhet (case)
- etablere tilstrekkelig sikkerhet i begrensede driftsmiljøer (lab)

Kompetanse:
- være i stand til å oppdatere sine kunnskaper om informasjonssikkerhet
- formidle sine kunnskaper om informasjonssikkerhet til personer uten IT-faglig bakgrunn

kunne kommunisere om emnet med en virksomhets strategiske ledelse

Informasjonssikkerhet

Ingeniør

Bachelor i ingeniørfag - Data

Bachelor i ingeniørfag - Automatiseringsteknikk

Web/Lists(guid'8b698a2d-6ad0-4f7d-b3be-219cc1979f02')/Items(7879)/FieldValuesAsText

Informasjonssikkerhet - ID302809