Transcript Slide 1
National Tech Prep Network Conference
September, 2005
Career Pathways for Student Success
The Increased Importance of Information Assurance Education
A Roadmap to a Career in Homeland Security
Moderator:
Phil Hale
Dean of Applied Technology Oakland Community College
Information Assurance Directorate
Dr. Vic Maconachy
“We now live in a world where terrorists can do as much damage with a keyboard and a modem as with a gun or bomb…Two choices are available: adapt before the attack or afterward.”
Congress Speaks
Sen. Edwards introducing Cybersecurity Research and Education Act of 2002
How Bad Is It ?
Winning the battle is dependent on knowing the enemy’s secrets, movements and plans.
Al Qaeda Manual: Declaration of Jihad Against the Country’s Tyrants, eleventh lesson: Espionage
Read Any Good News Lately?
Internet Attacks During Third Quarter
Tech Web News
According to Internet Security Systems’ newest report, the number of security threats climbed 9 percent in the third quarter over the previous three months.
CSI – Cyberterrorism: More Sophisticated Than Past Worms
Information World
No hard evidence exists that shows a cyberterrorism attack on the U.S., but when such an attack comes, it is likely to be much more harmful than the current crop of relatively unsophisticated viruses and worms that have caused billions of dollars in damages…
YES ! …Maybe ?
2003 IT Security Budgets Increased Despite Flat Overall Spending, Says META Group Business Wire
This year, companies spent an average of 8.2% of their total IT budgets on security, up from 7.6% in 2002 and only 3.2% in 2001, according to new findings from META Group’s 2004 Worldwide IT Benchmark Report.
Sobig’s Success Prompts Calls for Secure E-Mail I D G News Service
In the wake of the Sobig attack, security experts uniformly credited the worm’s sophisticated design for much of its success. However, the sheer magnitude of Sobig’s attack led to questions about whether the Internet’s current e-mail infrastructure is making things too easy for virus writers and spammers.
Talk about impact!
A True Story
USA TODAY – Monday Sept. 8, 2004
Betty bought a brand new computer for Christmas. In June, COMCAST curtailed her outbound mail privileges after pinpointing her PC as a major source of e-mail spam. An intruder had turned her P C into a “Zombie”, spreading as many as 70,000 pieces of e-mail spam a day.
Shopping On the net
Auctions.
Search engines, Comparison shopping Download malicious Code/keystroke reader Creates spam relay
Betty is not alone
National Cyber Security Alliance Study with AOL:
Approximately three-fourths of users falsely believed their computers were at least somewhat safe from on-line threats and viruses, and 60% believed they were safe from hackers.
Two-thirds of the users had no firewall protection nor current anti-virus protection
Information Assurance
Defense-In-Depth TECHNOLOGY
Triad
OPERATIONS PEOPLE Fundamentally, only THREE countermeasures available to protect critical information infrastructures .
Network Protection Is No Longer Just an Insurance Policy, It Is Now a Core Business Requirement Industry Federal Government Finance Education
Growing the Information Assurance Work Force for Today and Tomorrow
V International Cooperation IV Secure Govt.
III Awareness and Training II Threat & Vulnerability Reduction I National Response System
Awareness, Literacy, Training and Education:
Weave a thread of continuity through The National Plan
Jan. 2003
The National Strategy to Secure Cyberspace
•
Priority III : A National Cyberspace Awareness and Training Program
• In addition to the vulnerabilities in existing information technology systems there are at least two other major barriers to users and managers acting to improve Cybersecurity •
(1) a lack of familiarity,knowledge and understanding of the issues
•
(2) an inability to find sufficient numbers of adequately trained and/or appropriately certified personnel to create and manage secure systems.
CNSS National Training Standards Map
CNSS National I A Education and Training Standards: CNSSI 4011 CNSSI 4012 CNSSI 4013 CNSSI 4014 CNSSI 4015 CNSSI 4016 CNSSI 4017 The I A Professional Senior Systems Manager Systems Administrator Information System Security Officer System Certifier Risk Analyst (Pending) Information Systems Security Engineer (in development)
127 U.S. Institutions in 40 States and the District of Columbia Map to the CNSS National Training Standards
CNSS National Training Standards Map
This program offers tremendous opportunity for 2 year programs/
National Centers of Academic Excellence in Information Assurance Education Partnerships with Academia
Reducing the vulnerability of our National Information Infrastructure by promoting higher education in information assurance and producing a growing number of professionals with IA expertise in various disciplines.
http://www.nsa.gov/ia/academia/acade00001.cfm
Centers of Academic Excellence in Information Assurance Education
New National Centers of Academic Excellence in Information Assurance Education
2005
California State Polytechnic (CA) DePaul University (IL) East Carolina University (NC) Eastern Michigan University (MI) Nova Southeastern University (FL) Oklahoma State University (OK) United States Air Force Academy (CO) Virginia Polytechnic Institute and State University (VA)
NSA-Designated Centers of Academic Excellence in Information Assurance Education
Partnership for Critical Infrastructure Security Geo location is very good.
IMPACT
Schools designated as CAEs
are eligible for special congressional funding are reporting students specifically searching for schools with CAE recognition are starting to support and receive support for state level cyber and homeland security issues and research are producing students immediately employed in the work force Areas having CAEs Can boast having IA education and training and education programs to potential corporations considering relocation Can boast presence of IA research capability Can use CAEs to improve security posture
Implementing -
Defending America’s Cyberspace National Plan for Information Systems Protection Version 1.0
An Invitation to a Dialogue
The White House 2000 Congress Passes Cyber-Service Bill (October 20, 2000)
•
Provides for:
– – – –
Scholarships for Service Infrastructure Support: Faculty Development Infrastructure Support: Program Development All based on NSA Centers of Academic Excellence in Information Assurance
Administered by National Science Foundation NSA representative co-chair of executive steering group
Department of Defense
Scholarship for Service Program NSA Designated Executive Agent
Assistant Secretary of Defense Command, Control, Communications and Intelligence MEMO Dated July 2, 2001
“I hereby delegate to the Director, National Security Agency, the authorities and responsibilities of the Secretary of Defense under the following statute: Public Law 106-398”
BREAKOUT OF STUDENTS
Recruitment
AY 2001 - 2002 AY 2002 - 2003 AY 2003 - 2004 AY 2004 - 2005 AY 2005 - 2006
Total Recruitment student aw ards Retention*
AY 2001 - 2002 AY 2002 - 2003 AY 2003 - 2004 AY 2004 - 2005 AY2005 - 2006*+
Total Retention student aw ards Initial Scholarships Aw arded
12 30 29 34 33
Returning Scholarships Aw arded
na 11 24 34 38
138 Initial Scholarships Aw arded
17 14 4 10 23
Returning Scholarships Aw arded
na 17 29 28 26
68
Partnerships with Business, Academia, & Government
http://www.ncisse.org
National Colloquium for Information Systems Security Education
Purpose:
Academic colloquium with academia, government, business and industry INFOSEC experts to discuss direction of INFOSEC undergraduate and graduate curricula; academic disciplines; common requirements; specific knowledge, skills and abilities; certification requirements and feasibility of certification board formulation.
Conference: June, 2006 Maryland
Sources of Help & Information
Non-Government
The Twenty Most Critical Internet Security Vulnerabilities (Updated) ~ The Experts’ Consensus
Sources of Help & Information
Academia
http://www.cert.org/
NIATEC
http://niatc.info/niatec2/index.htm
Sources of Help & Information
Government
http://www.nsa.gov/ia/academia/acade00001.cfm
Awareness Toolkit
PURPOSE:
•
Enhance Awareness
•
Encourage Information Systems Education and Training
WHERE CAN I FIND INFORMATION ON DEVELOPING AN AWARENESS PROGRAM?
Self-Help Awareness Program
•
CD-ROMS
•
VIDEO’S
•
BROCHURES
•
BOOKLETS
nietptoolkit@nsa
Educational Solutions for a Safer World National Security Agency Information Assurance Directorate http://www.nsa.gov/ia/academia/acade00001.cfm
Jenny Griffith CIS Secondary Tech Prep Liaison Walled Lake Central High School
Beginning the Educational Path
Building a model for a career focused on Information Assurance education and training through High School curricula
• • • • • •
The Oakland County Tech Prep Consortium is comprised of:
28 local school districts 44 high schools four technical campuses business/industry/labor affiliates five campuses of Oakland Community College Oakland Schools, the intermediate school district of Oakland County.
An Overview of Oakland County, Michigan • Geography:
Located north of Detroit; 910 square miles. The county has 450 lakes within its boundaries.
• Population:
1,134,195. For the year 2000, the estimated median age of the county was 36.7 years.
• Median Income:
1999, which is the latest data, is $61,907 (U.S. average = $41,994).
The median income per household based upon
• Commerce:
Forty-five Fortune 500 companies do business in the County. It is the third wealthiest county in the nation. One third of all U.S. auto production takes place within 70 miles of the County. Robotics firms in Oakland County account for more than 50% of all U.S. robotics sales .
Step one in “the process”
Agreeing upon specific measurable competencies which fulfilled requirements of degree and certificate programs at Oakland Community College
Competencies
0 1 2 3 4 1.
Recognize important Internet committees
2. 3. 4. 5. 6. 7.
Understand basic workings of the Internet Identify most common Web browsers Understand FTP Demonstrate basic workings of e-mail and newsgroups Differentiate real time and asynchronous communications Understand Web technologies, helper applications, and plug-ins (what are they used for and when is their use appropriate.)
8. 9.
Identify and understand anti-virus software Know and perform internet searching using various browsers
10.
Understand HTML and its function as a markup language
Poster
Careercruising.com
Oakland County Tech Prep Consortium
Oakland Community College / High School Advanced Placement Credit Agreement Computer Information Systems (CIS) District / School: ____________________________________________________________________________ Address: __________________________________________________________________________________ City: ______________________________________________________________________________________ O.C.C. Program(s): Computer Information Systems (CIS)(11.0199) Electronics Technology (ECT)(15.0303) Oakland Community College will award advanced placement credit to students for the secondary course(s) according to the conditions / requirements listed below. Advanced Placement Credit applies to OCC degrees and certificates. This agreement is valid until date of discard. Corresponding Course(s) No: Replaces the following O.C.C. Course(s)/Credits providing High School Course(s) 11.1000 conditions and requirements below are fulfilled: CIS 1050 Personal Computer Productivity Tools (CCNA or CNA) (4 Credits) CIS 1300 Networking Concepts (Net + Certification) (4 Credits) CIS 1400 Introduction To Web Systems (4 Credits) CIS 2940 Novell Certification Test Prep (CNA) (3 Credits) ECT 2150 Computer Repair I (3 Credits)
Total OCC Credits Possible: 18
Conditions and Requirements: 1. Students must apply for Advanced Placement credit within two years of high school graduation. 2. Students must complete OCC-ES10 Advanced Placement Credit form with their high school counselor and send it to OCC with their application for admission. 3. Students must attain a Level 3 or 4 on all competencies or pass the appropriate certification exams to be accepted unconditionally into the OCC portion of the program. Any deficiencies will require additional course work at OCC.
School District Oakland Community College
Please sign and print name. Please sign and print name. _ _____________________________ / _________
Instructor Signature Date
Print name here: ___________________________ _ _____________________________ / _________
Principal Signature Date
__________________________________ / ________
College Program Liaison Signature Date
Print name here: _____________________________ __________________________________ / ________
Program Dean Signature Date
Print name here: ___________________________ Print name here: _____________________________ This agreement remains effective for two additional years after expiration date to permit student access to agreed upon credits.
The following dates are to be completed by the Tech Prep Director.
Agreement Implementation Date: 9/1/05 Agreement Expiration Date: 9/1/06 ____________________________________ Agreement Discard Date: 9/1/08 ______________________________________
Barbara K. Dursum, Director Date Oakland County Tech Prep Consortium
Ken Sigler CIS Post - Secondary Tech Prep Liaison Oakland Community College
Continuing the Educational Path
Vertical Articulation of High School Curricula to a community college nationally recognized for Information Assurance education & training
Credit Though Agreed Upon Outcomes
•
Outcome matching process
• •
CIS Discipline Support College Administrative Support
•
Instructor enforced contractual agreement
Overcoming IT Outsourcing
Shifts In Information Technology
The CNSS - IACE Program
• Authentication of compliance is provided by
the
Information Assurance Courseware Evaluation Program (IACE) • The IACE Program was established under the authority of the CNSS •
CNSS certification validates that a curriculum conforms to
best practice in IA
.
•
The IACE Process
Experts at the IACE perform an assessment
of the degree to which an institution’s courseware maps to national standards. • That certification ensures that all of the elements are covered •
Thus certified institutions can be assured to
meet the minimum national training and education standards for IA
Acting as the Middleman
Dan Shoemaker, PhD Professor & Director Center for Information Assurance Studies
Continuing the Educational Path
Vertical Articulation of Community College Curricula to a University Center of Excellence
The IA Body of Knowledge •
The Complete IA Body of Knowledge comprises:
Encyclopedic Knowledge
and principles - Facts, technologies,
Process Knowledge
– How those facts are used
Outcomes This is captured by 385 behavioral outcomes •
The core knowledge, skill and ability (KSA) model is divided into two major categories Things you need to know Things you need to be able to do
Things You Need to Know • Fundamental Security Elements • Technology-Oriented Security Elements • Organization Specific Security Elements • Laws and Regulations
Things You Need to Be Able to Do • Designing and Engineering the System to be Secure • Using and Operating the System Securely
Aligning Curricular Focus •
Typically the first two years
Focuses on the Basic Principles Focuses on Technique versus Application Focuses on “Getting it”
Aligning Curricular Focus • Typically the last two years Focuses on Application and Innovation Focuses on Integrating Principles into Structures Focuses on “Staying on Top of It”
Areas of Focus – First Two Years • Basic Information States –
Transmission
–
Storage
–
Processing
• Fundamental Information Characteristics –
Trust
–
Integrity
–
Confidentiality
Areas of Focus – Second Two Years • Advanced Information Characteristics –
Authentication
–
Non-Repudiation
–
Legal Compliance
• Security Measures –
Policy and Practice
–
Development) (BCP) Technical Application (Access, Secure
–
Education and Training
Typical Articulation •
Community College Courses
– Technical Foundations •
Machine Architecture/Internal Representation
• •
Software Function Fundamentals Secure System and Software Configuration
• • •
Basic Software Development Practice Network Fundamentals (OSI) Network Architecture
– IA Principles
Typical Articulation •
Articulates with University Courses
– Technical Applications • Forensics • Encryption • Software Engineering • Attack/Defense Theory – Security Measures • Risk and Threat Analysis • Assurance Practices • Business Organization Theory and Development • Security Standards (BOK)
Some Advice Based on Experience •
Have a very small core requirement
– UDM has five core courses – Specification, Project Management, Software Assurance, Testing Methods and Network Security •
Articulate
System and Software Assurance
and
Networking
the program.
courses as electives into
•
Pre-identify as many
relevant
possible as general electives courses as
Questions
New National Centers of Academic Excellence in Information Assurance Education
2004