e-Security 2014

Topics

• Security Architecture
  • Security principles (least privilege)
  • Security policy: firewall policy, e-mail and Internet policy, security architecture
  • Division of duties
  • Technical security measures: network segmentation, firewalls, intrusion detection, secure configurations, secure application architectures
  • Security architecture components
• Why e-Security is necessary
  • Security goals
  • Threats to e-business
  • Spoofing
  • Quantitative and technical analysis of threats
  • Sniffing, hacking
  • Denial-of-service attacks
• Securing Websites (inbound access)
  • Server security: web server, application and data(base) servers, WAP server and DNS server
  • Website architectures
  • Transaction security
• Firewalls
  • Router, bastion host
  • Firewall architectures
  • Packet filtering
  • DeMilitarised Zone (DMZ)
  • Application level filtering
• Identification, authentication, authorisation and encryption techniques
  • Directory Services
  • Public Key Infrastructure (PKI) concepts
  • Trusted Third Party
  • Single Sign-On (SSO)
• Secure Internet Use (outbound access)
  • Mailserver security
  • Internet and e-mail usage policy
  • Scanning: e-mail traffic for viruses, browser connections (Java applets, Java script, ActiveX)
  • Proxy server
• Legal Issues
  • Securing personal data
  • Outsourcing contracts (site development, site hosting, content management, personnel)
  • Legal aspects of e-commerce
  • Computer crime
• Security Management
  • Security management processes
  • Security organisation: information strategy, plan, policy, security roles and responsibilities
  • Setting up security logging, monitoring and reporting
  • Preventive, detective and corrective security measures
  • Questions and answers
• Dealing with Hackers
  • Collecting evidence
  • Policy and legal measures
  • `Honey pots` and their uses
  • Using intrusion detection