Who bears the cost?

3 days

After examining the roles and interests of stakeholders, this lesson delves deeper into costs. It begins with a comparison of a global pandemic to a global cybersecurity incident. The information is drawn from The Solarium Commission White Paper “Cybersecurity Lessons from the Pandemic.” Prevention is less expensive than reaction. The other activities involve student identification of economic loss from a cyber attack, and the cost of an Internet shutdown to estimate the economic cost of Internet disruptions.

Unit 5 – Lesson 4 – “Policy Controls”

2 Days

This lesson focuses on security policies as controls. The focus is on the implementation of the policy, updates, and policy enforcement. Students work on activities that highlight the importance of security policies for ensuring the confidentiality, integrity, and availability of data. The lesson concludes with a laboratory exercise where the students experiment with installation and removal of software on an organizational machine in violation of an acceptable use policy.

Unit 5 – Lesson 3 – “Asymmetric Cryptography”

11 Days

Shifting from symmetric to asymmetric cryptography, this lesson takes students on a deeper dive beginning with the concept of public key cryptography to round out the use of cryptography as a mechanism to maintain confidentiality. The lesson shifts to the connection that cryptography has to ensure integrity through the study of hash functions, before making a final shift to the study of digital signatures.

Unit 5 – Lesson 2 – “Symmetric Cryptography”

4 Days

This lesson focuses on symmetric key cryptography, beginning with an overview of what cryptography is and the fundamental ideas of symmetric encryption. This sets the stage for later in the unit when students learn about asymmetric cryptography. Students will begin with learning about basic ciphers and a historical perspective providing context for the field of cryptography beyond the use of modern computers. Students will learn about modern symmetric ciphers and, by the end of the lesson, they will be comfortable encrypting and decrypting using a variety of techniques.

Unit 5 – Lesson 1 – “Data Controls”

4 Days

As students learned in Unit 4, data is a complex topic. This lesson introduces students to controls used for protecting data and begins the dive into more advanced controls explored throughout this unit. First, the focus is on refining student understanding of authentication, authorization, identification, and access control. Students learn about types of access control, including Role Based Access Control (RBAC), Mandatory Access Control (MAC), and Discretionary Access Control (DAC). The lesson concludes with an investigation into where various controls can go wrong with faulty authentication, authorization and/or access control.

Unit 5 – Lesson 8 – “Impact of Failure – Responsiveness to Change”

2 Days

This lesson is meant to help students to see that all of the controls from this unit come together to form a complex system that has weak points. Students are tasked with working in groups to take the context of an organization and outline which controls and structures they will need in which places, drawing from their learning throughout Unit 5 and prior. Students create a graphical representation of the system and place controls where appropriate, present to the class, and revise to demonstrate that cybersecurity is an ever-changing process and the most secure systems are responsive to change.

Unit 5 – Lesson 7 – “Software and Hardware Controls”

4 Days

In this lesson, the focus is on the software and hardware controls (secure design and secure software development lifecycle, static and dynamic software analysis, vulnerability management, and hardening of Operating Systems (OS) and software applications) that are in place to fix vulnerabilities and defend from exploits. Students will conduct a hands-on lab with OS hardening.