APPIN TECHNOLOGY LAB

FRONT RUNNER DIPLOMA

INFORMATION SECURITY
COURSE CONTENT
MODULE: INTRODUCTION TO INFORMATION SECURITY

Objective:
1. Understand Basics of computer networking
2. Need of information security
3. Understand cyber threats and issues

Goal: Learn fundamentals for Information security

Description:
 INFORMATION SECURITY
 ESSENTIAL TERMINOLOGIES
 SECURITY AND ITS NEED
 WHY IS IT SECURITY NECESSARY?
 IT SECURITY SERVICES LIFE CYCLE
 OPERATING SYSTEM BASICS
 DATA COMMUNICATION BASICS
 BASICS OF COMPUTER NETWORKING
 OSI AND TCP/IP MODEL
 TCP VS UDP
 TCP FRAME STRUCTURE
 UDP FRAME STRUCTURE
 TCP COMMUNICATION FLAGS
 NETWORKING DEVICES
 CYBER THREATS AND ISSUES
 PROTECTING YOUR COMPUTER AND NETWORK
 SOFTWARE SECURITY FOR PORTABLE COMPUTERS
 PROTECTING YOUR PASSWORD AND LOGGING ON SECURELY
 SELECTING TOOLS
 INFORMATION SECURITY POLICIES AND IMPLEMENTATION

MODULE: DESKTOP AND SERVER SECURITY

Objective:
1. Understand attack and security infrastructure for system.
2. Linux and Windows 8 security

Goal: Exposure to system security

APPIN TECHNOLOGY LAB
Description:

UNIT 1: DESKTOP AND SERVER SECURITY

 INTRODUCTION
 SECURING YOUR MIGRATED WINDOWS 7 DESKTOP
 DESKTOPS: LOCAL RIGHTS AND PRIVILEGES
 OVERALL DESKTOP SECURITY
 WHAT IS REGISTRY?
 REGISTRY EDITING
 BACKUPS AND RECOVERY
 POLICY
 STEPS TO CREATE REGISTRY VALUES
 SOME OF THE EXAMPLES TO CHANGE THE REGISTRY DEFAULT SETTINGS
 NT SECURITY
 THE LOGON PROCESS
 SECURITY ARCHITECTURE COMPONENTS
 INTRODUCTION TO SECURING IN NT BOX
 BACKUPS
 WINDOWS VULNERABILITIES AND THREATS
 DETERMINING IF YOU ARE ACTIVELY BEING COMPROMISED
 CLIENT –SERVER ARCHITECTURE
 SERVER SECURITY PRINCIPLES
 SECURING THE SERVER OPERATING SYSTEM
 APPLICATIONS AND NETWORK PROTOCOLS
 CONFIGURE OS USER AUTHENTICATION

UNIT 2: WINDOWS 8 INTRODUCTION AND SECURITY

 INTRODUCTION.
 SIMILARITIES BETWEEN WINDOWS 7 & WINDOWS 8.
 NEW FEATURES OF WINDOWS 8.
 HARDWARE RECOMMENDATIONS.
 HARDWARE INNOVATIONS.
 WINDOWS 8 EDITIONS.
 GETTING STARTED WITH WINDOWS 8.
 PROTECTING THE CLIENT AGAINST THREATS.
 BOOT OPTIONS FOR SECURITY.
 SMART SCREEN.
 VULNERABILITY MITIGATION AND SANDBOXING.
 PROTECTING SENSITIVE DATA: BITLOCKER.
 SECURE ACCESS TO RESOURCES:

UNIT 3: LINUX SECURITY

 INTRODUCTION
 BENEFITS OF LINUX
 HOW SECURE SHOULD MY LINUX BE?
 WINDOWS VS. LINUX DESIGN
APPIN TECHNOLOGY LAB
 LAYERS OF LINUX/UNIX
 LINUX DIRECTORY STRUCTURE (FILE SYSTEM STRUCTURE) EXPLAINED WITH EXAMPLES
 SHADOW AND PASSWORD FILES
 HOW TO SET UP A FIREWALL UNDER LINUX?
 SECURING AND HARDENING TIPS LINUX SYSTEMS
 REALISTIC SECURITY AND SEVERITY METRICS

MODULE: DATA SECURITY

Objective:
1. Understand data backup and recovery strategies
2. Understand cryptography and steganography
3. Understand physical security methods

Goal: Exposure to methods for securing data

Description:

UNIT1: DATA SECURITY

 INTRODUCTION
 DATA SECURITY MANAGEMENT
 CHARACTERISTICS OF ACCESS SECURITY IN THE SYSTEM
 TYPES OF DATABASE ATTACKS
 DATA SECURITY ISSUES AND SOLUTIONS
 INTRODUCTION TO CLOUD COMPUTING
 PROTECTING THE USERS
 CLOUD COMPUTING IN REAL DOMAIN
 BENEFITS FROM CLOUD COMPUTING

UNIT 2: DATABACKUP
 DATA BACKUP
 INTRODUCTION
 DATA BACKUP STRATEGIES
 OFFLINE DATA BACKUP
 ONLINE DATA BACKUP

UNIT 3: CRYPTOGRAPHY
 STRENGTH OF THE CRYPTOGRAPHY
 SOME TECHNICAL TERMS
 TYPES OF CIPHER TEXT
 TYPES OF CRYPTOGRAPHY
 DATA ENCRYPTION STANDARD (DES)
 IDEA: INTERNATIONAL DATA ENCRYPTION ALGORITHM
 ASYMMETRIC CRYPTOGRAPHY
 RSA ALGORITHM
 HASH FUNCTIONS&ALGORITHM
APPIN TECHNOLOGY LAB
 DIGITAL SIGNATURES
 DIGITAL CERTIFICATION

UNIT 4: STEGANOGRAPHY
 OVERVIEW
 STEGANOGRAPHY TECHNIQUES
 TYPES OF STEGANOGRAPHY
 STEGANALYSIS
 STEGANOGRAPHY DETECTION TOOL

UNIT 5:- PHYSICAL SECURITY

 HARDWARE BASED MECHANISMS FOR PROTECTING DATA:
 SOFTWAARE BASED MECHANISMS FOR PROTECTING DATA:
 BIOMETRIC SECURITY

MODULE: NETWORK SECURITY

Objective:
1. Exposure to network level attacks
2. Understand wireless and router security
3. Understand IDS/IPS

Goal: Exposure to network hacking and security

Description:

UNIT 1: VIRTUAL PRIVATE NETWORK SECURITY

 INTRODUCTION TO VPN
 APPLICATION & REQUIREMENTS OF VPN
 VPN TYPES
 OPEN VPN
 MODELS OF VPN
 IPSEC VPN
 VPN SECURITY FRAMEWORK
 VPN SECURITY ISSUES
 OTHER VPN THREATS

UNIT 2: WIRELESS LAN

 INTRODUCTION
 802.11 STANDARDS OF WLAN
 BASICS OF WIRELESS LAN
 ANTENNAS
 ACCESS POINT POSITIONING
 ROGUE ACCESS POINT
 WIRED EQUIVALENT PRIVACY
 DOS ATTACK
APPIN TECHNOLOGY LAB
 MAN IN MIDDLE ATTACK (MITM)
 COUNTERMEASURES FOR WLAN
 TOOLS
 WIRELESS INTRUSION DETECTION
 WIRELESS INTRUSION PREVENTION
 OPEN SOURCE SCANNING SOFTWARE

UNIT 3: ROUTER SECURITY

 WHAT IS A ROUTER?
 STATIC AND DYNAMIC ROUTING
 WORK TO ROUTER
 KEEPING THE MESSAGES MOVING
 DIRECTING TRAFFIC
 TRANSMITTING PACKETS
 KNOWING WHERE TO SEND DATA
 MAC ADDRESSES
 UNDERSTANDING THE PROTOCOLS
 TRACING THE MESSAGE
 DENIAL OF SERVICE ATTACK
 CONFIGURATION OF ROUTER
 PROTOCOLS ON A ROUTER
 RFC 1483
 HANDSHAKE PROTOCOLS
 NAT (NETWORK ADDRESS TRANSLATION)
 NAPT SERVICES
 ADSL DETAILS
 TROUBLE SHOOTING
 ROUTING TABLE PROBLEMS
 VARIOUS TYPES OF INTRUSION
 SECURING THE ROUTERS

UNIT 4: INTRUSION DETECTION AND PREVENTION

 INTRODUCTION
 INTRUSION DETECTION AND PREVENTION
 IDS
 NEED OF IDS
 COMPONENTS
 TYPES
 WHAT IS NOT AN IDS?
 DETECTION METHODOLOGIES
 VARIOUS TOOLS AVAILABLE
 LIMITATIONS OF IDS
 INTRUSION PREVENTION SYSTEM
 TYPES
 NETWORK BASED IPS
 COUNTER MEASURES TAKEN BY AN IPS
APPIN TECHNOLOGY LAB
 RISKS INVOLVE

UNIT 5: ACCESS CONTROL SYSTEM

 INTRODUCTION: WHAT IS ACCESS CONTROL
 ACCESS CONTROL IN PHYSICAL SECURITY
 ACCESS CONTROL IN INFORMATION SECURITY
 NEED OF AN ACCESS CONTROL SYSTEM
 SOME CONCEPTS RELATED TO ACCESS CONTROL
 ACCESS CONTROL TECHNIQUES
 NON-DISCRETIONARY ACCESS CONTROL
 MANDATORY ACCESS CONTROL (MAC)
 ROLE-BASED ACCESS CONTROL
 LATTICE BASED ACCESS CONTROL
 CHINESE WALL
 ACCESS CONTROL MODELS

MODULE: WEB SECURITY

Objective:
1. Understand firewalls and proxy
2. Understand sniffing
3. Understand security for internet access

Goal: Exposure to security issues on internet

Description:

UNIT 1: LAN SECURITY

 THE INITIAL INTERNETTING CONCEPTS
 INTRODUCTION TO LAN
 WHY LAN SECURITY IS IMPORTANT
 LAN/WAN COMPONENTS
 TOPOLOGY
 PROTOCOLS
 THREATS OF LAN
 INAPPROPRIATE ACCESS TO LAN RESOURCES
 DISCLOSURE OF DATA
 UNAUTHORIZED MODIFICATION OF DATA AND SOFTWARE
 DISCLOSURE OF LAN TRAFFIC
 SPOOFING OF LAN TRAFFIC
 DISRUPTION OF LAN FUNCTIONS
 SECURITY SERVICES AND MECHANISMS
 PROTECTING MAC ADDRESS
 NETWORK SCANNERS
 TYPES OF SCANNING
 SCANNING METHODOLOGY
APPIN TECHNOLOGY LAB
UNIT 2: FIREWALL SECURITY
 FIREWALLS
 WORKING OF FIREWALL
 TYPES OF FIREWALL
 FIREWALL MONITORING.
 PROXY SERVER
 USE OF PROXY
 WORKING OF PROXY SERVER
 APPLICATIONS OF FIREWALL
 FIREWALL EVASION TOOL

UNIT 3: INTERNET SECURITY

 INTRODUCTION
 SECURITY INTRUSIONS AND SECURITY PROPERTIES
 THREATS FACED ON INTERNET
 TYPES OF INTERNET SECURITY
 INTRODUCTION TO IP ADDRESSES
 FINDING IP ADDRESS OF A REMOTE SYSTEM
 HIDING YOUR IDENTITY: ANONYMOUS SURFING
 WHAT IS A SOCKS PROXY SERVER?

MODULE: VAPT

Objective:
1. Understand the need of VAPT
2. Understand how VAPT is performed and various tools

Goal: Learn VAPT skills

Description:

UNIT 1: INTRODUCTION TO VAPT

 INTRODUCTION
 IMPORTANT TECHNICAL TERMS
 INFORMATION GATHERING
 SCANNING AND FINGERPRINTING

UNIT 2: VULNERABILITY ASSESSMENT

 VULNERABILITIES
 VULNERABILITY ASSESSMENT
 PROTECTIVE MEASURES
 STEP WISE APPROACH
 VULNERABILITY ASSESSMENT: THE RIGHT TOOLS TO PROTECT YOUR CRITICAL DATA
 TYPES OF VULNERABILITY ASSESSMENT
 THE CHALLENGES OF VULNERABILITY ASSESSMENTS
APPIN TECHNOLOGY LAB
 TOOLS FOR VA
 RISK ASSESSMENT
 NETWORK SECURITY AUDIT CASE STUDY

UNIT 3: PENETRATION TESTING

 INTRODUCTION AND METHODOLOGY
 TYPES OF PENETRATION TESTS
 METHODOLOGY
 PENETRATION TESTING APPROACH
 PENETRATION TESTING VS VULNERABILITY ASSESSMENT
 HOW VULNERABILITIES ARE IDENTIFIED
 A SAMPLE PENETRATION TESTING REPORT
 SECURITY SERVICES
 SECURITY SERVICES MANAGEMENT TOOLS
 FIREWALL
 AUTOMATED VULNERABILITY SCANNING
 AN APPROACH TO VULNERABILITY SCANNING
 DENIAL OF SERVICE (DOS) TESTING
 WIRELESS PENETRATION TESTING
 PENETRATION TESTING TOOLS
 ESCALATION OF PRIVILEGES
 CASE STUDIES

MODULE: PROTECTION FROM CYBER ATTACKS

Objective:
1. Understand malware attacks and security
2. Understand how google is used by hackers

Goal: Learn about malware attacks and google hacking

Description:

UNIT 1: MALWARES
 INTRODUCTION TO MALWARES
 TYPES OF MALWARES
 INFECTIOUS MALWARE
 VULNERABILITY TO MALWARE
 ANTI-MALWARE STRATEGIES
 INSTALLING BOTS ON TARGET MACHINES
 WORKING OF BOTS
 MALWARE DETECTION TECHNIQUES
 COUNTER MEASURES

UNIT 2: NETWORK INTRUSION

 INTRODUCTION
APPIN TECHNOLOGY LAB
 TYPES OF INTRUSIONS
 NON-TECHNICAL INTRUSIONS
 TABNABBING
 BACKTRACK
 BACKDOOR
 BACKDOOR COUNTERMEASURES
 ROOTKITS
 MONITORING TOOLS
 MALWARE GLOSSARY

UNIT 3: ART OF GOOGLING

 INTRODUCTION
 THE GOOGLE TOOLBAR
 SEARCHING TECHNIQUES
 DIRECTORY LISTING
 LOCATING CGI-BIN
 LOCATING ROBOTS.TXT
 CAMERA INTRUSION
 SOME TRICKS
 THE HARVESTER TOOL
 ARTICLES

MODULE: INFORMATION SECURITY MANAGEMENT SYSTEM

Objective:
1. Understand need for ISMS
2. Understand security auditing and various frameworks

Goal: Exposure to ISMS and ISO auditing

Description:

UNIT 1: SECURITY AUDITING

 INTRODUCTION
 SECURITY AUDITING OBJECTIVES
 RISK INVOLVED
 AUDITING STEPS
 AUDITED PROCESSES.
 AUDITED SYSTEMS.
 AUDITING APPLICATION SECURITY.

UNIT 2: LEAD AUDITOR: IT (LA-27001

 INTRODUCTION
 PURPOSE OF STANDARDS
 CONTROLS & ITS OBJECTIVES
 ISO/IEC 27001 AUDITOR: AUDITOR’S ROLES AND RESPONSIBILITIES
APPIN TECHNOLOGY LAB
 REVIEW OF THE ISO 27001:2005
 UNDERSTANDING OF THE RELATIONS BETWEEN ISO 27001:2005
AND ISO/IEC 17799:2005
 SECURITY RELATED THREAT AND VULNERABILITIES EVALUATION
 UNDERSTANDING OF THE SECURITY CONTROLS AND COUNTERMEASURES

MODULE: CYBER LAWS AND IT ACTS

Objective:
1. Understand the role of cyber laws and acts

Goal: To know what is illegal in IT environment

Description:

 INTRODUCTION
 CYBER LAWS: INTERNATIONAL PERSPECTIVE
 E-GOVERNANCE
 IMPEDIMENTS IN IMPLEMENTING E-GOVERNANCE PROJECTS FROM LEGAL PERSPECTIVE
 ANALYSIS OF PROBLEMS – REPERCUSSIONS
 RELEVANT LAWS
 JURISPRUDENCE OF INDIAN CYBER LAW
 THE INFORMATION TECHNOLOGY ACT, 2000 (SOME LAWS)
 AMENDMENT TO THE IT ACT 2000 BY ITAA2008
 ADVANTAGES OF CYBER LAWS
 PROSECUTION OF CYBER CRIMES UNDER INDIAN CYBER LAWS (IT ACT, 2000)
 PROBABLE SOLUTIONS
 ARTICLES ON CYBER LAWS
 CASES ON CYBER LAWS

MODULE: CYBER FORENSICS

Objective:
1. Understand need for forensics and various strategies
2. Forensics of mobiles and computers

Goal: Learn computer and networking skills

Description:

UNIT 1: CYBER CRIME

 CYBER SECURITY & FORENSICS
 WHAT IS CYBER CRIMES?
 CLASSIFICATION OF CYBER CRIME
 WHY LEARN ABOUT CYBER CRIME
 TYPES OF CYBER CRIME
 CHARACTERISTICS OF COMPUTER CRIME
APPIN TECHNOLOGY LAB
 PREVENTION OF CYBER CRIME
 QUESTIONNAIRE BASED ON RECOMMENDATIONS FROM THE FOURTH MEETING OF
GOVERNMENTAL EXPERTS ON CYBER-CRIME CYBER CRIMINALS
 CASE STUDIES

UNIT 2: CYBER FORENSICS

 CYBER FORENSICS: DETAILED VIEW
 DIGITAL EVIDENCE
 CHALLENGES OF FORENSIC SCIENCE
 FORENSIC METHODOLOGY
 SOME FORENSIC SOFTWARES/ HARDWARES
 BASIC APPROACHES
 FORENSICS TOOLS EXAMPLE

UNIT 3: CATCHING CRIMINALS

 CYBER TERRORISM- THE DARK SIDE OF THE WEB WORLD
 HONEY POTS AND HONET NETS

UNIT 4: MOBILE FORENSICS

 INTRODUCTION TO MOBILE FORENSICS
 GENERAL PHONES (NOKIA, SAMSUNG, LG)
 BLACKBERRY DEVICES
 CHINESE DEVICES
 ANDROID PHONES
 EXTRACTION METHODS OF MOBILE FORENSICS
 MOBILE PHONE CHARACTERISTICS
 MOBILE FORENSIC ANALYSIS
 THE CHALLENGES OF MOBILE FORENSICS
 TOOLS FOR MOBILE FORENSICS
 FORENSIC TOOLKIT

MODULE: COMMUNICATION SECURITY

Objective:
1. Learn mobile communications basics
2. Understand VOIP security
3. Learn attacks and security measures for emails

Goal: Exposure to security and threats for various communication methods

Description:

UNIT 1: MOBILE SECURITY

 INTRODUCTION
 WHAT IS MOBILE?
 ARCHITECTURE OF MOBILE COMMUNICATION
APPIN TECHNOLOGY LAB
 MOBILE GENERATION
 TECHNOLOGY OF MOBILE COMMUNICATION
 MOBILE PHONE STANDARDS
 PROTOCOLS USED IN MOBILE
 INTRODUCTION TO SMS MESSAGING
 SIM
 INTRODUCTION TO MOBILE OS
 POPULAR OPERATING SYSTEMS
 ANDROID FROM GOOGLE INC.
 BLACKBERRY OS FROM RIM
 IOS FROM APPLE INC
 SYMBIAN OS
 WINDOWS PHONE OS
 SAMSUNG BADA
 WHAT IS NFC, HOW IT WORKS AND WHAT ARE ITS PRACTICAL APPLICATIONS
 WHY IS MOBILE SECURITY IMPORTANT?
 MOBILE PLATFORM COMPARISON
 MOBILE THREATS
 TRENDS OF MOBILE THREATS
 WHAT IS BLUETOOTH? & HOW DOES IT WORK??
 HOW BLUETOOTH CREATES A CONNECTION
 BLUETOOTH INTRUSIONS ON MOBILE PHONES
 BLUETOOTH WEAKNESSES
 MOBILE SAFEGUARDS AND SOLUTIONS

UNIT 2: VOICE OVER INTERNET PROTOCOL

 DEFINITION & TRENDS
 SERVICES
 TYPES OF VOIP
 COMPONENTS OF VOIP
 IP TELEPHONY & IP PAGING
 PROTOCOLS AND ACRONYMS
 REASONS FOR VOIP
 PROBLEMS IN VOIP
 VOIP SECURITY SCENARIO
 HOW DO WE SECURE VOIP?
 TYPES OF VOIP ENCRYPTION AND AUTHENTICATION

UNIT 3: E-MAIL SECURITY

 INTRODUCTION
 HISTORY OF E-MAIL
 EMAIL ADDRESSES
 HOW E-MAIL WORKS?
 VARIOUS MAIL SERVERS
 E-MAIL PROTOCOLS
 ANALYSIS OF EMAIL HEADERS
APPIN TECHNOLOGY LAB
 EMAIL TRACKING
 IP TRACKING USING EMAIL
 SPAMMING
 WAYS TO PREVENT SPAM
 SECURITY THREATS TO YOUR EMAIL COMMUNICATIONS(recent updates)
 SETUP EMAIL FILTER IN GMAIL, HOTMAIL & YAHOO
 HOW TO STEAL DATA FROM AN E-MAIL?
 E-MAIL EXCHANGE SERVER SECURITY
 VIRUS PROTECTION
 RPC OVER HTTP
 PROTECTING FRONT-END SERVERS
 KEEP EXCHANGE SERVER UP-TO-DATE
 CYBER LAWS REGARDING SPAMMING
 SECURITY POLICIES