Syllabus

1. Basic concepts of information security, its importance in practice, and the consequences of neglecting security in organisations. Information security management. Explanation of core concepts such as the CIA triad, assets, threats and risk. Discussion of the impact of security failures on operations and reputation. Introduction to Information Security Management Systems (ISMS). 2. Information assets and their attributes. Definition of information assets, including physical, logical and human assets. Attributes such as value, sensitivity, availability and criticality for organisational functioning. 3. Authentication and identification; authentication and identification systems; biometric systems. Overview of identity verification methods, multi-factor authentication, passwords, tokens and certificates. Characteristics and security properties of biometric technologies. 4. Threats, incidents and classification of computer malware. Types of threats and malware categories (viruses, worms, ransomware, spyware). Methods for detecting and managing security incidents. 5. Intentional and unintentional attacks; attack life cycle; consequences of incidents. Phases of an attack from reconnaissance to data exfiltration. Distinction between technical and social attacks. Analysis of operational and organisational impacts. 6. Characteristics and types of intentional attacks. Typical attack scenarios such as phishing, DDoS, SQL injection, man-in-the-middle and privilege escalation. Attacker motivations and detection approaches. 7. Fundamentals of cryptography (symmetric and asymmetric encryption). Principles of key-based cryptography, hashing and digital certificates. Overview of modern algorithms and their practical applications. 8. Types of antivirus protection, their quality and use for computers and mobile devices. Comparison of signature-based, heuristic and behavioural detection. Endpoint protection across platforms and evaluation of their effectiveness. 9. Electronic signature, certification authorities, and their importance in practice. Legal and technical aspects of electronic signatures. The role of Certification Authorities, qualified certificates and their use in digital communication. 10. Security policies and standards (ISO); security plans and their preparation. Development of security documentation and policies. Overview of ISO/IEC 27000 standards and requirements arising from cybersecurity legislation. 11. Criteria for evaluating security; risk analysis and self-assessment in organisations; security models. Fundamental methods for risk management, vulnerability assessment and security maturity models. Procedures for internal audits. 12. Teamwork on case studies: how to design a security plan. Team-based threat analysis, proposal of security controls, and documenting a practical security plan. Assessment of feasibility and organisational impact. 13. Analysis of IT security at the university and proposals for improving IT security. Audit of the existing security infrastructure, identification of deficiencies and weaknesses. Development of recommendations and innovative security improvements.