Cybersecurity

Prerequisites

We have successfully mapped to Information Systems Security Professionals, NSTISSI No. 4011 and System Administrators, CNSSI No. 4013E.

These certifications are valid June 2009 to June 2014.

Award

CNSS NSA Award (581.658 Kb) …(see Margaret for file on her hard drive) National Security poster.pdf

IA Partnerships

a. Shared Curriculum

Examples: IA teaching materials provided to technical school, universities, community colleges, K-12 schools, etc.

Hagerstown Community College has been a member of the CyberWatch initiative for three years. During that time period, we have attended the CISSE conference twice, attended numerous workshops (Cell phone forensics, Ethical Hacking, Computer forensics, Wireless Concepts, Case Studies, Remote labs, Security), participated in committee work for the CyberWatch initiative, worked closely with Fred Klappenburger and Elizabeth Harrision in developing programs, and mapped successfully to two NSA standards. During this time period we have reconstructed our Networking Technology program of study and developed a new program, Computer Forensics. We continue to be successful in establishing articulation partnerships with high schools and technical schools and have established an articulation agreement with Capitol College, which is a four year school. Having spent these development years creating a firm knowledge base, we recognize that we are a young program who will soon provide teaching materials to our partners.

Capitol College has recently asked us to participate in an NSF sponsored grant; The purpose of the capacity building portion of this grant is twofold: 1. to acquire the necessary technology to implement quality interactive voice and video technology, in order for us to achieve our primary goal of bringing the instructor to the student and the student to the lab; and 2. to engage community colleges as partners in harnessing the collective expertise from all participating partner institutions in order to broaden student access and strengthen the educational experience, thereby increasing each respective institution’s capacity to produce IA professionals.

Please note that as a CyberWatch school we receive materials, such as the CCDC competition DVD, and share these with our students. This acts as a recruitment tool for the IA field. Also, note our webpage for Networking Technology, http://www.hagerstowncc.edu/academics/divisions/technology-computer/ist/net [1]. This page displays our CyberWatch affiliation logo, CyberWatch video, CNSS logo, and picture of Margaret Spivey receiving the CNSS certificate from Mr. David Wennergren, Deputy Assistant Secretary of Defense for Information Management and Technology & DoD Deputy Chief Information Officer, Link to bio: http://www.defenselink.mil/cio-nii/org/ [2]. This press release was shared with 25 entities that are representative of the four state area.

…(see Margaret for file on her hard drive) Press Release Contacts – 11.09-1.docx

Andrea Rich – Hagerstown Magazine arich@publicopinionnews.com [3]

Board of Education kauffwil@wcboe.k12.md.us [4]

Brunswick Citizen citizen@mip.net [5]

Chamber of Commerce donna@hagerstown.org [6]

Chris Copley – Herald Mail Lifestyle Editor chrisc@herald-mail.com [7]

Community College Times cctimes@aacc.nche.edu [8]

Debby Heishman – Public Opinion Editor dheishman@publicopinionnews.com [9]

Ed Waters, Jr. – Frederick News Post Reporter ewaters@fredericknewspost.com [10]

Erin Harman – USM-H – PR Director eharman@hagerstown.usmd.edu [11]

Hancock News news@morganmessenger.com [12]

Herald-Mail Community News - general community@herald-mail.com [13]

Jake Womer – Herald Mail – Asst. City Editor jakew@herald-mail.com [14]

Joel Huffer – Herald Mail – Asst. City Editor joelh@herald-mail.com [15]

Journal Contact – Lifestyle Editor mbieniek@journal-news.net [16]

Joyce Nowell – Echo Pilot Editor jnowell@echo-pilot.com [17]

Julie Green – Herald Mail – Lifestyle Reporter julieg@herald-mail.com [18]

Linda Duffield – Herald Mail – City Editor lindad@herald-mail.com [19]

Mary Anne Burke – Wash. Co. Arts Council maburke@myactv.net [20]

Mia Hoover – Herald Mail Assistant miah@herald-mail.com [21]

MIX 95.1/WIKZ - top 40 in PA mix91.1@mix95.com [22]

NBC 25 mkraham@nbc25.com [23] NBC 25 pbickford@nbc25.com [24]

Peggy Hutson – Channel 99 hutsonp@hagerstowncc.edu [25]

Picket News editor@picketnews.com [26] Public Opinion - Chambersburg Community@publicopinionnews.com [27]

The Eagle 106.9 john.austin@123fargo.com [28]

The Record Herald news@therecordherald.com [29]

Tiffany Arnold – Herald Mail Lifestyle Reporter tiffanya@herald-mail.com [30]

Tony Mulieri – Herald Mail Community Editor tonym@herald-mail.com [31]

b. Shared Faculty

Examples: Faculty on curriculum development committee for more than one institution.

HCC faculty worked with CyberWatch faculty, such as Fred Klappenberger from Anne Arundel Community College, in shaping our IA curriculum. We continue to work with CyberWatch faculty and are happy to share work with new institutional members who are trying to develop their own IA curriculum.

Our faculty serve on advisory committees for Washington County Public Schools and Franklin County Technical Schools. Through this involvement we have an opportunity to influence high school curricula and to share best ideas.

Point Value: up to 5 points

c. Use of distance education technology and techniques to deliver IA courses.

Distance education includes live/delayed broadcasts, videotapes/CDs, lectures, and web-based IA courses.

The Networking Technology program offers courses via web-based learning and a combination of web/classroom instruction; this is known as a hybrid class.

Course	Method of Instruction
IST 154, Networking Basics	Web based
IST 155, 156, 255, 256 (CISCO)	Hybrid
IST 160, Intro to Security Fundamentals	Web based
IST 253, TCP/IP	Hybrid
IST 267, Network Security	Hybrid

We are looking forward to adopting CyberWatch online IA courses.

Point value: up to 5 points.

d. Evidence the program is providing students with access to IA Practitioners.

Example: guest lecturers working in IA industry, government, faculty exchange program with industry and/or government, etc.

Three of our adjunct instructors work daily in industry. They touch the lives of our students on a weekly basis. They present wonderful role models to IA students as practitioners in the field.

Brenda Hernandez: Linkedin profile: http://www.linkedin.com/in/blhernandez; [32] currently employed at the Pentagon for Pentagon Renovations and Reconstruction, Washington, DC., Advanced Systems Development.

Peter Medley: Currently employed at the Annapolis Police Department, Annapolis, Maryland and Detective Corporal, Forensic Computer and Cellular Telephone Examiner, assigned to US Secret Service Electronic Crimes Task Force, Baltimore Field Office.

Doug Horton: Functional Area Manager, Systems Engineering Solutions, Homeland Security, US Coast Guard Operations Center, Kearneysville, WV.

Point Value: up to 5 points

IA Student Development

a. Evidence of IA degrees/areas of study/track or certificates.

Example: List of IA Associates degrees and/or certificates in IA curriculum as listed on the institution's website or catalog, list of all IA program courses with their descriptions.

Point Value: 5 points

AAS IST Networking Technology degree program http://www.hagerstowncc.edu/sites/default/files/programs/09-tec-ist-deg_... [33] AAS Information Systems Technology, Concentration 4: Networking Technology

Certificate: Networking Technology http://www.hagerstowncc.edu/sites/default/files/programs/09-tec-istnt-ce... [34]

IA Course descriptions http://www.hagerstowncc.edu/academics/courses/Information%20Systems%20Technology%20(IST)

Forensics Degree http://www.hagerstowncc.edu/sites/default/files/programs/09-tec-ist-deg_... [33]

b. Evidence of Copies of Articluation/Transfer Agreements …(see Margaret for file on her hard drive)

Articulation Agreement between HCC and Capitol College

HagCC.BSIA Articulation Agreement DRAFT Dec09.doc (98 Kb)

Articulation Agreement between Capitol College and HCC (70.5 Kb)

Hagerstown CC.BSIA.Draft4.Dec09.doc (80.5 Kb)

Hagerstown IA Course Descriptions.doc (74.5 Kb)

This document is expected to be formally agreed upon soon.

Evidence of copies of articulation/transfer agreements with 4 yr. institutions offering a concentration or IA Degrees/areas of study/track or certificates.

Point Value: 5 points

HCC adopted the curriculum of the CyberWatch model which has been articulated by University Maryland University College, Capitol College, Towson University and University of Baltimore. As evidenced by the articulation agreement with Capitol College we are prepared to pursue articulation with the other schools. Anne Arundel Community College and Prince Georges Community College both adhere to the CyberWatch model and have obtained articulations with these schools.

c. Articulation agreements with high schools

Articulation agreements with high schools to facilitate awareness and training for faculty/administration/students.

A COPY OF THESE AGREEMENTS CAN BE FOUND AT…(see Margaret for file on her hard drive)

• Articulation between Washington County Public Schools and HCC
• Articulation Agreement with Franklin County, PA Technical School and HCC
• Articulation Agreement between Waynesboro PA Senior High School and HCC
• Articulation Agreement between Montgomery County and HCC

Point Value: 2 points per school/ 6 pts. maximum

d. Participation in Cyber/IA competitions

Our participation with CyberWatch, CISSE, NSA and IA curriculum development has been extremely active. Our forensic team was ready to participate in the last cup competition. Due to some timing issues, they missed the deadline for the competition. The students completed the exercises in the HCC classroom. Since we are a young program we have not yet actively participated in any Cyber/IA competition. As a young program, we continue to develop our classrooms to meet the need of students; future classroom development will allow us prepare students for CyberDefense/IA competition.

Point Value: 2 points per each / 6 pts. maximum

e. Courses containing "Hands-on" training or Lab training.

Point Value: 2 points per course / 6 pts maximum

IST 160 Information Security Fundamentals: This is the first course in the fundamentals of information, computer and network security. The course discusses common security issues, identifies methods of assessing systems to identify critical data and presents tools and techniques for securing computers and networks. Course objectives map to the CompTIA Security+ Exam and include general security concepts, communication security, infrastructure security, basics of cryptography and operational/organizational security.

IST 267 Network Security: Network Security is a course that examines the concepts of information, computer and network security. The course is presented at the beginning and intermediate technical level using lecture, lab and discussion format. Course goals include increasing awareness of security issues, defining basic security iterms, identifying security infrastructure and codes, and examining policies that may be employed in security management. Course content includes examining a broad range of domains: access control, telecommunications, security management, applications development, cryptography ,security architecture, operations security, disaster recovery planning, ethics, and physical security.

IST 155 Networking I: This course introduces the architecture, structure, functions, components, and models of the Internet and other computer networks. It uses the OSI and TCP layered models to examine the nature and roles of protocols and services at the application, network, data roles of protocols and services at the application, network, data link, and physical layers in conjunction with the Cisco Networking Academy. The principles and structure of IP addressing and the fundamentals of Ethernet concepts, media, and operations are introduced to provide a foundation for the curriculum. Introductory router/switch device configuration skills are also included.

IST 156 Networking II: This course describes the architecture, components, and operation of routers, and explains the principles of routing and routing protocols. Students analyze, configure, verify, and troubleshoot the primary routing protocols RIPv1, RIPv2, EIGRP, and OSPF. By the end of this course, students will be able to recognize and correct common routing issues and problems. This course is offered in conjunction with the Cisco Networking Academy.

IST 255 Networking III: This course provides a comprehensive, theoretical, and practical approach to learning the technologies and protocols needed to design and implement a converged switched network. Students learn about the hierarchical network design model and how to select devices for each layer. The course explains how to configure a switch for basic functionality and how to complement Virtual LANs, VTP, Inter-VLAN routing, and Spanning Tree Protocol in a convergent network. In conjunction with the Cisco Networking Academy, students also develop the knowledge and skills necessary to implement a WLAN in a small to medium network.

IST 256 Networking IV: This course discusses the WAN technologies and network services required by converged applications in enterprise Networks. Students learn how to implement and configure common data link protocols and how to apply WAN security concepts, principles of traffic, access control and addressing services.

IA Multidisciplinary Subject

a. Evidence that IA is taught as modules in existing non-IA courses…(see Margaret for file on her hard drive)

Evidence that IA is taught as modules in existing non-IA courses and that non-technical/non-IA students are being introduced to IA (for example: Non-technical/non-IA students are being introduced to IA concepts; e.g. business courses teaching Information Security modules, health courses - HIPAA regulations)

Point Value: 5 points

A COPY OF THESE AGREEMENTS CAN BE FOUND AT…(see Margaret for file on her hard drive)

• IA in Radiography
• IA in Dental Office Management
• IA in Health Record Analysis
• IA in Emergency Medical Technician

b. Evidence IA programs require non-technical courses of study …(see Margaret for file on her hard drive)

Evidence IA programs (certificate and/or degree programs) require non-technical courses of study: e.g. ethics, policy, and business.

Non-technical courses:

• ACC 101 Principles of Accounting I
• ACC 102 Principles of Accounting II
• STU 106 Professionalism in the Workplace
• BUS 145 Customer Service

Point Value: 5 points

A COPY OF THESE AGREEMENTS CAN BE FOUND AT…(see Margaret for file on her hard drive)

Non-technical Courses in IA program

c. Availability of non-credit/credit professional development courses in IA

Availability of non-credit/credit professional development courses in IA (e.g. First Responders, K-12 teachers)

HCC Fall Faculty Development Workshop: Steve Shank, Trudy Gift, Karen Weil-Yates conducted workshop to HCC faculty. Topics included: general computer interests, inclduing viruses, malware, secure storage and metadata. Faculty in attendance: 25

WEB 101 - Web Design I: Course content includes secure form validation guidelines. Students: 20 This course is taught as both credit and non-credit.

Students will learn fundamental design techniques of the web including graphics, HTML, JavaScript, rollovers, publishing with FTP and tables-based design. Dreamweaver will be the primary software used and students will learn to manage website's use templates, library items and gain a general understanding of the Dreamweaver design and coding environment. This course will serve as an introduction to Internet technologies used to support browsing, file transfers, e-commerce and user security. Steps will be taught on selecting and configuring software to support these activities. Other topics will include standards, accessibility (508), internet research and intellectual property rights as they relate to web content.

WEB 215 - Interactive Media: Course content includes secure form validation guidelines. Students: 20 This course will focus on Flash and other multimedia used on the web including video, sound, interactive media, forms, animation and JavaScript as well as integration into a website. Animation, Internet gaming, interactive design and online entertainment will be covered as well. Students will learn how to design for the Internet, mobile iphones, palmtop screens, web TV as well as consideration for future technologies.

Point Value: 5 points

IA Outreach

a. Evidence provided in the form of a Strategic Plan

Evidence provided in the form of a Strategic plan and/or general IA Awareness Program description (example: flyers, letters from sponsors, etc), and/or workshop accomplishments, (For example: sponsorship of workshops for K-12, senior citizen groups, community college, technical schools, state homeland security, first responders, industry, etc.)

From 2006 to 2009, Continuing Education, under the direction of Jack Drooger, offered biannually "Computer Safety Seminar" for the home computer user. These sessions were one hour in length. This seminar was offered to the community. See PowerPoint file below to view content of seminar.

Our goal for the future is to offer seminars addressing Information Assurance to employees in industry.

Point Value: up to 10 points

PPT presentation for Computer Safety Seminar…(see Margaret for file on her hard drive)

IA Faculty

a. Identify by name faculty member with overall responsibility

Identify by name faculty member with overall responsibility for the IA instructional program. Provided evidence, i.e. verification letter and/or job description.

Steve Shank, senior tenured full-time faculty, is designated as the Lead Instructor for the Networking Technology program. He was also instrumental in achieving mapping to the NSA standards. Steve has guided the curriculum for the Networking Technology program and Computer Forensics program.

Steve is currently a student at Capitol College earning a master's degree in Information Assurance. He has completed the following courses: Network Systems Security Concepts, Internal Protection, Vulnerability Mitigation, Malicious Software, Secure Info Transfer & Storage, Applied Wireless Network Security, Computer Forensics & Incident Handling, Legal Aspects Computer Security, Complementary Security. He is currently enrolled in Security Risk Management. He has two more classes to complete: Wireless Security, Perimeter Projection.

Point Value: 5 points (required)

Professional Development Plan for Steve Shank …(see Margaret for file on her hard drive)

Each year each faculty member creates a Professional Development Plan. This plan outlines the goals and duties of the faculty member for the academic year.

Steve Shank PDP IA Duties …(see Margaret for file on her hard drive)

b. Identify by name additional IA faculty members teaching IA courses.

Identify by name additional IA faculty members teaching IA courses within the department that sponsors IA programs.

• Peter Medley
• Brenda Hernandez
• Jack Drooger
• Doug Horton
• Trudy Gift
• Karen Weil-Yates (resume not available)
• Gini Khalsa (resume not available)

Point Value: 1 pt. per name / up to 5 maximum

c. Provide evidence in the form of curriculum vitae

Provide evidence in the form of curriculum vitae supporting the faculty member's qualifications to teach IA. At least one IA faculty member will be expected to be professional certified with at least one of the IA certifications listed under DOD Directive 8570, such as CISSP, CPP, CISA, CISM, GIAC, etc. or a minimum of 9 hrs of graduate coursework and/or appropriate experience in a related field could be considered in lieu of a professional certification.

Point Value: 5 points (required)

…(see Margaret for file on her hard drive)

Jack Drooger Resume for Jack Drooger (63 Kb) Jack is an adjunct instructor who teaches CISCO courses; Networking I, II, II, IV for HCC.

Resume for Brenda Hernandez Resume for Brenda Hernandez (65.5 Kb) Brenda Hernandez, an adjunct instructor for HCC, teaches Network Security Fundamentals.

Resume for Doug Horton Resume for Doug Horton (545.348 Kb) Doug Horton, an adjunct instructor, teaches UNIX for us.

Resume for Peter Medley Resume for Peter Medley (52 Kb) Peter Medley, adjunct instructor for HCC, teaches technical courses in our Computer Forensics program.

Resume for Steve Shank Resume for Steve Shank (23.5 Kb) Resume for Steve Shank, lead instructor for the Networking Technology program.

Resume for Trudy Gift Resume for Trudy Gift (15.388 Kb) Trudy Gift, senior tenured full-time faculty.

Practice of IA at HCC

a. Provide a link to the institution IA security plan and/or policies.

Point Value: up to 5 points

…(see Margaret for file on her hard drive)

Acceptable Computer Usage Policy HCC Acceptable Computer Usage Policy (20.037 Kb)

Identity Theft Prevention Program with Amendment Identity Theft Prevention Program with Amendment.doc (60.5 Kb)

Strategic Goals HCC Strategic Goals (26.5 Kb)

Mission and Vision Statements Mission and Vision Statement (23.5 Kb)

b. Institution designated Information System Security Officer

Institution designated Information System Security Officer or equivalent. Provide name, position and job description for person or persons responsible for information security.

Point Value: 5 points

While the college recognizes the importance of a Security Officer, the current financial fiscal environment does not allow us to hire staff for this position until 2012.

In 2010 HCC will undergo a security audit.

However, we do have three IT positions whose job description cite computer security and network security as duties.

IT Project Specialist: Joshua Stultz

Network Administrator: Scott McIntyre (Senior Network Administrator) and Herbert Fiege

IT Operations Manager: vacant

…(see Margaret for file on her hard drive)

IT Project Specialist Job Description IT Project Specailsit.docx (16.659 Kb)

Network Administrator Job Description Network Administrator.docx (16.16 Kb)

IT Operations Manager Job Description IT Operations Manager.docx (20.416 Kb)

c. Provide evidence of the implementation of the institution IA security plan.

Provide evidence of the implementation of the institution IA security plan to encourage IA awareness throughout the campus. (Example: Students and faculty/staff are required to take computer based training or on-line tutorials; a security banner statement present on institution computers; security related help screens are available; institution-wide seminars are held on the importance of IA, etc. 2 pts awarded per item)

Point Value: 2 min/ 10 max

…(see Margaret for file on her hard drive)

Login Message - Acceptable Use Login Message - Acceptable Use.docx (10.246 Kb)

Rules for Qualification

Total MINIMUM point requirement: 57

Total MAXIMUM points available: 108

Minimum points required to quality as a CAE2Y: 57

Minimum points must be met for each of the 6 criteria.