Principles and Practice of Information Security

1. 01Operating system protection mechanisms
2. 02Intrusion detection systems
3. 03Formal models of security
4. 04Cryptography and steganography
5. 05Network and distributed system security
6. 06Transfer of funds/value across networks; electronic voting security
7. 07Secure application design
8. 08Homeland cybersecurity policy and government regulation of information technology

1. 01Foundations of Information Security
2. 02Legal, Ethical and Professional Frameworks
3. 03Access Control Architectures
4. 04Perimeter Defense and Firewalls
5. 05Intrusion Detection and Prevention Systems (IDPS)
6. 06Physical Security
7. 07History of Information Security and the CNSS Model
8. 08Implementing Information Security: Approach, the SDLC and Professional Roles
9. 09Threats to Information Security
10. 10Network Attack Methods and Secure Programming
11. 11Legal, Ethical and Regulatory Landscape
12. 12Risk Management

12 transcribed topics, taken from the lecturer’s own workbook. Readable in full once you sign in.

The Expanded Attributes of Information Security

Security is usually taught as the CIA triad — Confidentiality, Integrity, Availability — but a fuller list of attributes is needed to reason about end-to-end protection of an organisation’s digital assets.

Primary motives for hackers

Financial gain, political objectives, fame and reputation, revenge, and intellectual curiosity.

Attacker targets

Data repositories, network communication channels, hardware and computer systems, and human personnel (social engineering vectors).

Threat agents

External hackers, malicious or careless insiders, competing entities, organized cybercriminals, and nation-state actors.

Ethics

Moral principles and rules of conduct guiding individual and collective behavior.

Professional standards

Expectations governing conduct within specialized fields.

Laws

Enforceable rules established by governing authorities.

Policies

Internal rules mandated by organizations.

Computer Fraud and Abuse Act (CFAA)

Criminalizes unauthorized access to protected computer systems.

Electronic Communications Privacy Act (ECPA)

Safeguards wire, oral and electronic communications against unauthorized interception.

HIPAA & GLBA

Mandate stringent privacy and security controls for healthcare and financial institutions respectively.

Sarbanes-Oxley Act (SOX)

Requires public corporations to maintain accurate financial records and internal controls.

Mandatory Access Control (MAC)

Uses rigorous data classification schemes where users and objects are assigned sensitivity and clearance levels. Lattice-based access control provides a mathematical formalization of these security levels.

Non-Discretionary Access Control (NAC)

Centrally managed and strictly enforced access control governed by organizational authorities — for example Role-Based Access Control (RBAC) or Task-Based Access Control.

Discretionary Access Control (DAC)

Implemented at the discretion of data owners, common in peer-to-peer and decentralized environments.

The Four Pillars of Access Control

Every access control mechanism, regardless of model, is built from the same four steps in the same order.

Identification

A supplicant presents a unique identifier (ID) within the security domain.

Authentication

Validating the supplicant’s identity using one or more of three factors: something you know (passwords, PINs, passphrases), something you have (smart cards, ATM cards, hardware tokens), or something you are (biometrics — fingerprints, hand geometry, retinal scans, voice recognition).

Authorization

Matching authenticated entities against authorized resource access lists and group memberships.

Accountability (auditability)

Maintaining comprehensive system audit logs to attribute all user actions to verifiable identities, facilitating intrusion detection and forensic analysis.

Firewalls

Protective network layers that inspect and restrict unauthorized data transfer between an untrusted external network (such as the Internet) and a trusted internal network. Firewalls can operate as dedicated hardware appliances, software modules running on routers or servers, or distributed network perimeters.

IDS (Intrusion Detection System)

Detects violations and generates passive alarms (audible or visual) — it observes and reports but does not act.

IPS (Intrusion Prevention System)

Actively intercepts and blocks malicious traffic in real time.

True attack stimulus

An actual attack or authorized test drill triggering a correct IDPS response.

False positive

An alarm triggered in the absence of an actual attack.

False negative

The failure of an IDPS to detect an actual attack — the most grievous security failure, since the organization has no idea it happened.

Noise

Accurate but low-threat alerts generated by unsuccessful attacks or normal operational anomalies.

General management

Exterior facility security, building access control, and fire protection systems.

The 12 topics define many more terms than these — the full set, with flashcards, is in the notes.

• Principles of Information Security — Michael E. Whitman & Herbert J. Mattord

  6th ed. — the standard undergraduate security text

• CompTIA Security+ Study Guide — Mike Chapple & David Seidl

  8th ed. — excellent practical coverage, aligns with SY0-601

• The CIA triad (Confidentiality, Integrity, Availability) is the lens through which every security concept is understood — internalise it
• Read real breach case studies (Troy Hunt's blog, Krebs on Security) — they make abstract threats concrete
• Professor Messer's free Security+ course covers most of this curriculum and is excellent
• Social engineering is the most common attack vector — understand human psychology, not just technical controls
• Scope triage: the examinable core is what was actually lectured — Lectures 1–4, which are sections 7–12 of the lecture notes (Whitman & Mattord chapters 1–4). Cryptography/steganography and funds transfer/e-voting sit in the course outline but were never taught, so revise them last if at all
• Written paper, not CBT: a 10-mark question wants roughly five distinct points, each named and then explained in a sentence or two. One long unbroken paragraph scores badly even when everything in it is correct — the marker is counting points
• Structure every long answer the same way: define the term, explain the mechanism, give an example or a diagram, then link it to a neighbouring concept. A repeatable skeleton stops you freezing on a question you half-know
• Practise reproducing the diagrams from memory with their labels — the McCumber Cube, the TCP three-way handshake, the SDLC waterfall, top-down vs bottom-up. "With the aid of a diagram" is a standard question stem and the labels are where the marks are
• On a four-from-six paper in two hours, budget about 30 minutes per question: 5 planning the points, 20 writing, 5 checking. Read all six and pick your four before you write a single word
• Where a list is long (the fifteen threat categories, for instance) the question will ask for "any five" — so learn five you can explain properly rather than fifteen you can only name

What is UUY-CYB 122 at the University of Uyo?

UUY-CYB 122 (Principles and Practice of Information Security) is a 2-unit, 100 Level course taught in the Second Semester at the University of Uyo, Akwa Ibom State, Nigeria. An introduction to the core principles of information security: operating system protection mechanisms, intrusion detection, formal security models, cryptography and steganography, and the policy/regulatory dimension of protecting information and value across networks.

What topics are covered in UUY-CYB 122?

The UUY-CYB 122 outline covers 8 topics: Operating system protection mechanisms; Intrusion detection systems; Formal models of security; Cryptography and steganography; Network and distributed system security; Transfer of funds/value across networks; electronic voting security; Secure application design; Homeland cybersecurity policy and government regulation of information technology.

What textbooks are recommended for UUY-CYB 122?

Recommended reading for UUY-CYB 122: Principles of Information Security by Michael E. Whitman & Herbert J. Mattord; CompTIA Security+ Study Guide by Mike Chapple & David Seidl.

How do I pass UUY-CYB 122?

The CIA triad (Confidentiality, Integrity, Availability) is the lens through which every security concept is understood — internalise it Read real breach case studies (Troy Hunt's blog, Krebs on Security) — they make abstract threats concrete Professor Messer's free Security+ course covers most of this curriculum and is excellent Social engineering is the most common attack vector — understand human psychology, not just technical controls Scope triage: the examinable core is what was actually lectured — Lectures 1–4, which are sections 7–12 of the lecture notes (Whitman & Mattord chapters 1–4). Cryptography/steganography and funds transfer/e-voting sit in the course outline but were never taught, so revise them last if at all Written paper, not CBT: a 10-mark question wants roughly five distinct points, each named and then explained in a sentence or two. One long unbroken paragraph scores badly even when everything in it is correct — the marker is counting points Structure every long answer the same way: define the term, explain the mechanism, give an example or a diagram, then link it to a neighbouring concept. A repeatable skeleton stops you freezing on a question you half-know Practise reproducing the diagrams from memory with their labels — the McCumber Cube, the TCP three-way handshake, the SDLC waterfall, top-down vs bottom-up. "With the aid of a diagram" is a standard question stem and the labels are where the marks are On a four-from-six paper in two hours, budget about 30 minutes per question: 5 planning the points, 20 writing, 5 checking. Read all six and pick your four before you write a single word Where a list is long (the fifteen threat categories, for instance) the question will ask for "any five" — so learn five you can explain properly rather than fifteen you can only name

Where can I find UUY-CYB 122 lecture notes and past questions?

Areté (https://www.aretecyb.tech/courses/uuy-cyb-122) carries 12 lecture-note topics, 45 past-paper questions, 2 recommended textbooks for UUY-CYB 122, plus an AI tutor that has read the outline. It is free for University of Uyo students — sign in with your email, no password.

• GST 111Communication in English
• MTH 111Elementary Mathematics I (Algebra and Trigonometry)
• PHY 111General Physics I (Mechanics)
• PHY 117General Practical Physics I
• COS 111Introduction to Computing Sciences
• STA 111Descriptive Statistics
• UUY-CSC 111Computer Operations
• UUY-CSC 112Computer Troubleshooting