2014 – 2015
Florida Department of Education
Curriculum Framework 

Program Title:	Database & E-commerce Security CCC
Career Cluster:	Information Technology

CCC	
CIP Number	0511100311	
Program Type	College Credit Certificate (CCC)	
Program Length	18 credit hours	
CTSO	Phi Beta Lambda, BPA 	
SOC Codes (all applicable) 	15-1122 – Information Security Analysts	
Targeted Occupation List	http://www.labormarketinfo.com/wec/TargetOccupationList.htm	
Perkins Technical Skill Attainment Inventory	http://www.fldoe.org/workforce/perkins/perkins_resources.asp 	
Statewide Articulation	http://www.fldoe.org/workforce/dwdframe/artic_frame.asp 	

Purpose

This certificate program is part of the IT Security AS degree program (1511100306).  

A College Credit Certificate consists of a program of instruction of less than sixty (60) credits of college-level courses, which is part of an AS or AAS degree program and prepares students for entry into employment (Rule 6A-14.030, F.A.C.).

This program offers a sequence of courses that provides coherent and rigorous content aligned with challenging academic standards and relevant technical knowledge and skills needed to prepare for further education and careers such as Database Security Professionals and E-Commerce Security Professionals in the Information Technology career cluster; provides technical skill proficiency, and includes competency-based applied learning that contributes to the academic knowledge, higher-order reasoning and problem-solving skills, work attitudes, general employability skills, technical skills, and occupation-specific skills, and knowledge of all aspects of the Information Technology career cluster. 

The content includes but is not limited to work in Internet, intranet, extranet, and enterprise environments; installing, configuring, designing, and managing secure database and E-commerce resources. 

Additional Information relevant to this Career and Technical Education (CTE) program is provided at the end of this document.

Standards

After successfully completing this program, the student will be able to perform the following:

01.0	Demonstrate an understanding of computer hardware.
02.0	Demonstrate an understanding of networked environments, hardware, and software.
03.0	Install and configure secure network systems software and utilities.
04.0	Demonstrate proficiency with Internet structure, organization, and navigation.
05.0	Demonstrate an understanding of network access control systems and methodology.
06.0	Describe cryptography concepts, standards, and applications.
07.0	Perform telecommunications and network security activities.
08.0	Demonstrate an understanding of Database Management Systems.
09.0	Perform administrative tasks related to database security.
10.0	Demonstrate an understanding of E-commerce.
11.0	Perform tasks related to e-commerce security.
12.0	Perform Web site management activities.
13.0	Design and implement physical security measures.
14.0	Perform operations and security management practices.
15.0	Employ applications and systems development security techniques.
16.0	Develop business continuity and disaster recovery plans.
17.0	Describe ethical issues, pertinent laws, and how to conduct investigations.
18.0	Perform general organizational computing workplace competencies.
19.0	Perform project planning and management activities.
20.0	Perform documentation and technical reference activities.
21.0	Demonstrate employability skills.
22.0	Demonstrate professional development skills.

2014 – 2015
Florida Department of Education
Student Performance Standards

Program Title:	Database & E-commerce Security CCC
CIP Number:		0511100311
Program Length:	18 credit hours
SOC Code(s):		15-1122 

This certificate program is part of the IT Security AS degree program (1511100306).  At the completion of this program, the student will be able to:	
01.0	Demonstrate an understanding of computer hardware. – The student will be able to:	
01.01	Describe multiple numbering systems used to represent instructions and data, including binary, octal, decimal, and hexadecimal.	
01.02	Identify the architecture of major hardware platforms.	
01.03	Describe the functions of major hardware components of a computer system.	
01.04	Discuss the potential impact of emerging hardware technologies.	
02.0	Demonstrate an understanding of networked environments, hardware, and software. – The student will be able to:	
02.01	Discuss fundamental network concepts such as topology, protocols, architecture, and internetworking.	
02.02	Define all layers in the Open Systems Interconnect (OSI) and Transmission Control Protocol/Internetworking Protocol (TCP/IP) network protocol models.	
02.03	Discuss the nature of Internetworking Protocol (IP) addresses and Media Access Control (MAC) addresses, and mapping between protocol addressing schemes.	
02.04	Describe the functions and hardware requirements for current popular network servers for such services as: Domain Name Service (DNS), Dynamic Host Configuration Protocol (DHCP), e-mail, the World Wide Web (WWW) and proxy.	
02.05	Describe the major functions and hardware requirements of network client hardware components.	
02.06	Describe the major functions of network connectivity hardware, such as hubs, repeaters, bridges, routers, switches, and gateways.	
02.07	Describe the function of network storage devices and other peripherals such as a Redundant Arrays of Inexpensive Disks (RAID) and CD-ROM towers.	
03.0	
Install and configure secure network systems software and utilities. – The student will be able to:	
03.01	Install and configure current leading system software, drivers, and service packs.	
03.02	Discuss the functions of authentication protocols and Virtual Private Networks (VPNs).	
03.03	Use system software to perform routine maintenance tasks such as backup and hard drive defragmentation.	
03.04	Install and configure a secure desktop client operating system.	
03.05	Describe modifications necessary to an operating system such as modifying parameters and how to handle conflicting interrupts when installing, configuring, and upgrading typical applications software.	
03.06	Install and configure client software for network-based applications such as e-mail, Web browsing, terminal emulation, file transfer, group conferencing and database.	
03.07	Install and configure current popular network servers for such services as: Domain Name Service (DNS), Dynamic Host Configuration Protocol (DHCP), e-mail, the World Wide Web (WWW) and proxy service.	
04.0	Demonstrate proficiency with Internet structure, organization, and navigation. – The student will be able to:	
04.01	Describe Internet structure and administration, including such topics as Requests for Comments (RFCs) and the Domain Name System (DNS).	
04.02	Describe common Internet services and port numbers.	
04.03	Demonstrate the use of internetworking protocols, including: Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), e-mail protocols such as Simple Mail Transfer Protocol (SMTP) and Post Office Protocol (POP3) and Telnet.	
04.04	Differentiate between push and pull technologies.	
04.05	Demonstrate the use of typical remote access mechanisms such as Telnet.	
04.06	Describe the data format and proprietary nature of commonly used Internet file types.	
04.07	Demonstrate use of Internet clients and services such as e-mail, Web browsers, search engines, newsgroups, mailing lists, chat rooms and file transfer clients.	
05.0	Demonstrate an understanding of network access control systems and methodology. – The student will be able to: 	
05.01	Specify by access control mechanisms what users can do, which resources they can access, and what operations they can perform on a system.	
05.02	Compare and contrast several access control techniques, including access control lists, discretionary, mandatory, lattice-based, rule-based, and role-based access control.	
05.03	Administer computer, group, and user accounts.	
05.04	Manage policies, rights, permissions, and passwords for users and/or groups of users.	
05.05	Oversee password and PIN selection, management, and control.	
05.06	Demonstrate an understanding of alternative methods to identification and authentication, including characteristic-based or biometric techniques, tokens, tickets, one-time passwords, and single sign-on techniques.	
05.07	Implement centralized/remote authentication access controls such as RADIUS and TACACS.	
05.08	Implement and manage decentralized access controls such as domains and trusts relationships.	
05.09	Analyze methods of server attack, including brute force, denial of service, spoofing, spamming, sniffers, hackers, and crackers.	
05.10	Demonstrate an understanding of the different types of intrusions and the different methods of intrusion detection, including data extraction, sampling, recognition and traffic analysis.	
05.11	Monitor the network using various forms of intrusion detection resources to detect attacks.	
05.12	Investigate audit trails for signs of network intrusions.	
05.13	Perform penetration testing to find weaknesses in the access control systems.	
06.0	Describe cryptography concepts, standards, and applications. – The student will be able to:	
06.01	Demonstrate an understanding of the encryption/decryption process.	
06.02	Demonstrate an understanding of the basic functions involved in key management including creation, distribution, verification, revocation, destruction, storage, recovery, and life span of keys.	
06.03	Utilize various forms of cryptography, digital certificates, and digital signatures to achieve confidentiality, integrity, authentication, and non-repudiation in an enterprise data communications network.	
06.04	Discuss the creation and use of digital certificates and digital signatures to provide authentication of users and verification of data integrity in network communications.	
06.05	Employ cryptographic algorithms such as DES, RSA, MD5 and DSA.	
06.06	Identify the strengths and weaknesses of cryptographic algorithms and the effects of key length.	
06.07	Implement current popular key distribution methods including manual, Kerberos™, and Internet Security Association and Key Management Protocol (ISAKMP).	
06.08	Utilize application and network-based protocols such as Secure Socket Layer (SSL), Secure Hypertext Transfer Protocol (SHTTP), and Internetworking Protocol Security (IPSEC).	
06.09	Describe the use of hardware components such as smart cards and tokens.	
07.0	Perform telecommunications and network security activities. – The student will be able to:	
07.01	Utilize protocol layering models such as the Open Systems Interconnection (OSI) model in analyzing network security threats.	
07.02	Evaluate the security implications involved with the various physical media types such as fiber optics, twisted pair, and wireless communications.	
07.03	Describe security concerns with using certain network topologies such as star, bus, mesh, and ring.	
07.04	Employ network monitors and packet sniffers to identify security threats.	
07.05	Implement security measures using hardware and software such as firewalls, routers, switches, gateways, and proxies.	
07.06	Discuss the security vulnerabilities of the Transmission Control Protocol/Internetworking Protocol (TCP/IP) protocol stack.	
07.07	Configure Network Layer security protocols such as Internetworking Protocol Security (IPSEC).	
07.08	Configure Transport Layer security protocols such as Secure Socket Layer (SSL).	
07.09	Utilize Secure Multipurpose Internet Mail Extensions (S/MIME), Secure Socket Layer (SSL) and other Application Layer security protocols. 	
07.10	Perform connection verification and authentication using Challenge Handshake Authentication Protocol (CHAP) and Password Authentication Protocol (PAP).	
07.11	Implement secure data communication techniques such as Virtual Private Networks (VPNs), tunneling, Network Address Translation (NAT), and transmission logging.	
07.12	Develop secure e-mail, facsimile, and voice communication procedures to protect against network attacks such as flooding, eavesdropping, sniffing and spamming and describe appropriate countermeasures.	
07.13	Employ alarms and signals to alert network security administrators of intrusions.	
08.0	Demonstrate an understanding of Database Management Systems. – The student will be able to: 	
08.01	Compare the major types of databases including relational, flat file, distributed and object-oriented databases.	
08.02	Describe the concept of relational database concepts including tables, entity-relationships, queries, and normalization.	
08.03	Analyze the various components of a database management system.	
08.04	Install and configure database server software from leading vendors.	
08.05	Demonstrate an understanding of transactions processing and concurrency control.	
08.06	Employ techniques to ensure database integrity and security.	
09.0	Perform administrative tasks related to database security. – The student will be able to:	
09.01	Develop database security guidelines.	
09.02	Monitor database security systems.	
09.03	Manage web database security.	
09.04	Verify security compliance.	
09.05	
Secure backup processes.	
09.06	Verify backup processes.	
10.0	Demonstrate an understanding of e-commerce. – The student will be able to:	
10.01	Identify components and procedures necessary to process credit card transactions.	
11.0	Perform tasks related to e-commerce security. – The student will be able to: 	
11.01	Manage digital certificates.	
11.02	Maintain integrity in transaction storage and reporting systems.	
11.03	Protect credit card, personal, banking, and "bill to" and "ship to" information in transaction processes.	
11.04	Maintain email security related to e-commerce.	
11.05	Assist in evaluating e-commerce platform vulnerabilities.	
12.0	Perform Web site management activities. – The student will be able to:	
12.01	Describe the process of obtaining an Internet domain name and mapping it to an Internet Protocol (IP) address.	
12.02	Use current Web server software to create and maintain a secure Web site.	
12.03	Use Web site access tracking and analysis tools to evaluate the security of a Web server.	
13.0	Design and implement physical security measures. – The student will be able to:	
13.01	Identify the physical threats to an enterprise’s resources that include the employees, facilities, data, equipment, support systems, media, and supplies they utilize.	
13.02	Diagnose an enterprise’s physical vulnerabilities to threats from natural disasters such as fire, flooding, and power loss.	
13.03	Specify possible countermeasures to physically protect an enterprise’s resources and sensitive information.	
13.04	Develop a list of physical facility requirements to secure the premises.	
13.05	Evaluate the applicability of technical controls such as smart cards, access logs, and intrusion detection systems.	
14.0	Perform operations and security management practices. – The student will be able to:	
14.01	Perform personnel administrative management operations, including specifying job requirements, background checking, job rotation and termination procedures.	
14.02	Implement anti-virus solutions on an enterprise-wide basis.	
14.03	Perform backups of critical information.	
14.04	Protect the privacy of personal data.	
14.05	Demonstrate proper handling including marking, handling, storage and destruction of sensitive information and media.	
14.06	Demonstrate an understanding of different control types, such as directive, preventive, detective, corrective, and recovery controls.	
14.07	Determine what resources, including hardware/software, password files, source code, storage and logs, require protection.	
14.08	Compare the advantages and disadvantages of internal versus external audits.	
14.09	Perform compliance checks on user adherence to security policies.	
14.10	Identify different types of monitoring including event, hardware, and illegal software.	
14.11	Utilize monitoring tools and techniques such as trend analysis, traffic analysis and reporting mechanisms.	
14.12	Implement countermeasures to defend against threats such as fraud, theft, employee sabotage, espionage, terrorism, and hackers.	
14.13	Perform penetration testing activities including sniffing, eavesdropping, dumpster diving, and social engineering.	
14.14	Understand principles of risk management and asset valuation.	
14.15	Monitor server information for defamatory statements and privacy rights infractions.	
14.16	Manage software licenses and enforce compliance within the organization.	
15.0	Employ applications and systems development security techniques. – The student will be able to:	
15.01	Analyze the controls that are included within systems and applications software and those used in the development of agents, applets, software, databases, data warehouses and knowledge-based systems.	
15.02	Implement features to ensure data and application integrity, security and availability.	
15.03	Analyze local environment application issues including viruses, Trojan horses, logic bombs and worms.	
15.04	Develop multilevel security schemes for databases and data warehouses.	
15.05	Describe different aspects of application and database security control architectures, including process isolation, hardware segmentation, separation of privilege, layering, abstraction and security kernels.	
15.06	Define the various types of computer viruses and malicious code and the roles that hackers, crackers, phreaks, and virus writers play in developing and utilizing malicious code.	
15.07	Formulate countermeasures to defend against or detect viruses and malicious code.	
15.08	
Utilize anti-virus software and develop policies to provide enterprise-wide anti-virus protection.	
15.09	Employ countermeasures to defend against attacks such as brute force and replay attacks.	
16.0	Develop business continuity and disaster recovery plans. – The student will be able to:	
16.01	Perform a business impact assessment, including components such as an emergency assessment, specifying business success and critical business functions, establishing priorities, and developing alternative means of accomplishing objectives.	
16.02	Specify the necessary capabilities of alternative business sites such as cold, warm, hot and mobile sites to be used in the case of a disaster.	
16.03	Develop business continuity, disaster containment, and disaster recovery plans for disasters such as such as floods, fires, power outages, strikes, hardware/software failures, and bombings addressing: protection of physical assets, emergency response, personnel notification, backups and off-site storage, utilities, external communications, and logistics and supplies.	
17.0	Describe ethical issues, pertinent laws, and how to conduct investigations. – The student will be able to:	
17.01	Understand the major categories and types of laws as to how they relate to E-commerce, including criminal law, civil law and administrative law.	
17.02	Develop institutional policies and practices to conform to or supplement existing laws regarding data privacy and intellectual property rights.	
17.03	Describe abnormal and suspicious activity as it relates to database and e-commerce security.	
17.04	Analyze potential data security threats such as fraud or collusion.	
17.05	Develop legal institutional policies and practices to protect against purposeful violations of data integrity.	
17.06	Identify the major categories of computer crime and attacks, including military, business, financial, terrorist, grudge and “fun” attacks.	
17.07	Develop legal institutional policies and practices to conduct an investigation of purposeful violations of data integrity or existing e-commerce laws, including: the collection and preservation of evidence; confiscation of equipment, software and data; interrogation of suspected violators; and reporting of incidents to the appropriate authorities.	
17.08	Discuss major ethical and legal issues related to Internet use.	
18.0	Perform general organizational computing workplace competencies. – The student will be able to:	
18.01	Follow oral and written instructions.	
18.02	Prepare, outline, and deliver a short oral presentation.	
18.03	Interpret appropriate information from graphics, maps, or signs.	
18.04	Demonstrate self-motivation and responsibility to complete an assigned task.	
18.05	List the steps in problem solving.	
18.06	Identify and discuss issues contained within professional codes of conduct.	
18.07	Identify and discuss intellectual property rights and licensing issues.	
18.08	Identify potential sources of employee/employer or employee/employer conflict and discuss possible approaches to resolve such disagreements.	
18.09	Use appropriate communication skills, telephone etiquette, courtesy, and manners when dealing with individuals lacking a technical background. 	
19.0	Perform project planning and management activities. – The student will be able to: 	
19.01	Apply effective time management skills.	
19.02	Describe appropriate measures for planning and implementing corporate-wide upgrade of hardware and software.	
20.0	Perform documentation and technical reference activities. – The student will be able to:	
20.01	Use technical vocabulary appropriately.	
20.02	Locate information in printed and online technical references.	
20.03	Prepare documentation to track: physical inventory, regulation and license compliance, hardware and software modifications and upgrades, security breaches and countermeasures, and the current e-commerce security environment.	
21.0	Demonstrate employability skills. – The student will be able to:	
21.01	Identify sources of employment opportunities.	
21.02	Discuss employee rights regarding privacy, discrimination, due process and safety.	
22.0	Demonstrate professional development skills. – The student will be able to:	
22.01	Anticipate future industry trends.	
22.02	Describe options for continuing education.	
22.03	Read industry journals and magazines.	

Additional Information

Laboratory Activities

Laboratory activities are an integral part of this program.  These activities include instruction in the use of safety procedures, tools, equipment, materials, and processes related to these occupations.  Equipment and supplies should be provided to enhance hands-on experiences for students. 

Career and Technical Student Organization (CTSO)

Phi Beta Lambda and Business Professionals of America (BPA) are the appropriate career and technical student organizations for providing leadership training and reinforcing specific career and technical skills.  Career and Technical Student Organizations provide activities for students as an integral part of the instruction offered.  The activities of such organizations are defined as part of the curriculum in accordance with Rule 6A-6.065, F.A.C.

Accommodations

Federal and state legislation requires the provision of accommodations for students with disabilities as identified on the secondary student’s Individual Educational Plan (IEP) or 504 plan or postsecondary student’s accommodations’ plan to meet individual needs and ensure equal access.  Postsecondary students with disabilities must self-identify, present documentation, request accommodations if needed, and develop a plan with their counselor and/or instructors.  Accommodations received in postsecondary education may differ from those received in secondary education.  Accommodations change the way the student is instructed.  Students with disabilities may need accommodations in such areas as instructional methods and materials, assignments and assessments, time demands and schedules, learning environment, assistive technology and special communication systems.  Documentation of the accommodations requested and provided should be maintained in a confidential file.

Articulation

For details on articulation agreements which correlate to programs and industry certifications refer to http://www.fldoe.org/workforce/dwdframe/artic_frame.asp.