Instructor: Paul Thomas, CNIT 182 – System and Organizational Security, Purdue
Course purpose: foundational cybersecurity concepts and IT foundations, including modeling information systems, databases, cybersecurity fundamentals, risk management, and more.
Audience: mostly cybersecurity majors; some BCRM or exploratory students.
Course philosophy: provide tools and resources; student effort and preparation drive success.
Course tone: approachable, with emphasis on active learning and real-world relevance.
Textbooks and Materials
Two textbooks required for the course:
Left: Security and Computing. The syllabus explains how to acquire the ebook for free; with some creativity you might access both for free, but don’t disclose that to the instructor.
Right: Second textbook is generally not available as an ebook.
Do you have to buy the textbooks?
Not strictly required, but quizzes and much of the material are based on them. Buying is recommended for alignment with quizzes and in-class material.
Quizzes/Materials: Quizzes and many topics are drawn from these texts.
Instructor and Teaching Team
You can call him Paul; formal titles (Professor/Doctor) are fine if your culture requires it.
TA and instructional team: Owen (primarily handles grading for labs this section), Abby (undergraduate TA), plus other grad students.
Lab sections: Students are assigned to a lab section (e.g., 07:30am). Attendance to the assigned lab is expected.
Contact: email the instructor with the course code and section number; include a brief description of the problem to help triage.
How to Address Me and Classroom Etiquette
You can call me Paul (first name).
Do not address as “bro,” “buddy,” or similar terms; a respectful form is expected.
The instructor will be the “bad guy” on attendance rules to emphasize expectations.
What to Expect from the Course and How to Succeed
Goals: build transferable skills for future courses and careers; high emphasis on engagement and preparation.
Structure: most items and deadlines are forecasted in advance; plan ahead with calendars (Brightspace or personal calendars).
Extensions: life happens; if you anticipate a deadline issue, inform the instructional team ahead of time. Extensions are not guaranteed.
Communication gaps: instructors cannot read minds; proactively communicate struggles or questions.
Attendance and engagement: meaningful value is added in every class session; you are encouraged to attend and participate.
Attendance, Participation, and Evaluation
Attendance policy: you are expected to attend lectures and labs. Attendance contributes to the grade.
5% punctuality bonus: a QR code is scanned in the first five minutes of class to claim 5% for being on time.
Check-in window: first five minutes of class.
Participation: active engagement in activities and deliverables contributes to the grade; both lectures and labs count.
No “break curves” and no extra credit; you earn what you get.
A reminder: consistent attendance and participation are needed to avoid surprises in the grade.
Definition of “on time”: being present in class when the session starts (the instructor emphasizes punctuality and engagement).
If you fall behind, there are structured opportunities to catch up, but overall effort and consistency are rewarded.
Peer evaluation: there is a peer evaluation component that influences a portion of the grade.
General comment: “great is the enemy of good” – aim for steady, consistent effort.
Academic Integrity and AI Usage
Academic dishonesty: cheating, submitting others’ work, or using work not your own.
Using AI: not forbidden, but should be used responsibly. AI can help with brainstorming, formatting, or rewording emails, but should not replace critical thinking.
If work is AI-generated with no human input, consequences may follow (scope varies with the assignment).
Collaboration: collaboration in labs is allowed, but submitting someone else’s work as your own is not allowed.
If you share solutions in a way that enables copying, penalties apply.
The instructor expects thoughtful use of AI and accountability for your own learning.
Big Picture: IT, Science, Technology, and Engineering
Distinguishing terms:
Science: study of natural phenomena; generates knowledge.
Engineering: uses knowledge to create tools.
Technology: uses tools to solve real-world problems.
In computing:
Computer Science: study of computing phenomena (algorithms, programming, etc.).
Computer Engineering: the hardware aspect of computing devices.
Technology: combination of knowledge, software, and hardware applied to solve real problems.
By enrolling in cybersecurity within IT, you commit to lifelong learning: today’s cutting edge may be obsolete tomorrow.
Information Systems: Definition and Five Components
Information systems transform data into information with context and value.
Data vs Information:
Data: raw facts without context.
Information: processed data with context and purpose.
Software/Procedures: programs and processes that implement tasks; some processes may be manual, some automated.
Data/Information: the data stored, processed, and used; includes datasets, stock numbers, item prices, etc.
People: end users and system administrators; users and other information systems.
Communications/Networks (implicit in software and hardware interactions): not always listed separately, but often part of software/Processes in practice.
The five components together enable the system to transform data into information for decision making.
The five components are not mutually exclusive; e.g., a barcode is data, but the barcode scanner is hardware; the barcode’s data is used to retrieve inventory information (data) and trigger software processes.
Example: a vending machine as a concrete information system:
People: customers, cashier or staff, restockers, security personnel.
Discussion prompts during the vending machine example:
What data are stored? Stock levels, prices, total cost, tax, rewards, etc.
What are the security concerns? Card skimmers, tampering, theft, unauthorized access to the device or data, insecure software, weak access controls, outdated software, etc.
Data security considerations: encryption of payment data, secure transmission to banks or payment networks, validation of card status, stock checks, inventory accuracy.
Human factors: access permissions for staff, role-based access, potential insider threats, and the importance of end-user education.
Activity: Point-of-Sale (POS) Kiosk – Components and Security Concerns
Task: Identify hardware, data, and software/process components of a POS kiosk and list security concerns.
Example hardware items identified in class: screen, barcode scanner, card reader, receipt printer, cash drawer, the whole physical register, barcode labels.
Example data items identified: barcodes, stock numbers, item unit prices, total cost, taxes, discounts, rewards/loyalty records.
Example software/process concerns: encryption during payment transmission, access control (who can edit prices or void items), stock replenishment, inventory tracking, outdated software, vulnerability patches.
Security concerns: card skimmers, physical tampering, unsecure storage of card data, unauthorized access to the POS software, outdated firmware, poor staff authentication, potential insider threats.
Discussion about access control: different permission levels (customer vs. cashier vs. manager) and the need to escalate permissions via a manager for elevated tasks.
The role of COBOL in legacy systems: COBOL is an old language still used on mainframes; some students may encounter it in practice, though it’s less common today; updates and modernization affect vulnerabilities and maintenance needs.
Vulnerabilities can exist in software (including legacy systems) and may be introduced through updates; continuous maintenance and security patches are essential.
Assignment: Write a neat, organized description of POS components and associated security concerns and submit to Brightspace by midnight today.
COBOL and Legacy Systems
COBOL is an old programming language still used in some mainframe environments; it remains relevant but is increasingly niche.
Learning COBOL is not typically recommended for beginners due to its niche status; modern students can learn object-oriented approaches in more current languages.
Vulnerabilities exist and can be addressed through software updates; updates can also introduce new vulnerabilities.
Parkinson’s Law and Time Management
Parkinson’s Law: work expands to fill the time available for its completion.
Implication for students: given long timeframes, you may procrastinate; tight deadlines may not always improve quality, but there is a balance.
Lesson: develop time management skills; plan assignments around realistic schedules for your own multiple courses.
Practical takeaway: for this course, plan ahead and manage multiple concurrent deadlines across courses.
Quizzes, Exams, and Browser Requirements
Quizzes are due before most classes; reminders appear in Brightspace.
Do not start a quiz unless you intend to complete it; once opened, the timer starts and there are no resets.
Quizzes are not open-book or open-note; you should read the relevant chapter before attempting.
Reading material alignment:
If the quiz title references Security and Computing, read the corresponding chapter in that textbook.
Time limits for quizzes: example provided is 10 questions with an 8-minute window:
Your browser requirement: Purdue uses LockDown Browser; instructions to install are provided by Purdue; quizzes and lecture exams require this browser.
In-class monitoring: the TA may monitor to collect content for social media with consent; this is part of the class administration.
Absences and Makeups
Purdue university absence policy applies; excused absences include:
Military service (documentation required)
Grief-related absences (documentation)
Medically excused absences (hospitalization, verified via the Office of the Dean of Students; forms required and notification by email)
Singular class absence is not catastrophic to performance; repeated absences cause deficits and impact grading.
Late submissions: typically a late penalty applies, e.g., 10% per day.
Makeup policies exist; details are in the syllabus and course communications.
Practical Advice for Success in CNIT 182
Attend both lectures and labs; there is value in every session.
Be prepared and stay engaged; early attendance yields better outcomes due to participation and on-time activities.
Use AI as a tool, not a crutch: brainstorm, format, and refine your writing or emails, but rely on your own critical thinking for final submissions.
Plan your schedule across four to six courses; use calendars to manage deadlines and avoid last-minute panic.
Submit assignments on Brightspace by the stated deadlines; use the late policy as a guide to optimize your submissions.
If you miss a class, follow the university’s excused absence guidance and communicate with the instructional team to arrange makeup work when appropriate.
Quick Reference: Key Formulas and Values
Punctuality bonus (per session):
Pextpunctuality=0.05
Late submission penalty (per day):
extLatepenalty=0.10imesextdayslate
Check-in window for attendance: first 5 minutes of class
Information system components (five): Hardware, Software/Processes, Data, People, (and implicitly Networks/Environment as part of implementation)
Final Note
The course emphasizes a balanced, proactive approach to learning, with a strong focus on practical problem solving in IT and cybersecurity contexts. Always come prepared, engage actively in lectures and labs, and communicate early if you need help.