Norwich MSIA Program Review

Yesterday (June 11, 2010), I walked across the dais at the Norwich Field House and received my diploma for Master of Science in Information Assurance (MSIA), and I thought I would share my review of the degree program for anyone who is interested.

Feel free to comment or email me if you have questions about the Norwich MSIA.

The Norwich University MSIA Program Explained

Note: much of the information in this section is taken from this paper by Dr. Kabay.

Norwich University

Before discussing the specifics of the MSIA program, it is important to understand the Norwich University values. Norwich University has a long tradition of developing leaders dedicated to the service of our country and they take that tradition very seriously. Norwich was founded in 1819 by a former superintendent of West Point Military Academy, Captain Alden Partridge. Capt. Partridge believed in a strong militia and opposed a professional officer class. Consequently, he developed a system of learning that was experiential and focused on liberal arts, sciences, and military training. He created a system of learning that developed leaders who were able to think and apply what they learned in the classroom, as well as to act ethically and with courage. Norwich expects the same of its current graduates whether they are in the Corps of Cadets or not.

Norwich MSIA

The Norwich University MSIA program, now eight years old, is considered to be one of the best MSIA programs in the country, and is accredited as a National Center of Academic Excellence by the NSA and DHS. “The goal of these programs is to reduce vulnerability in our national information infrastructure by promoting higher education and research in IA and producing a growing number of professionals with IA expertise in various disciplines.[1]“

Who Should Consider the Norwich MSIA

The Norwich MSIA is a management focused degree. This program is targeted at the decision makers, or those who want to become decision makers such as CISOs, CIOs, and CTOs.

Do not consider this degree if you are looking to learn about configuring firewalls, IDS/IPS, or network devices. Do consider this degree if you are interested in learning about management topics such as how and where to use technical and administrative controls, privacy laws, governance, compliance, hiring, risk assessments, business continuity and disaster recovery, audits, and project management.

Personally, I think the most important thing that I learned is how to do a better job of translating between the technical and the business sides of the house. This is a supremely important skill that is sorely lacking in IT and information security, and I think that having this skill gives us a competitive advantage over those who do not have it. Those of us who can speak the business language are far more likely to be able to be effective and get what we need to improve our organization’s security and reduce its risk. Obviously, this skill is critically important for anyone working at or with the C-suite.

MSIA Case Study

The program is experiential with the student acting as a consultant writing a case study for their employer, or if that is not possible, they conduct an industry study. For example, one of the members of my cohort was employed as a contractor, so he wrote an industry case study as a guide to a manager in his chosen industry. He is planning to turn his work into a book (which I am anxious to read by the way).

This aspect of the program was terrific. I learned a lot about my business and was able to turn in professional papers that allowed my management to see my ability to perform a critical analysis of the specific topics that we studied. I actually found it fun to be a consultant.

Norwich MSIA Faculty

One of the main reasons that I chose Norwich for my MSIA is the quality of its faculty. The faculty are some of the top people in the information assurance industry, and they continue to work and contribute to the information security fields. Here is a brief list of the faculty:

• Dr. Mich Kaby – author, consultant
• Paul Brusil, PhD – medical informatics security
• Stephen Cobb, CISSP – prolific writer & consultant
• Rebecca Herold, CISSP, CISM, CISA, FLMI
• Don Holden, CISSP-ISSMP – standards organizations
• Jim Maloney, CISSP, CISM, GCIH – former CISO, Amazon
• Tom Peltier, CISM, CISSP – noted author &consultant
• Sanford Sherizen, PhD, CISSP – author, ISSA Hall of Fame
• Peter Stephenson, PhD, CISSP, CISM, FICAF –author and lecturer
• Michael Miora, CISSP, ISSMP, FBCI – expert in incident management and response, and disaster recovery

Residency Week

The Norwich MSIA is an online program, but they do require you to attend a one week residency session on campus. No one that I spoke to was looking forward to going to campus for a week “just to get my diploma“, but almost everyone I spoke to during the week was grateful for the requirement. We all enjoyed visiting the campus and learning about the history and tradition of Norwich University and its distinguished graduates. We also took time out to respect those graduates from the Corps of Cadets that lost their lives in the service of our country. Most of all, we enjoyed meeting our classmates face-to-face and spending one last week focusing on information security topics and debating specifics with our classmates and faculty. I found that I miss that aspect of school more than I realized.

Suggested Improvements

Here are some areas for improvement:

• More specific feedback from instructors that focuses more on the student’s analysis.
• Provide all course material on a USB drive in a format readable by an e-reader so students can more easily take their reading with them.
• Provide an opportunity for synchronous, web-enabled conversations among the cohort. Residency was so valuable because we could discuss topics face-to-face in a free-form format. The technology exists to do the same during the course, but requiring it on a weekly basis would remove some of the advantage of an online program. Perhaps require attendance of one such meeting per seminar.
• Provide a platform for the students to share their papers so they can learn from each other.

Conclusion

I am very happy with my decision to get a MSIA degree from Norwich University. I feel that I am prepared to contribute to my organization’s information assurance program, and to the industry itself. There is much work to do to improve our information systems’ security, and the industry needs trained, knowledgeable, ethical, and effective leaders. Our information security leaders have to be able to keep up with technology and laws. They have to be able to quickly research and assimilate information and then be able to critically think about and apply what they learn. These are skills that must be learned just as we learn anything technical such as configuring routers. I think the Norwich MSIA program provides the skills necessary to be an effective information assurance leader.

Finally, I am also proud to be part of the Norwich family and will always remember Norwich president Dr. Richard W. Schneider’s gift to our class – a quote from Thomas Jefferson, “One man with courage is a majority”.

I’d love to hear from other Norwich grads on what you think about the program, so leave a comment. I’d love to hear from people who think the MSIA might not be relevant or otherwise disagree with the Norwich approach.

Tagged as: Ethics, Information Assurance, information security, infosec, MSIA, National Center of Excellence, norwich university