LAB OF COMPUTER SECURITY

Computer and network security is one of the most critical area in ICT. The digital manager needs to be aware of the foundations of computer security in order to manage this key component of any digital business activity.

The goal of this course is to introduce the technical foundations of computer and network security, in order to be able to understand the threats that any digital business can be subject to.
Students will approach the themes of computer security, networking principles, security protocols and security services, with a hands-on approach.

During the course the student will achieve the following knowledge and skills:

Knowledge:
- The basics of a system administration, privileges and commands in a GNU/Linux environment;
- What is a security service, a security threat and a software bug;
- What are the foundations of computer communications (Internetworking) and the basics of network security;
- A primer on cryptography;
- Secure Internet protocols.

Skills; the student will be able to:
- Reproduce basic examples of typical software vulnerabilities;
- Apply basic principles of secure programming;
- Perform basic network survey, security analysis and remote attacks (e.g. ethical hacking);
- Use and configure secure Internet services;

The student will be also able to make assesements on the robustness and security features of systems with regards to typical security services (authentication, data secrecy, availability etc.) and to be able to communicate with experts of the domain on the security features that a specific service needs to offer to its users.

Familiarity with programming languages, achieved with the "Introduction to Coding" course.

The course is structured in 5 weeks, each week addresses one topic and provides hands-on experience with the relevant related software tools. The program is not intended to be immutable, it can change based on the student's interest and reactions.

Week one: Introduction to information security and operating system (OS) security:
- Introduction to security services, threats and mechanisms;
- Introduction to the GNU/Linux OS, the users, the privileges and the design of the OS as an example of OS security.

Week two: OS Security:
- Software attacks: what is a bug?;
- Examples of well-known vulnerabilities and coding bad practices;
- Sources of known vulnerabilities: Common Vulnerability Exposure;
- Secure programming guidelines.

Week three: Network Security:
- Introduction to networks and networking;
- Attacking remote systems;
- Known and typical attacks to various network layers: scanning, spoofing, DDoS, remote brute force.

Week four: Introduction to Cryptography:
- Classical cryptography concepts;
- Symmetric cryptography;
- Hash functions and HMAC;
- Example applications: password hashing and blockchains.

Week five: Asymmetric cryptography and PKI:
- Public/Private key cryptography;
- Certificates and PKI;
- Secure protocols: TLS;
- Example applications: Bitcoin and Tor.

The course is based on various sources, most of which are available on-line and will be provided with the course material. The sources plus the lesson slides should be enough for students that follow the lecture classes.

One reference book that contains material for almost the whole course (and much more) is:
Wenliang Du: Computer & Internet Security: A Hands-on Approach, (second edition, 2019, ISBN: 978-1-7330039-2-6, hardcover. ISBN: 978-1-7330039-3-3, paperback). The book is available at: https://www.handsonsecurity.net/ .

Other books that can serve as additional references are:

Andrew S. Tanenbaum, David J. Wetherall, Computer Networks: Pearson, fifth edition.
Olivier Bonaventure Computer Networks: Principles, Protocols, Practice https://inl.info.ucl.ac.be/cnp3 (Creative Commons license, third edition).
William Stallings, Cryptography and Network Security, Pearson, seventh edition.

The evaluation will be a written test (possibly using the Moodle platform provided by Ca' Foscari) plus an optional group project with a short discussion.
The test will be made of questions with multiple choice plus open answers referring to problems (and their solution) analysed during the classes.

Students will be given optional assignments during the course to test their understanding of the subject.

Each week will be made of 50% lectures and 50% hands-on sessions. Students will install a virtual machine on which to experiment the commands and the software that is required to achieve the learning goals.

English

written