LAB OF COMPUTER SECURITY

Computer and network security is one of the most critical area in ICT. A digital manager needs to be aware of the foundations of computer security in order to manage this key component of any digital business activity.

The goal of this course is to introduce the technical foundations of computer and network security, in order to be able to understand the threats that any digital business can be subject to.
Students will approach the themes of computer security, networking principles, security protocols and security services, with a hands-on approach.

During the course the student will achieve the following knowledge and skills:

Knowledge:
- The basics of a system administration, privileges and commands in a GNU/Linux environment;
- What is a security service, a security threat and a software bug;
- What are the foundations of computer communications (Internetworking) and the basics of network security;
- A primer on cryptography;
- Secure Internet protocols.

Skills; the student will be able to:
- Reproduce basic examples of typical software vulnerabilities;
- Perform basic network survey, security analysis and remote attacks (e.g. ethical hacking);
- Use and recognize secure Internet services;

The student will be also able to make assessments on the robustness and security features of systems with regards to typical security services (authentication, data secrecy, availability etc.) and to be able to communicate with experts of the domain on the security features that a specific service needs to offer to its users.

Familiarity with programming languages, achieved with the "Introduction to Coding" course.

The course is structured in 5 weeks, each week addresses one topic and provides hands-on experience with the relevant related software tools. The program is not intended to be immutable, it can change based on the student's interest and reactions.

Week one: Introduction to information security and operating system (OS) security:
- Introduction to security services, threats and mechanisms;
- Introduction to the GNU/Linux OS, the users, the privileges and the design of the OS as an example of OS security.

Week two: OS Security:
- Software attacks: what is a bug?;
- Examples of well-known vulnerabilities and coding bad practices;
- Sources of known vulnerabilities: Common Vulnerability Exposure;
- Secure programming guidelines.

Week three: Network Security:
- Introduction to networks and networking;
- Attacking remote systems;
- Known and typical attacks to various network layers: scanning, spoofing, DDoS, remote brute force.

Week four: Introduction to Cryptography:
- Classical cryptography concepts;
- Symmetric cryptography;
- Hash functions and HMAC;
- Example applications: password hashing and blockchains.

Week five: Asymmetric cryptography and PKI:
- Public/Private key cryptography;
- Certificates and PKI;
- Secure protocols: TLS;

The course is based on various sources, most of which are available on-line and will be provided with the course material.
The lesson slides together with the lecture notes are enough to prepare the exam.

More references:

One reference book that contains material for almost the whole course (and much more) is:
Wenliang Du: Computer & Internet Security: A Hands-on Approach, (second edition, 2019, ISBN: 978-1-7330039-2-6, hardcover. ISBN: 978-1-7330039-3-3, paperback). The book is available at: https://www.handsonsecurity.net/ .

Other books that can serve as additional references are:

Andrew S. Tanenbaum, David J. Wetherall, Computer Networks: Pearson, fifth edition.
Olivier Bonaventure Computer Networks: Principles, Protocols, Practice https://inl.info.ucl.ac.be/cnp3 (Creative Commons license, third edition).
William Stallings, Cryptography and Network Security, Pearson, seventh edition.

The evaluation will be a written test plus one out of a group project and another written test.
The test will be made of questions with multiple choice plus open answers referring to problems (and their solution) analysed during the classes.

Students will be given optional assignments during the course to test their understanding of the subject.

Each week will be made of 50% lectures and 50% hands-on sessions. Students will install a virtual machine on which to experiment the commands and the software that is required to achieve the learning goals.

English

The evaluation modality may change due to the evolution of the current pandemic.

written