Salta al contenuto principale della pagina

COMPUTER SECURITY

CODE 80156
ACADEMIC YEAR 2022/2023
CREDITS
  • 6 cfu during the 3nd year of 8759 INFORMATICA (L-31) - GENOVA
  • 9 cfu during the 1st year of 11160 COMPUTER ENGINEERING (LM-32) - GENOVA
  • SCIENTIFIC DISCIPLINARY SECTOR ING-INF/05
    LANGUAGE English
    TEACHING LOCATION
  • GENOVA
  • SEMESTER 1° Semester
    TEACHING MATERIALS AULAWEB

    OVERVIEW

    The course covers some of the fundamental principles of Computer Security. Topics covered include cryptographic hash functions, symmetric and asymmetric ciphers, digital signatures, digital certificates, security protocols, and access control. An introduction to network security and web security is also provided. The course also features a number of hands-on sessions and a cyber exercise (a Capture-the-Flag competition).

    For students of Informatica (Computer Science) the CyberExercise is not mandatory and the number of credits is reduced to 6.

    AIMS AND CONTENT

    LEARNING OUTCOMES

    Upon completion of the course, students will be able to: explain the concepts of confidentiality, availability, and integrity (CIA) as well as the concepts of threat, vulnerability, exploit and (cyber-)risk and (cyber-)risk mitigation; explain the strengths and weaknesses of cryptographic techniques as well as their role in protecting data at rest and in transit, in implementing the concept of digital signature and in supporting the design of security protocols; explain the security model of web browsers and identify the most relevant vulnerabilities of web applications; explain the causes and effects of buffer overflows in executable programs; explain the key principles of access control in information systems and most relevant access control models and mechanisms.

    AIMS AND LEARNING OUTCOMES

    Students will acquire in-depth understanding of the security issues that plague modern Computer Systems and complex ICT infrastructures as well as of the techniques used to solve or, at least, mitigate them. Students will learn how to evaluate if the confidentiality, integrity and availability of data and communications is at risk and to identify appropriate solutions to achieve these fundamental security properties. The course features a series of hands-on sessions that provide students with the ability to solve practical problems drawn from a variety of domains: cryptography, network security, host security and web security.

    PREREQUISITES

    • Good programming skills
    • Fundamentals of Computer Architectures and Operating Systems
    • Fundamentals of communication protocols and the TCP/IP

    TEACHING METHODS

    Lecture-style instruction complemented with hands-on session on selected topics (e.g. secure mail, web security).

    The examination consists of a written and a practical exam (cyber exercise).

     

    SYLLABUS/CONTENT

    1. Introduction Computer Security [1h]

      • The concepts of resource, vulnerability, threat, countermeasure, and risk

      • Security goals: confidentiality, integrity, availability, ...

    2. Introduction to Cryptography [2h]

      • Fundamental concepts (cryptography, cryptanalysis, general cryptographic schema)

      • Monoalphabetic substitution ciphers (Caesar cipher)

      • Polyalphabetic substitution ciphers (Vigenère cipher)

      • One-time pads (Vernam cipher)

      • Transposition ciphers

      • Composite ciphers

    3. Symmetric Cryptography [3h]

      • Block and stream ciphers

      • Feistel cipher structure

      • DES and 3DES

      • Modes of operation (Electronic Code Book, Cipher-Block Chaining, Stream Ciphers)

      • Link vs end-to-end encryption

      • The key distribution problem

    4. Public-Key Cryptography [6h]

      • Introduction to public-key cryptography

      • Introduction to Number Theory

      • The RSA algorithm

      • Diffie-Hellman key exchange

    5. Message Authentication and Digital Signatures [3h]

      • Message integrity and authentication functions (message encryption, message authentication code, cryptographic hash functions)

      • Digital signature

    6. Public Key Infrastructure (PKI) [3h]

      • PKI components

      • Digital Certificates

      • Trust models

    7. Security Protocols [6h]

      • Basic notions (protocol execution, assumptions and goals, attacker model)

      • Examples of protocols (NSPK, Otway-Rees, Andrew Secure RPC, Denning & Sacco)

      • Prudent engineering of security protocols

      • Kerberos (architecture, protocol, inter-realm communication, limitations)

    8. Secure mail [3h+3h hands on]

      • PGP

    9. Network Security [6h]

      • Link Layer: WiFi Security

      • Network Layer: IP-Sec

      • Transport Layer: SSL/TLS

      • Introduction to Firewalls

    10. Web Security [6h + 6h hands on]

      • Security on the client side (cookies and privacy, HTTP authentication mechanisms)

      • Security on the server side (unvalidated input, broken authentication and session management, cross-site scripting, injection flaws, denial of service, ...)

    11. Secure Programming [6h]

      • Buffer overflows

      • Format string vulnerabilities

    12. Access Control [6h]

      • Discretionary vs Mandatory Access Control

      • Access control matrix model

      • Role-Based Access Control (RBAC)

      • Administrative Role-Based Access Control (ARBAC)

      • I modelli di Bell-LaPadula, Harrison-Ruzzo-Ullman, Chinese Wall

    13. Cyber Exercise [12h hands on]

    RECOMMENDED READING/BIBLIOGRAPHY

    Teaching material (slides and exercises) are available on AulaWeb.

    Charles P. Pfleeger Shari Lawrence Pfleeger. Security in Computing, 4/E. ISBN-10:0132390779, ISBN-13: 9780132390774, Prentice Hall Editor, 2007. (Available also in Italian)

    William Stallings, Lawrie Brown. Computer Security: Principles and Practice (3rd Edition). Pearson Ed., 2015

    TEACHERS AND EXAM BOARD

    Exam Board

    ALESSANDRO ARMANDO (President)

    GIACOMO RENATO BENEDETTI

    LUCA VERDERAME

    ALESSIO MERLO (President Substitute)

    LESSONS

    Class schedule

    All class schedules are posted on the EasyAcademy portal.

    EXAMS

    EXAM DESCRIPTION

    Written Exam based on open–ended questions. 

    Hands-on Assessment (CyberExercise) requiring the solution of “Capture-the-Flag” problems. 

    Students with learning disorders ("disturbi specifici di apprendimento", DSA) will be allowed to use specific modalities and supports that will be determined on a case-by-case basis in agreement with the delegate of the Engineering courses in the Committee for the Inclusion of Students with Disabilities.

     

     

    ASSESSMENT METHODS

    The written test will assess

    • The understanding of the fundamental problems and techniques of Computer Security

    • the ability to critically evaluate the characteristics of the various solutions to classical security problems (e.g. data protection, authentication, authorization),

    The practical test will assess

    • The ability to use penetration testing tools

    • the ability to discover vulnerabilities and exploits in computer systems.

    Exam schedule

    Date Time Location Type Notes
    11/01/2023 16:00 GENOVA Scritto
    17/01/2023 14:00 GENOVA Laboratorio
    08/02/2023 16:00 GENOVA Scritto
    17/02/2023 15:00 GENOVA Laboratorio
    15/06/2023 16:00 GENOVA Scritto
    13/07/2023 16:00 GENOVA Scritto
    25/07/2023 15:00 GENOVA Laboratorio
    04/09/2023 16:00 GENOVA Scritto