SECURITY 1

This course aims at introducing basic concepts and techniques for the development of secure systems and networks. In the first part of the course, we will cover program exploitation, system, network and web security. In the second part of the course, we will apply the theory in a laboratory of "ethical hacking" in which students will have to attack other teams while defending their own system from other teams' attacks. The first part is preparatory for the second one.

- knowledge of basic concepts and techniques for the development of secure systems and networks;
- knowledge of attack and defence techniques related to program exploitation, system, network and web security;
- skills related to securing real systems and networks, developed through an ethical hacking lab.

It is required basic knowledge of mathematics, programming (good level of C and basic notions of scripting and PHP), computer architectures, operating systems and computer networks.

1. Background and tools
1.1 Introduction to Linux shell
1.2 Introduction to Python
1.3 Intel assembly
1.4 Program analysis

2. Program exploitation
2.1 Overflow and stack protection
2.2 Overwriting the return address
2.3 Format strings
2.4 Secure programming and countermeasures

3. System and network security
3.1 Identification
3.2 Network attacks and countermeasures
3.3 Firewall configuration

4. Web security (server side)
4.1 SQL injections
4.2 Blind SQL injections
4.3 Prevention of server side attacks

5. Web security (client side)
5.1 Cross site scripting (XSS)
5.2 Cross site request forgery (CSRF)
5.3 Prevention of client side attacks

J. Erickson, Hacking, the art of exploitation, No starch press, 2008.
R. J. Anderson, Security Engineering: A Guide to Building Dependable Distributed Systems, Wiley, 2008.

The exam takes place through a written test, some assignments and a competition of ethical hacking. The written test aims at verifying the knowledge of the different topics of the course. Assignments are not mandatory and consist of a problem (challenge) to solve. Solving assignments give extra score with respect to the the mark of the written test. The ethical hacking competition aims at putting into practice the knowledge acquired and verifying the competence in attacking and securing IT systems and networks.

Theoretical lectures and practical laboratory classes;
Audio and Video online resources;
Chat and forum;
Challenges on various topics that give extra score;
Ethical hacking lab.

English

written

This subject deals with topics related to the macro-area "Cities, infrastructure and social capital" and contributes to the achievement of one or more goals of U. N. Agenda for Sustainable Development