LAB OF COMPUTER SECURITY
|Academic year||2020/2021 Syllabus of previous years|
|Official course title||LAB OF COMPUTER SECURITY|
|Course code||ET7016 (AF:275113 AR:160784)|
|Modality||On campus classes|
|Degree level||Bachelor's Degree Programme|
|Educational sector code||INF/01|
|Moodle||Go to Moodle page|
The goal of this course is to introduce the technical foundations of computer and network security, in order to be able to understand the threats that any digital business can be subject to.
Students will approach the themes of computer security, networking principles, security protocols and security services, with a hands-on approach.
- The basics of a system administration, privileges and commands in a GNU/Linux environment;
- What is a security service, a security threat and a software bug;
- What are the foundations of computer communications (Internetworking) and the basics of network security;
- A primer on cryptography;
- Secure Internet protocols.
Skills; the student will be able to:
- Reproduce basic examples of typical software vulnerabilities;
- Apply basic principles of secure programming;
- Perform basic network survey, security analysis and remote attacks (e.g. ethical hacking);
- Use and recognize secure Internet services;
The student will be also able to make assesements on the robustness and security features of systems with regards to typical security services (authentication, data secrecy, availability etc.) and to be able to communicate with experts of the domain on the security features that a specific service needs to offer to its users.
Week one: Introduction to information security and operating system (OS) security:
- Introduction to security services, threats and mechanisms;
- Introduction to the GNU/Linux OS, the users, the privileges and the design of the OS as an example of OS security.
Week two: OS Security:
- Software attacks: what is a bug?;
- Examples of well-known vulnerabilities and coding bad practices;
- Sources of known vulnerabilities: Common Vulnerability Exposure;
- Secure programming guidelines.
Week three: Network Security:
- Introduction to networks and networking;
- Attacking remote systems;
- Known and typical attacks to various network layers: scanning, spoofing, DDoS, remote brute force.
Week four: Introduction to Cryptography:
- Classical cryptography concepts;
- Symmetric cryptography;
- Hash functions and HMAC;
- Example applications: password hashing and blockchains.
Week five: Asymmetric cryptography and PKI:
- Public/Private key cryptography;
- Certificates and PKI;
- Secure protocols: TLS;
The lesson slides together with the lecture notes are enough to prepare the exam.
One reference book that contains material for almost the whole course (and much more) is:
Wenliang Du: Computer & Internet Security: A Hands-on Approach, (second edition, 2019, ISBN: 978-1-7330039-2-6, hardcover. ISBN: 978-1-7330039-3-3, paperback). The book is available at: https://www.handsonsecurity.net/ .
Other books that can serve as additional references are:
Andrew S. Tanenbaum, David J. Wetherall, Computer Networks: Pearson, fifth edition.
Olivier Bonaventure Computer Networks: Principles, Protocols, Practice https://inl.info.ucl.ac.be/cnp3 (Creative Commons license, third edition).
William Stallings, Cryptography and Network Security, Pearson, seventh edition.
The test will be made of questions with multiple choice plus open answers referring to problems (and their solution) analysed during the classes.
Students will be given optional assignments during the course to test their understanding of the subject.