Modern computer systems routinely handle high-value information such as financial and personal data, economic transactions, and various forms of valuable intellectual property. Moreover, computer systems are becoming pervasive, always-on and increasingly interconnected. Ensuring information security in this landscape is an extremely challenging task.

Security engineering, the discipline of designing and building secure systems, is a complex, interdisciplinary problem mixing elements of cryptography, software engineering, secure networking, as well as political and social challenges.

This course is an extensive introduction to the challenges of cybersecurity, and to the methodology to build, validate, and (ethically) bypass security systems with the goal of learning how to secure them properly.

During the lectures, we will analyze the various building blocks of a computer and information system, including their security subsystems. We will constructively analyze their vulnerabilities, see how these can be exploited, and deductively learn what was wrong and how to avoid repeating such engineering mistakes.

At the end of the course, students will know the basic terminology of security and a rudimentary risk assessment methodology. They will have a broad knowledge of basic security technologies and of their fallacies and issues. They will also have a working knowledge of some basic examples of vulnerabilities and their exploitation.

After the exam and the optional hacking lab, students will have developed the skills needed to assess the basic security issues of systems, networks and applications. They will be able to discuss security choices in meaningful terms, to evaluate a provided solution and improve over it, or to offer and sketch a solution to a security problem provided. They will also be able to exploit simple application vulnerabilities, and to develop basic patches. 

1) Introduction to information security

- What is information security: examples

- Vulnerabilities, Risks, Exploits, Attackers: definitions

- Security as risk management

2) A short introduction to cryptography

- Basic concepts: cypher, transposition, substitution

- Symmetric and asymmetric ciphers

- Hash functions, digital signatures and PKI

- Vulnerabilities in digital signature schemes and in PKI

- Why all of the above is almost useless as a security defense

3) Authentication

- The three ways of authentication

- Multifactor authentication

- Authentication technologies evaluation; bypassing authentication control

4) Authorization and access control

- Discretionary (DAC) and mandatory (MAC) access control policies

- Multilevel security and its applications: military secrets management

5) Software vulnerabilities

- Design, implementation and configuration bugs

- Typical memory errors: buffer overflow and format string bugs

- Exploiting applications and local privilege escalation (*)

- Web application security: introduction

- Typical code-injection vulnerabilities: cross-site scripting and SQL injections

- Hacking real web applications (*)

- Code review and fuzzing: finding bugs in real world applications

6) Secure networking architectures

- Network protocol attacks: sniffing, denial of service, spoofing, DNS poisoning, ARP poisoning

- Firewall: taxonomy and technologies

- Secure network architectures (DMZ and multi-zone networks)

- Virtual private networks (VPN)

- Secure connections and transactions: the tale of SSL and SET and their weaknesses

7) Malicious software

- The evolution of malicious software: from the Morris worms to modern malware

- Mobile malware: the case of malicious Android apps

- Botnets and underground economy

- Malware analysis and honeypots

The course is complementary and not alternative to cryptography courses such as "095947 CRYPTOGRAPHY AND ARCHITECTURES FOR COMPUTER SECURITY". The overlap with such courses is minimal.

The course has a strong "hands-on" philosophy. Practical exercises will be conducted for all the topics marked with a (*) in the following syllabus. A "virtual hacking lab" will be available, where students can practice how to bypass and secure computer applications.

Students will need a basic knowledge of the following topics:

• Network protocols (in particular the TCP/IP suite and HTTP)
• Web applications and their 3-tier architecture
• C language, and possibly a language useful to create simple scripts such as Python
• Operating systems, in particular memory allocation and protection
• Assembly language (an X86 assembly language introductory class will be provided during the course)

The exam is a written test (Italian students can, if they so wish, answer in Italian). The test is comprised of open questions, relative to theory or to simple applications of theory and reasoning to use cases, code samples, network schemes, etc. A large collection of previous exams, in large part with solutions, is provided on Beep.

The grade can be integrated with points (up to 3) available during the year with specific "assignments", such as breaking into applications made available in the virtual hacking lab. Such assignments are completely optional, and the maximum grade cum laude can be obtained also with the final written exam alone.

It is vital that you get the 3rd edition if you choose this book!