Security Engineering and Management (2014/2015)

This course is offered at the University of Trento by the security group in the framework of the Security and Privacy Master of the European Institute of Innovation and Technology (EIT Digital).

See the UNITN S&P EIT page for further information.

See the current Security Engineering Course for further information.

Most CS professionals will actually use, buy, or sell security technology and make security decisions. They don't design protocols, nor crypto algorithms, they decides which security technology they are going to use. However, they are not trained to actually choose the technology. The course should teach them to chose the technology based on case studies from industry.

The course will introduce students to a number of methodologies for Security Management (Risk and Threat Analysis, Risk Assessment, Control Frameworks) and provide a high level view of some Security Technologies (Authentication, Database, Access control, Web Application, etc). By using two industrial risk assessment methodologies, the student will identify threats and the corresponding security controls appropriate for an industrial case study.

At the end students should be able to make their own security analysis, documenting the threats and the security controls or requirements for an industrial case study

• Lecturers: Fabio Massacci
• Teaching assistant: Katsiaryna Labunets

The exam will evaluate the skills of the students in solving problems and the acquired knowledge of course's arguments. The exam will consists of an oral and written part. The written part will be a report where students working in group or alone apply the concepts learned during the course to analyze a real case study. The oral part will consist in a discussion of the report with the lecturer and a company representative owning the case study.

The students who will attend the class will have the opportunity to present their work and receive feedbacks before the final submission of the report. The final mark will be assigned based on the written report. If the work for the report has been done in group, all the group members will be assigned the same mark

You can register to the course on the following link: registration form BY October 13th.

Note: If you have a problem in finding a group partner, send us a message: labunets (at) disi.unitn.it.

• Tuesday - room A224 - 11:00-12:30
• Wednesday - room A222 - 14:00-15:30 (up to 17:00 when practical exercises are held)

The final deliverable should include the following documents:

1. [1 file] Security Engineering report which presents the results of all three deliverables (template).
2. [1 file] Summary of results which aggregates the results of all three deliverables (template). This document should be submitted in Excel format ONLY.
3. [4 files] Method artifact files for each deliverable (1a, 1b, 2 and 3): CORAS artifact file (template) or SecRAM artifact file (template).

The final presentation template in .pptx format: template. The final presentation should be submitted in Power Point or PDF format.

[OLD] Each deliverable should include the following documents:

1. Security Engineering report (template).
2. Summary of results (template). This document should be submitted in Excel format ONLY.
3. Method artifact file: CORAS artifact file (template) or SecRAM artifact file (template). Note: Deliverable 1 should contain method artifact files for both CORAS and SecRAM methods. Deliverable 2 and 3 should contain method artifact file for the assigned method.

Each deliverable should be submitted by 12:00:00 PM (noon) of the day of the deadline (see the table above).