This course is offered at the University of Trento by the security group in the framework of the Cyber Security track of the European Institute of Innovation and Technology (EIT Digital) Master School programme.

See the UniTrento Cyber Security Master Track page for further information.

See the new course for this academic year for uptodate information

Most CS professionals will actually use, buy, or sell security technology and make security decisions. They don't design protocols, nor crypto algorithms, they decide which security technology they are going to use. However, they are not trained to actually choose the technology. The course should teach them to chose the technology based on balancing threat and controls, costs, impact and likelihood of events. In other words the course will teach them to manage risk.

The course will introduce students to the key principles of Security Risk Assessment (Risk and Threat Analysis, Risk Assessment, Control Frameworks). The student will identify threats and the corresponding security controls appropriate for two industrial case studies.

At the end students should be able to make their own cyber risk assessment, documenting the threats and the security controls or requirements for an industrial case study

General knowledge about Security is mandatory before attending this course (for the obvious reason that you cannot chose among technologies you don't know at all). This might be obtained by attending the Master Level courses of Introduction to Computer and Network Security, Cryptography, and Security Testing at the Cyber Security track in Trento. Bachelor students from Trento might also consider the course on Reti Avanzate which provides the minimum knowledge about cryptographic protocols.

• Lecturers: Fabio Massacci

• Gibson. "Managing Risk in Information Systems". Jones and Bartlett. ISBN13: 9781284055955

Other recommended texts are

• Anderson. "Security Engineering" For which a old version is also on the web.
• Gollmann. "Computer Security" which is mostly a reference book for Security Technologies.

The exam will evaluate the skills of the students in solving problems and the acquired knowledge of course's arguments. The exam will consists of both individual exercises to be done in the lab and a final report.

In the report students working in group or alone apply the concepts learned during the course to analyze a real case study. The report will be discussed with the lecturer and a company representative owning the case study. If the work for the report has been done in group, all the group members will normally be assigned the same mark.

• Step-by-Step Qualita/ve RA Exercises during the course (up to 16/30)
  • Item Industrial Cases:Remote Virtual Control Tower Center (RTC)
  • Building AutomaMon by UTC (UTC)
  • These include: Identify Assets, Threats, Pre and Post Controls
• Assess Vulnerabilities Exercise (Up to 6/30)
  • CVSS (Common Vulnerabilities Scoring System), world standard.
  • exercise 1 is to identify risk from descriptions as they arrive in a CERT Bulletin)
  • Exercise 2 is to identify risk as they apply to you on your security architecture
• Final Project (Up to 12/30)
  • A complete detailed quantitative risk assessment of the industrial automation case study security architecture
  • Evaluation by Industry experts of UTC

Being able to defend your ideas in class is an important part of the evaluation (if you cannot explain why you chose something you get a negative vote for the relative exercise).

• Monday - room A220 - 11:30-13:30
• Friday - room A114 - 14:30-16:30 (up to 17:30 when practical exercises are held)

All assignments are assigned through Google Classroom. Students will be asked to comment in class on their assignment which must be submitted through Classroom.

The final deliverable by June 11 should include:

• the report summarising the finding of your security risk assessment in Google Docs format
• security risk assessment of the case with SESAR SecRAM in Google Spreadsheets format