Differences

This shows you the differences between two versions of the page.

--- security_engineering_2017 [2018/08/24 19:43]
fabio.massacci@unitn.it [Assigned Exercises (Graded)]
+++ security_engineering_2017 [2021/01/29 11:58]
@@ Line 1: / Line 1: @@
-====== Cyber Security Risk Assessment ======
-This course is offered at the University of Trento by the [[security_group|security group]] in the framework of the [[https://masterschool.eitdigital.eu/programmes/cse/|Cyber Security track]] of the [[https://www.eitdigital.eu/|European Institute of Innovation and Technology (EIT Digital)]] Master School programme.
-See the [[teaching_activities|UniTrento Cyber Security Master Track page]] for further information.
-** See the [[security_engineering|new course for this academic year]] for uptodate information **
-===== Course Objectives (2017/2018) =====
-Most CS professionals will actually use, buy, or sell security technology and make security decisions. They don't design protocols, nor crypto algorithms, they decide which security technology they are going to use. However, they are not trained to actually choose the technology. The course should teach them to chose the technology based on balancing threat and controls, costs, impact and likelihood of events. In other words the course will teach them to manage risk.
-The course will introduce students to the key principles of Security Risk Assessment (Risk and Threat Analysis, Risk Assessment, Control Frameworks). The student will identify threats and the corresponding security controls appropriate for two industrial case studies.
-At the end students should be able to make their own cyber risk assessment, documenting the threats and the security controls or requirements for an industrial case study
-==== Pre-requisite ====
-General knowledge about Security is mandatory before attending this course (for the obvious reason that you cannot chose among technologies you don't know at all). This might be obtained by attending the Master Level courses of Introduction to Computer and Network Security, Cryptography, and Security Testing at the [[https://masterschool.eitdigital.eu/programmes/cse/|Cyber Security track]] in Trento. Bachelor students from Trento might also consider the course on Reti Avanzate which provides the minimum knowledge about cryptographic protocols.
-===== Lecturers =====
-  * Lecturers: Fabio Massacci
-===== Textbook =====
-  * [[http://www.jblearning.com/catalog/9781284055955/|Gibson. "Managing Risk in Information Systems"]]. Jones and Bartlett. ISBN13: 9781284055955
-Other recommended texts are
-  * [[http://www.cl.cam.ac.uk/~rja14/book.html|Anderson. "Security Engineering"]] For which a old version is also on the web.
-  * [[https://www.wiley.com/WileyCDA/WileyTitle/productCd-0470741155,miniSiteCd-BSG.html|Gollmann. "Computer Security"]] which is mostly a reference book for Security Technologies.
-===== Exam Modalities =====
-The exam will evaluate the skills of the students in solving problems and the acquired knowledge of course's arguments. The exam will consists of both individual exercises to be done in the lab and a final report.
-In the report students working in group or alone apply the concepts learned during the course to analyze a real case study. The report will be discussed with the lecturer and a company representative owning the case study. If the work for the report has been done in group, all the group members will normally be assigned the same mark.
-  * Step-by-Step Qualita/ve RA Exercises during the course (up to 16/30)
-     * Item Industrial Cases:Remote Virtual Control Tower Center (RTC)
-     * Building AutomaMon by UTC (UTC)
-     * These include: Identify Assets, Threats, Pre and Post Controls
-  * Assess Vulnerabilities Exercise (Up to 6/30)
-     * CVSS (Common Vulnerabilities Scoring System), world standard.
-     * exercise 1 is to identify risk from descriptions as they arrive in a CERT Bulletin)
-     * Exercise 2 is to identify risk as they apply to you on your security architecture
-  * Final Project (Up to 12/30)
-     * A complete detailed quantitative risk assessment of the industrial automation case study security architecture
-     * Evaluation by Industry experts of UTC
-Being able to defend your ideas in class is an important part of the evaluation (if you cannot explain why you chose something you get a negative vote for the relative exercise).
-===== Schedule and Additional Material =====
-  * Monday - room A220 - 11:30-13:30
-  * Friday - room A114 - 14:30-16:30 (up to 17:30 when practical exercises are held)
-^Date ^Topic ^Slides ^Other Material ^
-|2018-02-19 |Introduction | {{:teaching:seceng:2017:cybrisk-2017-01-introduction.pdf|Introduction}}, {{:teaching:seceng:2017:cybrisk-2017-02-terminology.pdf|Terminology}}| {{:teaching:seceng:2015:itgov-2012-cardfrauds.pdf|Card Frauds}}{{:teaching:seceng:2015:usgov-2015-idtheft-stats.pdf|ID Theft Stats}} |
-|2018-02-23 |Risk Management Fundamentals | {{:teaching:seceng:2017:cybrisk-2017-03-riskmanagement.pdf|Risk Management}}| The SESAR SecRAM Manual is available on the Google ClassRoom. As examples of management guides [[https://cobitonline.isaca.org/l3-main?book=framework|COBIT 5 Book]] e [[http://csrc.nist.gov/publications/nistpubs/800-30-rev1/sp800_30_r1.pdf|NIST 800-30 Risk Assessment Guide]] and the associated [[http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf|NIST 800-53 Security Controls Catalog]], [[https://www.ncsc.gov.uk/content/files/guidance_files/IS1%20%26%202%20-%20Information%20Risk%20Management%20-%20issue%204.0%20April%202012%20-%20NCSC%20Web.pdf|UK IAS risk Assessment]]|
-| 2018-02-26 | Identifying Assets and Activities to Be Protected | {{:teaching:seceng:2017:cybrisk-2017-05-asset-identification.pdf|Slides}} | [[https://download.gsb.bund.de/BSI/ITGSKEN/IT-GSK-13-EL-en-all_v940.pdf|BSI Catalogues]] |
-| 2018-03-05 | Identifying and Analyzing Threats, Vulnerabilities, and Exploits | {{:teaching:seceng:2017:cybrisk-2017-06-threats-vulns-exploits.pdf|Slides}}| {{:teaching:seceng:2017:enisa-threats-taxonomy.pdf|ENISA Threat Taxonomy}}. |
-| 2018-03-12 | Risk Mitigation with Security Controls | {{:teaching:seceng:2017:cybrisk-2017-07-controls.pdf|Slides}}| see above for information. |
-| 2018-03-19 | UTC - Case Study Presentation | See Google Classroom for the presentation | US CERT's case study on [[https://ics-cert.us-cert.gov/sites/default/files/recommended_practices/CaseStudy-002.pdf|Malware attacks on Industry Control Systems]] |
-| 2018-03-23 | Mitigating Risks by post-controls for Business Continuity and Disaster Recovery  | {{:teaching:seceng:2017:cybrisk-2017-09-recovery.pdf|Slides}}| |
-| 2018-03-26 | Discussion on Likelihood estimation | | See above for the IAS |
-| 2018-04-06 | Visit to a SOC @ Trentino Network | | |
-| 2018-04-13 | Introduction to Quantitative Risks | {{:teaching:seceng:2017:cybrisk-2017-09-quantitative.pdf|}} | There are several proposals for example [[https://users.encs.concordia.ca/~wang/papers/ijngc10.pdf|metrics using attack graphs]], another variant available as [[https://pdfs.semanticscholar.org/600e/af2f14b549bed20f1af15b80aca3175e511b.pdf|NIST Interagency report]]|
-| 2018-04-16 | CVSS Base Introduction |{{:teaching:seceng:2017:cybrisk-2017-10-qra-cvss-base.pdf|Slides}} | {{:teaching:seceng:material:cvss-v30-user_guide.pdf|CVSS Original User Guide}}, {{:teaching:seceng:material:cvss-v30-examples.pdf|CVSS SCoring Examples}}. There is also an [[https://learning.first.org/courses/course-v1:FIRST+CVSSv3+2017/about|official tutorial on CVSS]], which also has an HTML transcript |
-| 2018-04-23 | CVSS Environment Introduction | {{:teaching:seceng:2017:cybrisk-2017-10-qra-cvss-environment.pdf|Slides}} | See above. Look also at {{https://www.elsevier.com/books/pci-compliance/williams/978-1-59749-948-4|PCI Compliance}} |
-| 2018-05-04 | CVSS Environment Review | | |
-| 2018-05-07 | Quantitative Risk Analysis II | {{:teaching:seceng:2017:cybrisk-2017-11-quantitative-costs.pdf|Slides}} | |
-| 2018-05-07 | Quantitative Risk Analysis III | | Detailed Instruction {{http://www.win.tue.nl/~lallodi/allodi-risa-17.pdf|here}} |
-==== Assigned Exercises (Graded) ====
-All assignments are assigned through Google Classroom. Students will be asked to comment in class on their assignment which must be submitted through Classroom.
-^Date ^Topic ^Other Material ^
-| 2018-03-02 | ROT Exercise - Assets | [[http://www.sesarju.eu/sesar-solutions/airport-integration-and-throughput/remote-tower-single-airport|Remote Virtual Tower Description]] |
-| 2018-03-09 | ROT Exercise Threats | Chris Johnson's analysis of the incidents of [[http://www.dcs.gla.ac.uk/~johnson/papers/Linate/Chris_W_Johnson_Ueberlingen_Linate.pdf|Linate and Uberlingen]] and of [[http://www.dcs.gla.ac.uk/~johnson/papers/IET_2007/Accident_reports.pdf|114 US incidents]]. An article on the drone accident nearby [[http://www.ntsb.gov/aviationquery/brief2.aspx?ev_id=20060509X00531&ntsbno=CHI06MA121&akey=1|Nogales (2006)]], and Washington Post's article on [[http://www.washingtonpost.com/sf/investigative/2014/06/20/when-drones-fall-from-the-sky/ |Drones' incidents]]. ABC reports of attempted [[http://abcnews.go.com/US/story?id=95993|voice hijacking]] of airplanes. Bowden's Hacking of a sewage treatment plant ({{:teaching:seceng:2014:grc-boden-sewage_spillover-fisma-study.pdf|FISMA study of security controls}} or the {{:teaching:seceng:2014:grc-boden-sewage_spillover.pdf|Court conviction}}). Terry Childs' refusal to pass admin rights ({{:teaching:seceng:2014:grc-childs-refusal.pdf|Court documents}} and discussion on {{http://www.cio.com.au/article/255165/sorting_facts_terry_childs_case?fp=&fpid=&pf=1|CIO Magazine}} and {{http://www.computerworld.com/article/2517653/security0/after-verdict--debate-rages-in-terry-childs-case.html|on ComputerWorld}}) |
-| 2018-03-16 | ROT Exercise - Pre Controls | see above |
-| 2018-04-09 | ROT Exercise - Post Controls | see above |
-| 2018-05-21 | UTC Case Study Webinar | See Google Classroom. There is a comprehensive [[https://ics-cert-training.inl.gov/learn|tutorial on Security for ICS]] |
-| 2018-05-06 | Presentations Review | |
-| 2018-04-20 | CVSS Base Exercise in Class (Graded - individually) | |
-| 2018-04-27 | CVSS Environmental Exercise in Class (Graded -individually) | |
-| 2018-05-18 | UTC Exercise - Qualitative Report Review | |
-| 2018-05-28 | UTC Exercise - Quantitative | |
-| 2018-06-04 | UTC Exercise - Quantitative II | |
-==== Final Report ====
-The final deliverable by June 11 should include:
-  * the report summarising the finding of your security risk assessment in Google Docs format
-  * security risk assessment of the case with SESAR SecRAM in Google Spreadsheets format

DISI Security Research Group Wiki

User Tools

Site Tools

Differences

Page Tools