Course Topics
The course introduces the fundamental concepts related to the security of computer systems and networks, illustrating the main threats and strategies to protect data, applications, and infrastructures. The instruction begins with an overview of the key concepts in system and network security, highlighting the principles of confidentiality, integrity, and availability of information, as well as the concepts of authentication, authorization, and accountability. The course also presents the variety of cyber threats, including viruses, worms, trojans, ransomware, and spyware, and explains how these can compromise the security of data and systems.
Subsequently, the course delves into the basic mechanisms of cryptography. It explains the differences between symmetric and asymmetric cryptography, methods for key management, and the use of digital signatures to ensure data authenticity and integrity. The concept of hashing is also addressed, including the properties of hash functions and the issues related to collisions. Additionally, the course describes methods for secure key exchange and practical applications of digital certificates.
Another focus of the course is web application security. The most common vulnerabilities, such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF), are analyzed, explaining how attackers can exploit them. Software security is discussed, including issues related to buffer overflows, and the main strategies to prevent such vulnerabilities are illustrated.
The course also covers the architectures of security devices and related infrastructures. Firewalls, intrusion detection and prevention systems (IDS/IPS), proxies, and other devices are described. The role of public key infrastructures (PKI) and digital certificates is examined in depth, as they are essential for ensuring authenticity in digital communication.
A specific module is dedicated to network security, with particular attention to secure communication protocols, access control, network segmentation, and techniques for protecting against interception. Threats such as ARP poisoning, DNS poisoning, and man-in-the-middle attacks are illustrated, along with countermeasures to mitigate them.
Finally, the course focuses on risk management and resilience strategies. Topics include risk assessment, threat analysis, the definition of security policies, and mitigation plans. Concepts such as redundancy, fault tolerance, backup systems, and disaster recovery are explored in detail.
Teaching format
Frontal classroom lecture and lab sessions.