Learning outcomes

The system security course aims to provide the fundamental knowledge necessary for specifying and analyzing security policies designed depending on the features of the system to protect, and on the information to protect.
In particular, the course proposes an initial overview of the basic concepts, and then focalizes on the security of operating systems, with particular attention to authentication and authorization, on software security, on software vulnerabilities in presence of malware, and on security databases.
Finally will be treated security management and legal aspects of computer security.

Program

Il corso svilupperà i seguenti argomenti:
1) Introduction:
- Notion of security and tasks of security (confidentiality, integrity and availability)
- Risk and assets analysis
- Vulnerabilities (hardware, software, data and comunication)
- Defenses
- Principles of information security
2) Classical Models
- Policies and models
- Policies: confidentiality vs integrity
- Access control (Autentication vs Autorization)
- DAC models (Harrison-Ruzzo-Ullmann, Graham-Denning, take-grant)
- Multilevel security (MAC)
- Classical models (Bell-LaPadula, Biba, Clark-Wilson, Chinese Wall)
- RBAC
- Non interference
3) Standard Meccanisms
- Autentication
- Autentication vs Identification
- Autentication (password-based, token-based, biometric)
- Attacks and protection
- Meccanisms for access control
- Intrusion detection systems
- Execution monitors
4) Data base security
- Relational data base security
- Access control and SQL
- Statistical data base security (Aggregation, inference and kind of attacks)
- Multilevel data base security
- Security and Data mining
5) Software
- SW Vulnerabilities
- Input management: errors vs attacks
- Store management: Buffer overflow
- Other kind of SW attacks
- Malware
- Kinds of malware
- Virus (Definitions, propagation methods, defence methods)
- Worm
- Backdoor (trapdoor), Troian horses and other malware kinds
- Models
- Defenses
6) Legal aspects of security
- Privacy and computer science
- Cyber crimes
- Ethical aspects
7) Security management
- Physical manaces to security
- Pianification and human issue
- Economical aspects of security