Programma

Dr. Carlo Mazzocca (UniSA)
Dr. Nicolò Romandini (UniBO)
24 hours (lectures)

Outcomes:

Knowledge of the main different aspects of security as a process, and of the technical language used to describe threats, vulnerabilities, and countermeasures.
Security requirements: confidentiality, integrity, authenticity, and how to achieve them in presence of different adversaries.
Analysis of the main cryptographic building blocks to design security countermeasures. Tips on correct implementation of cryptographic mechanisms.

Prof. Franco Callegati (UniBO)
Prof. Walter Cerroni (UniBO)
36 hours (lectures and labs)

Outcomes:

Basic ability to program network devices to implement segmented layer-2 and layer-3
internetworks.
Knowledge of security issues in telecommunication and of protocols (e.g. IPSec, TLS) for their mitigation.

Prof. Gabriele D'Angelo (UniBO)
Prof. Angelo Di Iorio (UniBO)
Prof. Marco Prandini (UniBO)
Dott. Davide Ciandrini (Cyberloop srl)
40 hours (lectures and labs)
 
Outcomes:
Knowledge of the basic steps of system configuration, from boot to service management. Basic ability to manage software installation, update and configuration in a production environment.
Knowledge of the different categories of vulnerabilities in a system and of the corresponding attack vectors. Basic ability to use tools for proactive security assessment and centralized monitoring.

Avv. Valentina Ricci (Privacy Network)
Dr. Stefano Maistri (IMQ Minded Security)
16 hours (lectures)

Outcomes:
Knowledge of design patterns and best practices for the whole process of secure software development.



The module will be complemented with specific workshops

- Static application security testing
Dr. Andrea Pagani (Crif)
8 hours
CyberSec Fields and TradeOffs
What is Source Code Analysis? SAST, OSS & Dependency, DAST & IAST Considerations
Top Application Security Risks; OWASP Top 10 2021 Detection
Lab 1 – Demo of a SAST tool: Running Fortify scans
Remediation: High level fixing strategies
Industrialization of SCA: Distributing SAST on large scale
Lab 2 – Corporate SAST: Scenarios for building SAST architectures

Dr. Giueppe Porcu (IMQ Minded Security)
Ph.D. Andrea Melis (UniBO)

24 hours (lectures and labs)

Outcomes:
Knowledge of the OWASP methodology for web applications.
Tools to verify web app security according to the OWASP methodology.
Specific challenges of web application security testing
Intelligence gathering and threat modeling
Vulnerability analysis
Client side attacks, Server side attacks
Tools and techniques

24 hours (lectures and labs)

Dott. Luca Capacci
Dott. Alfonso Solimeo (Cryptonet Labs)
24 hours (lectures and labs)

Outcomes:
Knowledge of the design patterns and security testing methodology for mobile applications.
Tools to verify mobile app security according to the presented methodology.
Specific challenges of mobile application security testing
Intelligence gathering and threat modeling
Vulnerability analysis
Testing authentication, cryptography, code quality.
Android, iOS and hybrid applications anatomy
Tools and techniques

Ph. D. Andrea Melis (UniBO)
Dr. Edoardo Montrasi (Cryptonet Labs)
16 hours

Outcomes:
Understanding of the structure of an ICS and of challenges posed by its peculiar differences with respect to IT systems.
Knowledge of security issues and possible countermeasures
Specific challenges of industrial control systems
Intelligence gathering and threat modeling
Vulnerability analysis
Embedded systems and fieldbus protocols anatomy
Tools and techniques

Prof. Fabio Pierazzi (University College London)
Dr. Alessandro Biondi (Cyberloop)
Dr. Andrea Bernardi (Cyberloop)
32 hours (lectures and labs)

Outcomes:
Knowledge of the CERT operations to detect threat trends and ongoing attacks.
Tools for static and dynamic analysis of code to identify malware.

Dott. Eugenio Severi (Certego)
Dott. Daniel Veroli (Certego)
Dott. Luca Cigarini (Certego)
Dott. Simone Ferraguti (Certego)
Dott. Tommaso Di Donato (Crif)
Dott. Massimiliano Pinto (Crif)
28 hours (lectures and labs)

Outcomes:
Knowledge of network-based intrusion detection systems and other kinds of probe-based systems to collect and correlate traces of malicious activity in progress.
Critical (industrial, infrastructural, etc) system architectures and methods for their protection from attacks.

Dott. Luca Losio (4n6)
16 hours (lectures)

Outcomes:
Knowledge of the methods to identify ongoing incidents and restore normal operations after a security breach.
Ability to draw an incident response plan and policy

Prof. Alessandro Amoroso (UniBO)
Dott. Luca Losio (4n6)
32 hours (lectures and labs)

Outcomes:
Knowledge of the issues and challenges of forensics, from a technical and legal viewpoints, such as chain of custody.
Ability to use the main forensics tools to analyze data and to write the final report.