5 credits
30.0 h + 15.0 h
Q2
Teacher(s)
Legay Axel;
Language
English
Main themes
The objective of the course is to make the student aware of the problem of computer security by adopting the "ethical hacking" approach.
The approach followed is that of showing how the vulnerabilities of a computer system can be exploited to threaten security. From there, the student will develop the skills necessary to detect these vulnerabilities and to protect the system. These can be deployed upstream or downstream (depending on the development process). We will also look at the cost and strength of these measures.
The student will also receive a very brief introduction to malware analysis and the techniques to detect them.
During this course, the student will also be aware of the place that cybersecurity takes in industry, as well as the ethical issues that are related to this field.
For information, the vulnerabilities addressed will be: buffer overflow, integer overflow, format string, data race. Among the protection we will study the technique of the non-executable stack or even that of the "canary". For malware analysis, we will focus on MIRAI and the YARA tool.
The approach followed is that of showing how the vulnerabilities of a computer system can be exploited to threaten security. From there, the student will develop the skills necessary to detect these vulnerabilities and to protect the system. These can be deployed upstream or downstream (depending on the development process). We will also look at the cost and strength of these measures.
The student will also receive a very brief introduction to malware analysis and the techniques to detect them.
During this course, the student will also be aware of the place that cybersecurity takes in industry, as well as the ethical issues that are related to this field.
For information, the vulnerabilities addressed will be: buffer overflow, integer overflow, format string, data race. Among the protection we will study the technique of the non-executable stack or even that of the "canary". For malware analysis, we will focus on MIRAI and the YARA tool.
Aims
At the end of this learning unit, the student is able to : | |
| 1 | Given the learning outcomes of the "Master in Computer Science and Engineering" program, this course contributes to the development, acquisition and evaluation of the following learning outcomes:
Given the learning outcomes of the "Master [120] in Computer Science" program, this course contributes to the development, acquisition and evaluation of the following learning outcomes:
Students completing successfully this course will be able to
Students will have developed skills and operational methodology. In particular, they have developed their ability to
|
The contribution of this Teaching Unit to the development and command of the skills and learning outcomes of the programme(s) can be accessed at the end of this sheet, in the section entitled “Programmes/courses offering this Teaching Unit”.
Content
The current attractive way to perform authentication with token is to use the RFID technology. Several billion RFID devices are sold every year and no one engineer should ignore this technology, its nice features, but its security flaws as well. To illustrate the course, we will see how to break an access card, a biometric passport, how to steal a car while being 20'000 km far from it, etc.
From this technology, the course will describe and extend the main points one should take care when designing a secure application.
Develop from scratch a secured solution.
From this technology, the course will describe and extend the main points one should take care when designing a secure application.
Develop from scratch a secured solution.
- How to read a standard.
- Implement cryptographic tools.
- Consider the solution as a whole.
- ...
- Everyday life applications based on RFID.
- Several billions computing devices around us.
- Computer science is no longer only PCs interconnected.
- ...
Teaching methods
Lectures introduce the theoretical and practical background needed to build a secure token-based applcation.
Evaluation methods
On first session:
- an exam for 60% of the final mark
- two works for 40% of the final grade
Other information
INGI2347 vs INGI2144
- INGI2347 is an introduction to network security and IT applications.
- INGI2144 is an advanced course on application security.
Online resources
https://moodleucl.uclouvain.be/enrol/index.php?id=12241
Bibliography
Support obligatoire: copie des diapositives disponible sur le site icampus.
Faculty or entity
INFO
