Security of Information and Organizations 2022/2023

Important Items

• T1: November 25th, 16.30

• T2 and E1: January 18th, 10h

• ES and PS: February 2nd, 10h

• EE and PE: September

• Project 1 - November 16th, 23:59

• Project 2 - January 6th, 23:59

Most laboratory guides will require a specific Virtual Machine available here. The file is compressed. The username and password are user. It runs best in VirtualBox added as a disk.

Planning

According to the UA academic schedule, classes will be lectured from September 19th, until January 6th. The subject is composed by a 2 hours of theoretical lectures, 2 hours of practical laboratories, and 1 hour of tutoring hours (optional).

Theoretical classes will present key concepts related to the application of security to modern information systems, and organizations. The practical classes will be focused in the exploration of security mechanisms, and in the exploration and analysis of common security attacks.

The topics lectured in each class should be as follows. Changes may happen, so please check it frequently.

Rules

Faculty and Lectures

This edition will be lectured by professors João Paulo Barraca, André Zúquete, Paulo Bartolomeu and Alfredo Matos. Teaching staff will be available by email and Microsot Teams, especially during the allocated tutoring slots. The use of the Microsoft Teams platform for direct communication is highly recommended. Official course information will be available in this page, or through the Elearning platform.

Classes will be lectured in the Portuguese language, unless there is a foreign student attending. In this case English will be used. All lecture notes will be made available in both Portuguese and English. Laboratory guides will be provided in English.

Prospecting students should be aware that this subject require some basic knowledge of several topics in the areas of networking, programmimg and operating systems, such as: the Python/C/Java languages, Linux administration and Linux console usage (mostly Debian), virtual machines, sockets, HTTP and HTML, asynchronous applications, hardware architectures.

Attendance

Students can choose to attend the theoretical classes, and is highly recommended they do so every week as it correlates with a good outcome. Attendance to practical classes is mandatory and faults will be recorded.

According to the University rules, students must be present at (at least) 70% of the practical classes. For this edition that results in a maximum of 3 unjustified faults. If a student exceeds the number of faults allowed, he will automatically fail the subject and won’t be allowed at any other evaluation during the current academic year.

Grading

Grading will be composed by two components. Both are mandatory and have a minimum threshold.

1. Theoretical Component: Relates to the contents lectured during all classes, mostly focusing on the theoretical lectures.

   • Option 1: 1 (One) intermediate test (T1), and 1 (One) final test (T2), each contributing with 5 points to the component.
     • Each test will cover half of the contents lectured.
     • Students may access the intermediate test without actually returning it for grading.
     • Returning the intermediate test indicates that the student will follow Option 1.
   • Option 2: 1 (One) exam (E1) that covers all contents lectured, and contributing with 10 points to the component.
     • This option is available for students that do not return the intermediate test (T1).
   • Dates:
     • Intermediate Test (T1): November 25th, including questions that address all contents until Public Key Infrastructures (PKI) (including), but not SmartCards.
     • Final Test (T2): addressing all contents since Smartcards (including).
     • Final Exam (E1): addressing all contents lectured (T1 + T2).
   • Final Theoretical Grade: (T1 + T2) or (E1)
   • Minimum points of this component: 3.5 pts (0-10)
     • i.e. $ T1 + T2 >= 3.5 \text{ or } E1 >= 3.5$

2. Practical Component:

   • Development of practical projects by a group of 4 students. Exceptionally, 3 students may be allowed after explicit authorization by the professors.
     • assignments may be awarded a maximum bonus +10% due to the addition of added innovation.
     • In the practical projects, each student will have a pool of 96 hours to allocate as required. This pool can be used to return assignments after the deadline without any penalty. After the pool is exausted, a standard penalty of 0.1 points per hour applies up to 2 days. After the 2 days (48h), the assignment will not be accepted.
   • Minimum points of this component: 3.5
     • i.e. $practical >= 3.5$

The following table summarizes the points of each component:

Supplementary season

The supplementary season takes place from January 26th until February 8th. It is available for all students that failed to obtain at least 9.50 points during the normal season, or 3.5 and one of the components. The remaining students may also access this season, but the University requires an additional administrative process. Grading will be composed by two components, each contributing with 10 points to the final grade.

1. Theoretical Component : Optional exam (ES)

   • Theoretical exam covering all contents lectured, with focus on the contents lectured in the theoretical lectures.
   • The final grade will be the maximum between the points obtained in this exam, and the points obtained in the previous exam.

2. Practical Component: Optional practical project (PS)

   • Development of a practical project by one ~or two~ up to four students. Update: This will consist on your previous projects, which you can resubmit with improvements.
   • The final grade will be the maximum between the points obtained in this project, and the points obtained in the previous assignments.

Special season

The special season usually takes place in September and is available to students in specific cases. Accessing this season will require an additional administrative process.

Grading will be composed by two components, each contributing with 10 points to the final grade. It follows the same rules used in the Supplementary season.

Students that wish to access this season should contact the faculty staff as soon as possible (e.g July).

Additional Content

Software

• AirCrackNG: A complete suite of tools to assess WiFi network security.
• Bettercap: The Swiss Army knife for WiFi, Bluetooth Low Energy, wireless HID hijacking and Ethernet networks reconnaissance and MITM attacks.
• Wireshark: The most popular packet sniffer application.
• WebGoat: A deliberately insecure web application maintained by OWASP designed to teach web application security lessons.
• Kali Linux: A popular Penetration Testing Distribution.
• John the Ripper: A password Cracker.
• Hashcat: Advanced Password Recovery tool, especially tailored at OpenCL.
• nmap: Probably the most famous port scanner and recognaissance tool.
• Pwnagotchi: Deep Reinforcement Learning for Wifi Pwning.

Websites

• TryHackMe: Beginner friendly website for cybersecurity training.
• GameOfHacks: Identify common programming errors that lead to security issues.
• Let’s Encrypt: A free, automated and open Certification Authority.
• Bruce Schneier Blog: A very interesting blog dedicate to security and cryptography.
• SANS Technology Institute: Best Security Books
• Reddit NetSec and NetSecStudents
• Reddit NetSec Books Galore
• Hacking Secret Ciphers With Python
• CVE Details

Books

• Segurança em Redes Informáticas
• Security in Computing, Fourth Edition
• Handbook of Applied Cryptography
• Security Engineering - The Book
• Understanding Cryptography
• Everyday Cryptography: Fundamental Principles and Applications

Misc Resources

These are not directly related to the course syllabus, but somewhat belong to the culture of cibersecurity.

• Cryptonomicon
• The Cuckoos Egg
• The Hacker Playbook 2: Practical Guide To Penetration Testing
• Smashing The Stack For Fun And Profit
• The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography (Paperback)
• Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker