Cybersecurity Engineering

Students are expected to acquire: • knowledge of the mathematical foundations, e.g. modular arithmetic, needed to understand the cryptographic algorithms as explained in official standards such as NIST SP-Recommendations or FIPS. • knowledge of symmetric cryptography primitives like Block Ciphers, Stream Ciphers, and Hash Functions; • knowledge of the asymmetric cryptosystems used, for instance, for exchanging keys or building Public Key Cryptography; • knowledge of the main protocols used in different fields like Commitments, (Blind) Digital Signatures, SRP, and SAE; • knowledge of the main programming libraries for implementing cryptography algorithms both in C and Python; • abilities to discern the correct cryptographic algorithms to use, depending on the field of application; • abilities to discover flaws in basic cryptographic protocols and when the cryptographic primitives are misused; • knowledge about the main classes of attacks against the presented cryptographic algorithm;

This is the first course in Cryptography. It is about the state-of-the-art principal cryptographic algorithms currently used for computer system security purposes. This course is an essential element in building the competencies of a cybersecurity expert, as the technological solutions in cybersecurity strongly rely on the use of cryptography. Indeed, superficial knowledge of the cryptographic primitives can lead to decisions and designs resulting in a weak level of protection and a higher exposition to cyber-attacks.

Basics of Cryptography and Cryptanalysis: • Kerckhoff's principle. • Computationally infeasibility or feasible. Brute Force • Concept of crypto primitives. • Attacks models : COA, KPA, CPA, CCA . • Indistinguishability goals IND . • Confidentiality, Authentication, Integrity and Nonrepudiation. Cryptographic programming: • use of cryptographic primitives in C; • use of cryptographic primitives in Python; Use of Linux GPG (GNU Privacy Guard) commands. Basics of Modular Arithmetic and Elliptic curves. • Calculations in rings of remainders modulo n . The (mod n) notation. • Calculations in Galois fields modulo a polynomial G. • Algorithm to compute the inverse: Euclidean extended and Kuttaka. • Chinese Remainder Theorem (CRT). Euler's Totient function. • Equations of first and second order (mod n). Quadratic residues. Euler's criterion. • Finite and cyclic groups, generators and order. Lagrange's theorem. Fermat's little theorem. • Discrete logarithm problem. • Elliptic curves: definition and construction of the addition law. Symmetric Cryptography: • Block-Ciphers: Feistel and SP-networks. DES, AES; • Operations Modes: ECB, CBC, CTR, OFB, CFB, GCM, CCM; • Stream-Ciphers and PRNG: o ARX algorithms: RC4, Salsa, and Chacha20. o Permutation algorithm: Keccak Sponge PRNG • Hash Functions: o Merkle-Damgård construction. o ARX: SHA1, SHA2 o Permutation based: Keccak Sponge, SHA3 o Birthday's paradox • Message Authentication Codes (MAC). Length extensions attack and HMAC. Asymmetric Cryptography: • DH Key Exchange on finite fields. • DH on elliptic curves. • RSA. Rabin. ElGamal. Hybrid Encryption, KEM/DEM Paradigm. • Protocols: Commitments, (Blind) Digital Signatures, SAE, and SRP.

Modalita di esame: Test informatizzato in laboratorio;
Exam: Computer lab-based test;
... Exam: A 60-minute written test held in class via PC, using the POLITO platform. A sample/demo of the written test will be available on the course’s Moodle platform (moodle.polito.it). During the written test, students may not consult books, notes, or any other learning materials. The written test is considered passed if the score is equal to or higher than 18/30. The exam results will be published on the teaching portal, along with the date when students can review their work and request clarifications.

Serious Cryptography: A Practical Introduction to Modern Encryption Jean-Philippe Aumasson, No Starch Press, 2018. Understanding Cryptography, A Textbook for Students and Practitioners Paar, Christof, Pelzl, Jan, Springer-Verlag, 2010. Applied Cryptography: Protocols, Algorithms and Source Code in C Bruce Schneier, Wiley; 20th Anniversary edition,2015.

Students will acquire knowledge, varying in depth depending on the specific topic, as well as skills and a profound comprehension of the mechanisms and motivations underlying the following technologies and solutions: - Concept of an embedded system. - Understanding of the development tools for embedded systems: cross-compiler, emulator, debug tools, profiling tools, and virtualization tools. - Concept of real-time embedded systems. - Understanding of examples of operating systems for embedded systems. - Skill for developing modules for communication with ad-hoc hardware components. - Understanding security issues in the embedded domain.

The course combines traditional classroom lectures with supervised exercise sessions, providing students with the opportunity to apply the concepts learned in practical scenarios and engage in discussions with the instructor. Additionally, certain topics within the course include dedicated lab sessions, allowing students to observe the practical implementation of related technologies and reinforce their understanding of the concepts covered in the lectures. The course is divided into two main components: classroom lectures and exercises, which account for 6 CFU (Crediti Formativi Universitari), and laboratory sessions, which contribute 2 CFU. Additionally, students will have the opportunity to be tutored for a total of 2 CFU.

Introduction to Embedded Systems (0.5 CFU) - Classification with respect to desktop systems. - Memory technology device. Development tools (0.5 CFU) - Cross-compiler. - Emulator. - Debugger. - Profiler. - Virtual platforms. Operating Systems for Embedded Systems (3 CFU) - Real-time and process scheduling. - Analysis of the architecture and services offered by operating systems for embedded: process scheduler, micriumOS, OSEK/VDX, Embedded Linux. - Anatomy of an operating system for embedded systems. Operating System Security (1 CFU) - HW/SW attack models - Countermeasures Programming of an embedded OS (2 CFU): - I/O management and device drivers. - Use of an evaluation board. - Building an OS for embedded systems: how to use development tools. - Design and development of device drivers for custom devices. Advanced tools for debugging and profiling embedded systems (1 CFU)

Modalita di esame: Elaborato progettuale in gruppo; Prova scritta in aula tramite PC con l'utilizzo della piattaforma di ateneo;
Exam: Group project; Computer-based written test in class using POLITO platform;
... The examination consists of the following two components: PART 1.1: This part consists of a written test covering all class topics. The test may include various question types, such as open-ended and multiple-choice questions, exercises focusing on specific topics, and the development of small programs. Each question is assigned a score, which is announced during the exam. The exam is delivered on a computer. The maximum score achievable in this part is 18/30, and the test duration is 60 minutes. The threshold to pass this part is 10/30. PART 1.2 (required for students who do not opt for the group project): This part consists of programming exercises on the topics covered during the course. The exam is delivered on a computer and requires the use of the open-source development tools explained in class. The maximum score achievable in this part is 12/30, and the test duration is 60 minutes. PROJECT — optional and substituting PART 1.2 The project emphasizes the application of concepts learned in class and enhances students’ ability to independently find documentation and acquire new skills beyond the scope of the course. Each year, a set of topics will be assigned. Projects MUST be carried out in teams. Once the project is completed, students must present it during an oral exam session, highlighting each team member’s contribution to the results. The oral exam consists of a 20-minute presentation, during which all team members must participate and contribute to the work presented. The presentation will be followed by questions about the developed work, aimed at assessing the contributions of all team members to the project. Finally, a live demo of the developed project will be possible whenever applicable. The project aims to assess: - The student’s proficiency in implementing and developing embedded applications. - The efficiency of the implementation. - The student’s ability to work effectively in a team. - The student’s presentation skills. - The individual contribution of each student to the project. The maximum score in this part is 14/30. The final grade is determined as follows: OPTION 1: exam without project Final grade = PART 1.1 + PART 1.2 OPTION 2: exam with project Final grade = PART 1.1 + PROJECT The highest distinction, “Laude,� is awarded if the total grade equals 32. PART 1.1 and PART 1.2 must be completed in the same attempt, while the project can be discussed at a different time. However, the project must be completed within one year, before the start of the next course edition. The project is assigned during the first academic year in which the student attends the course and cannot be attempted again in subsequent years. If the project is not delivered on time, the student must retake the entire exam under OPTION 1. Any minor changes to these policies or procedures will be communicated to the students in a timely manner.

Notes provided by the teacher. Additional reading: A. Berger Embedded Systems Design: An Introduction to Processes, Tools, and Techniques CMP Books, 2001, ISBN-10: 1-57-820073-3 Silbershatz A., Galvin. P., Gagne G. Operating Systems 8th Edition, Wiley, 2009, ISBN: 978-0-470-12872-5

Hardware & Wireless Security (Hardware and embedded security)Having completed the course, the participant will: - Get familiar with the basic concepts of hardware security, and in particular: - System Security - Secure Environments - Hardware and Hardware-based Security - For each field, get familiar with its main: - Vulnerabilities - Attacks - Countermeasures Hardware & Wireless Security (Wireless and device-to-device communication Security)- Knowledge of the wireless communication - Knowledge of specific wireless technologies, including cellular, WiFi, Bluetooth, NFC, IoT-specific solutions and navigation systems. - Knowledge of security challenges in wireless transmission systems - Knowledge of the leading solution and countermeasures to detect and limit possible attacks - Gain hands-on experience in vulnerability analysis and secure system, service, or protocol design.

Hardware & Wireless Security (Hardware and embedded security)The course is taught in English and aims to present the most significant aspects of Hardware Security, covering both intellectual property protection and the threads to the functionality of the systems, including their most common weakness, vulnerabilities, attacks, and possible mitigations and remediations. The course mixes lectures and hands-on experiences. The course includes a final exam in which students can face theoretical and practical questions related to hardware security. Hardware & Wireless Security (Wireless and device-to-device communication Security)The course, taught in English in the second semester of the second year of the Master of Science in Cybersecurity, is one of the characterizing courses of all the tracks. It aims at presenting the technologies for wireless communications and the security challenges they create for the cyber security of IT systems. This course focuses on the challenges in providing secure communication and network services in various wireless systems and approaches to managing these challenges. Topic coverage includes both the technology overview of different wireless communications systems and vulnerabilities, attacks, security mechanisms, and trade-offs at various layers of the protocol stack, from aspects of physical communication to application and service security issues; examples include jamming, MAC-layer misbehaviour, selective packet dropping, and cross-layer holistic attacks. The course introduces wireless technologies, including cellular, WiFi, Bluetooth, NFC, IoT-specific technologies and navigation systems. The students will learn about the various wireless system architectures and the security challenges one must consider and face to offer a reliable and secure communication system. The students will gain hands-on experience using tools and practical lab experiences.

Hardware & Wireless Security (Hardware and embedded security)- Introduction to Hardware Security [3h] - Basics of VLSI Design and IP [4h] - IP Security [10h] - Watermarking of HW IPs - Basics of PCB Security - Hardware-based security: [3h] - Introduction & Basic concepts - Implementations - Hardware Trust [6h] - Introduction & Basic Concepts - Hardware Counterfeiting - True Random Number Generators (TRNG) - Physically Unclonable Functions (PUF) - HW Attacks [10h] - Side-Channel Attacks - Fault Attacks - Test-infrastructure-based Attacks - Invasive Attacks - Hardware Trojans Hardware & Wireless Security (Wireless and device-to-device communication Security)1) Security at the physical layer (1.5 CFU) - Review of basic concepts for digital communications: Wireless Communication Overview, Wireless Channel, Signal Propagation, Digital Modulations - Physical layer security issues: jamming, anti-jamming/Jamming-resistance - Global Navigation Satellite Systems (GNSS) and positioning: Operating principles, signals and main systems (GPS and Galileo); Intentional and unintentional interference with GNSS signals, jamming, spoofing and countermeasures 2) Security of Cellular Networks (1 CFU) - 3G/4G/5G Network Structure and Architectures - Authentication and Confidentiality in cellular networks - Overview of Attacks and Countermeasures. 3) Security in WiFi Networks (1.5 CFU) - IEEE 802.11 Architecture and Protocols, Control and Management Frames - Security in WiFi: Rogue Access Points, WEP, WPA, IEEE 802.11i, IEEE 802.11w, Selfish behaviour at the WLAN MAC Layer. - Lab on WiFi security 4) Bluetooth security (1 CFU) - Overview of Bluetooth wireless technology, Bluetooth pairing, authentication, confidentiality, Low energy features - Bluetooth Vulnerabilities, Threats, and Countermeasures: bluesnarfing, bluejacking, DoS, MiTM - Lab on Bluetooth security 5) Security of Near Field Communications (NFCs) and RFIDs (1 CFU) - Introduction to NFC and RFID Technologies, Tags and Readers - NFC and RFID Security and Privacy Issues, Real-World Attacks, Standardisation Activities, Authentication and Access Control Protocols.

Hardware & Wireless Security (Hardware and embedded security)Modalita di esame: Prova scritta in aula tramite PC con l'utilizzo della piattaforma di ateneo; Hardware & Wireless Security (Wireless and device-to-device communication Security)Modalita di esame: Prova orale facoltativa; Elaborato scritto prodotto in gruppo; Prova scritta in aula tramite PC con l'utilizzo della piattaforma di ateneo;
Hardware & Wireless Security (Hardware and embedded security)Exam: Computer-based written test in class using POLITO platform; Hardware & Wireless Security (Wireless and device-to-device communication Security)Exam: Optional oral exam; Group essay; Computer-based written test in class using POLITO platform;
... Hardware & Wireless Security (Hardware and embedded security)The course exam will consist of questions and short exercises.Hardware & Wireless Security (Wireless and device-to-device communication Security)The exam consists of a written test that may include open-answer and closed-answer questions or exercises to check that the student has acquired the expected knowledge and skills (see expected learning outcomes). For the part about skills, the questions may be simple exercises or use cases related to the tools experimented with in the laboratories. For each question, the maximum grade that can be obtained is specified. The final grade will be the sum of the grades assigned to the answers given to the questions. The written test will be taken using the Exams platform in a classroom. In case of technical problems, the students may be asked to write their test with pencil and paper. The total duration of the test, as measured by the Exams platform, which includes the setup time, is 1 hour and 40 minutes. The test is closed-book, i.e., the student cannot consult any material during the test and cannot use any electronic device except the PC used for the test. Students with a grade of 25/30 or higher can opt for the oral exam. During the oral, the students will discuss all topics presented during the course. The grade of the oral exam may add a score between -3 and +3 to the grade of the written exam. Additionally, the teachers will request an oral exam in case of doubts about the evaluation of the written test. The oral exam will consist of additional questions to resolve the teachers' doubts in the evaluation. A sample exam test will be made available to the students through the Exercise platform.

Hardware & Wireless Security (Hardware and embedded security)- Copies of the teaching materials used for both the lectures and the Labs.Hardware & Wireless Security (Wireless and device-to-device communication Security)The teachers will provide the material (slides and links to online resources) on the course website.

Knowledge of the main categories of attack against IT systems. Knowledge and critical evaluation of the main concepts (encryption and digest) and technologies (PKI, firewall, VPN, TLS, S/MIME, e-documents) for IT security. Knowledge and critical evaluation of the security architectures for authentication and access control and the ability to tailor them to the protection of IT systems. Ability to analyse the risks of a network application and design solutions for their protection.

This course deals with security issues in modern networked computer systems, paying special attention to data security and protection of computer networks and networked computer applications in a closed (Intranet) or open (Internet) environment. The course aims to teach the skills needed to perform both the analysis and the high-level design of the security features of IT components and systems.

(1 CFU) Computer systems (in)security: problems and attacks (sniffing, spoofing, DOS, …), risk analysis. (1 CFU) Cybersecurity risk management: approach, methods, and standards (e.g., NIST Risk Management Framework). (1 CFU) Basic protection techniques: steganography, cryptography, digest, X.509 certificates, certification authorities (CA) and public-key infrastructures (PKI). (1 CFU) Authentication techniques (password, challenges, Kerberos) and related hardware devices (token and smart card). (1 CFU) Network security: standard to protect IP networks and configuration and management protocols; firewall and IDS to create protected subnets; virtual private networks (VPN). (1 CFU) Application security: e-mail protection (PGP, S/MIME), web security (SSL, TLS) and remote access protection (SSH, TLS), securing web applications.

Modalita di esame: Prova scritta (in aula);
Exam: Written test;
... Written test (90 minutes) with up to 10 open- or closed-answer questions about the analysis and design of security solutions. The written test is a "closed book" one.

Handouts of the instructor's foils and manuals for laboratory coursework. All learning material is available at the teaching portal. An auxiliary textbook, covering many but not all topics, is: - W. Stallings, 'Cryptography and Network Security - principles and practice', Prentice-Hall

Networks & Cloud Technologies and Security (Computer networks and cloud technologies)Students will build up knowledge (at a different level of depth depending on the specific topic), skills and a deep understanding of mechanisms and motivations underlying the following technologies and solutions: - Fundamental concepts of computer network design: IPv4 network design, Virtual local area network design, Routing and Forwarding solutions - Advanced topics about computer network solutions: IPv6 network design, MPLS protocol architecture, Protocols and techniques for quality of service on IP networks - Next-generation computer networks paradigm: Software Defined Networking (SDN) and Network Functions Virtualization (NFV). - Computing virtualization technologies and cloud computing models (public/private/hybrid, IaaS/PaaS/SaaS) Networks & Cloud Technologies and Security (Network and Cloud Security)Students will build up knowledge (at a different level of depth based on the topic), skills and a deep understanding of mechanisms and motivations underlying the following technologies and solutions: - Different protection mechanisms against attacks in traditional network systems and protocols; - Design common filtering solutions; - Traffic analysis to discover security problems; - Virtual Private Network and channel protection mechanisms and technologies; - Security topics in cloud computing services; - Security issues in next-generation computer networks.

Networks & Cloud Technologies and Security (Computer networks and cloud technologies)The course, taught in English in the first semester of the first year of the Master of Science in Cybersecurity, is the first module of the annual course "Networks & Cloud Technologies and Security", mandatory for all tracks. The course delves into the design principles of essential technologies underlying modern computer networks and cloud technologies, providing a good understanding of fundamental and advanced topics related to the working of the Internet, Networking Systems, and Cloud Computing solutions. Networks & Cloud Technologies and Security (Network and Cloud Security)The course, taught in English in the second semester of the first year of the Master of Science in Cybersecurity, is the second module of the annual course "Networks & Cloud Technologies and Security", mandatory for all tracks. The course delves into the essential approaches, methodologies, and technologies related to the security of traditional and modern computer networks and cloud environments.

Networks & Cloud Technologies and Security (Computer networks and cloud technologies)- IPv4 network design (0.6 CFU), Routing on the Internet (0.6 CFU), LAN and VLAN design (0.3 CFU) - IPv6 protocol, coexistence with IPv4, and IPv6 network design (1CFU) - MPLS (0.9 CFU), Techniques for quality of service (QoS) support (0.2 CFU), Optical networks (0.2 CFU) - Computing virtualization technologies (0,2 CFU) - Software Defined Networking and Network Programmability and Network Functions Virtualization (0.3 CFU) - Cloud computing models and technologies (1,3 CFU) Networks & Cloud Technologies and Security (Network and Cloud Security)- Network Security Fundamentals (0.3 CFU) - Network defenses and filtering solutions: (1.5CFU) - Virtual Private Network (IPsec VPN, TLS VPN) and channel protection Technologies (1.5CFU) - Cloud Computer Security (1.5 CFU) - Security issues to Software Defined Networking and Network Functions Virtualization (0,3 CFU)

Networks & Cloud Technologies and Security (Computer networks and cloud technologies)Modalita di esame: Test informatizzato in laboratorio; Prova orale facoltativa; Networks & Cloud Technologies and Security (Network and Cloud Security)Modalita di esame: Prova scritta (in aula); Prova orale facoltativa;
Networks & Cloud Technologies and Security (Computer networks and cloud technologies)Exam: Computer lab-based test; Optional oral exam; Networks & Cloud Technologies and Security (Network and Cloud Security)Exam: Written test; Optional oral exam;
... Networks & Cloud Technologies and Security (Computer networks and cloud technologies)The exam consists of 32 multiple-choice questions to ensure the student has acquired the expected knowledge (see expected learning outcomes). For the part about skills, the questions may be related to the tools experimented with in the laboratories. The written Test will be taken using the Exams platform in a classroom. In case of technical problems, the students may be asked to write their Test with pencil and paper. The Test is closed-book, i.e., the student cannot consult any material during the Test and cannot use any electronic device except for the PC used for the Test. The maximum grade of the Test is 32/32, and the total duration, as measured by the Exams platform, which includes the setup time, is 1 hour and 10 minutes. The following evaluation criteria will be applied: correct answer: 1 point, wrong answer: -0.33 points, no answer provided: 0 points. A mark on the written Test larger than or equal to 25/32 will give the student the right to take an integrative (and elective) oral test. The mark can also be increased by the evaluation of extra activities organized in the context of the Master’s Degree course. The final mark of the annual course "Networks & Cloud Technologies and Security" will be the average of the grade obtained for this module (“Computer networks and cloud technologies�) and the grade obtained in the other module (“Networks & Cloud Security�). If the average final mark is 32, the student gets 30L. A sample exam test will be made available to the students through the Exercise platform. Networks & Cloud Technologies and Security (Network and Cloud Security)The exam consists of a written test that may include open-answer and closed-answer questions or exercises to check that the student has acquired the expected knowledge (see expected learning outcomes). For the part about skills, the questions may be simple exercises or use cases related to the tools experimented with in the laboratories. The written Test will be taken using the Exams platform in a classroom. In case of technical problems, the students may be asked to write their Test with pencil and paper. The Test is closed-book, i.e., the student cannot consult any material during the Test or use any electronic device except for the PC used for the Test. The maximum grade of the Test is 30/32, and the total duration, as measured by the Exams platform, which includes the setup time, is 1 hour and 30 minutes. A mark on the written Test greater than or equal to 25/32 will give you the right to take an integrative (and elective) oral test. The oral Test allows the student to obtain the 30L (i.e., 32/32). The mark can also be increased by evaluating extra activities organized in the context of the Master’s Degree course. Alternatively, the student can develop individual homework about one of the course's topics, delivering a written report followed by an oral presentation. The report and the oral presentation are evaluated up to 30L (i.e., 32/32). The final mark of the annual course "Networks & Cloud Technologies and Security" will be the average of the grade obtained for this module (“Networks & Cloud Security�) and the grade obtained in the other module (“Computer networks and cloud technologies�). If the average final mark is 32, the student gets 30L. A sample exam test will be made available to the students through the Exercise platform.

Networks & Cloud Technologies and Security (Computer networks and cloud technologies)The teachers will provide the material (copy of slides and links to online resources) on the course website.Networks & Cloud Technologies and Security (Network and Cloud Security)The teachers will provide the material (copy of slides and links to online resources) on the course website. Assessment and grading criteria for the ONSITE exam

• Knowledge of the main aspects of HTML, CSS, modern JavaScript - Ability to use a JavaScript at an advanced level for creating web applications at the front-end layer. - Basic knowledge of a framework for creating web applications in JavaScript - Ability to create complete web applications, also in the “single page application� modality, by using a simple back-end API server. - Knowledge of the security risks in the development of browser-based web applications and the ability to enforce and implement best practices to mitigate such issues. - Understanding of the main issues regarding, robustness, interoperability, and performance of the studied applications.

The course, taught in English in the second semester of the first year of the Master of Science in Cybersecurity, aims at presenting the main techniques for creating distributed web applications, focusing in particular on the front-end programming, using the JavaScript language and a client-side programming framework. The main programming paradigms useful for the needs of the front-end of a modern web application will be considered, both by analyzing their impact in term of native JavaScript code, and by studying the approaches provided by a dominant framework. The topics presentation will enable the student to gain the basic skill to manage the main design choices within the mentioned topics, with additional attention to security aspects of web applications.

• Recall of web architectures, HTML5, CSS. - Complex layouts, CSS frameworks. Notions of web design. - JavaScript as a language. Variables and objects. Execution in the browser and in nodejs. - Handling forms and tables. DOM. Events. Callbacks. Closures. - Web servers and ExpressJS. Package managers and related security issues. - JSON. HTTP API. Asynchronous programming (async/await, Promise, Fetch). - Single Page Applications. Reactive programming. Introduction to ReactJS. - React applications. Components. JSX. - Identification, authentication and API authorization mechanisms. Tokens, signatures, server-side validation. - Architecture of a complex application. Event routing. State management. - Web related security issues and best practices. - Deployment and publication of applications. - Application examples.

E' possibile sostenere l?esame in anticipo rispetto all?acquisizione della frequenza

The teacher will provide the material (copy of slides and links to on-line resources) on the website of the course. Many useful resources are also freely available on the web (https://developer.mozilla.org, https://reactjs.org/, https://javascript.info/, etc). Some suggested textbooks for personal in-depth study: - M. Haverbeke, Eloquent Javascript (https://eloquentjavascript.net/) - A. Accomazzo, A. Lerner, N. Murray, C. Allsopp, D. Guttman, T. McGinnis, Fullstack React, 2019

• Knowledge of the main machine learning and deep learning algorithms used to support cybersecurity applications and analyses. • Ability to design and implement data science pipelines to apply data-driven analyses in the cybersecurity domain. • Knowledge of the state-of-the-art in AI for cybersecurity

Automatic or semiautomatic data analysis by means of Machine Learning and Deep Learning algorithms plays an increasing role in cybersecurity. This course then introduces both the AI fundamentals and their applications to the cybersecurity field. The first part of the course introduces the main deep machine learning algorithms and their foundations. During the second part of the course, the students will learn how to design and apply AI-based pipelines to address real use case problems in the cybersecurity fields, such as traffic classification, DDoS detection, and anomaly detection. The course uses a hands-on approach where students will face practical sessions on cybersecurity use cases.

Lectures (39 hours) • Introduction to machine learning algorithms for cybersecurity (3 hours) • Fundamentals of deep learning (6 hours) • Deep learning networks (10 hours) - Feedforward networks - Convolutional Neural Networks - Recurrent-Neural Networks - LSTM ◦ Introduction to deep NLP and embeddings creation techniques (6 hours) ◦ Anomaly detection (10 hours) - Supervised anomaly detection - Unsupervised anomaly detection • Use cases (6 hours) Laboratory activities (21 hours) • Development of data science-/AI-based pipelines for data analytics in the cybersecurity domain (21 hours) - Introduction to deep learning frameworks (3 hours) - Supervised traffic classification (6 hours) - Unsupervised anomaly detection (e.g., DDoS detection) (6 hours) - NLP and clustering for botnet detection (6 hours)

Modalita di esame: Prova orale facoltativa; Elaborato scritto prodotto in gruppo; Prova scritta in aula tramite PC con l'utilizzo della piattaforma di ateneo;
Exam: Optional oral exam; Group essay; Computer-based written test in class using POLITO platform;
... The exam includes two mandatory parts. The two mandatory parts are (i) a written test and (ii) the evaluation of a group report on the practices assigned during the course. PART I - WRITTEN TEST The written test may include open-answer and closed-answer questions or exercises to check that the student has acquired the expected knowledge and skills (see expected learning outcomes). For the part about skills, the questions may be simple exercises or use cases related to the tools experimented with in the laboratories. For each question, the maximum grade that can be obtained is specified. The final grade will be the sum of the grades assigned to the answers given to the questions. The written test will be taken using the Exams platform in a classroom. In case of technical problems, the students may be asked to write their test with pencil and paper. The total duration of the test, as measured by the Exams platform, which includes the setup time, is 1 hour and 40 minutes. The test is closed-book, i.e., the student cannot consult any material during the test and cannot use any electronic device except the PC used for the test. PART II - GROUP REPORT The second part of the exam consists in preparing a group report on the practices assigned during the course and developed in laboratories. The report aims to evaluate the student's ability to implement data analytics processes for analysing the data. The report's evaluation is based on the clarity of the report and the technical correctness and efficiency of the proposed and implemented solutions. The maximum grade for the individual report is 31. FINAL GRADE The exam is passed if (i) the grade of the written test is greater than or equal to 18 points and (ii) the grade of the individual report is greater than or equal to 18 points. The final grade is a weighted average between the evaluations of the written exam (70%) and the group report (30%). Specifically, the final grade is given by the weighted average: grade of the written test*0.7 + grade of the group report*0.3. If the final grade exceeds 30, then "30 e lode" will be recorded. OPTIONAL ORAL EXAM The student with a weighted grade of 25/30 or higher can take the oral exam. During the oral, the students will discuss all topics presented during the course, including the lab parts. The oral exam grade will consist of a score between -3 and +3 points to be added to the weighted grade of the written exam and report. Additionally, the teachers will request an oral exam in case of doubts about the evaluation of the written test or the report. The oral exam will consist of additional questions to resolve the teachers' doubts about the evaluation. A sample exam test will be made available to the students through the Exercise platform.

Copies of the slides used during the lectures, examples of written exams and exercises, and manuals for the activities in the laboratory will be made available. All teaching material is downloadable from the course website or the Portal.

At the end of the course, the students: - will have knowledge about and be able to perform critical evaluation of public key infrastructures and digital signature techniques. - will have knowledge about and be able to perform a critical evaluation of advanced solutions for data and communication protection. - will have knowledge about and be able to perform a critical evaluation of advanced aspects of authentication. - will be able to analyse the risks of a network application and design a solution for its protection.

This course deals with advanced protection techniques for modern networked computer systems. The course aims to teach the skills needed to perform both a detailed technical analysis of the security features of IT components and systems and to design solutions to protect them.

(1.5 CFU) Public-key certificates and PKI: features, benefits, and threats, secure electronic documents; (1 CFU) Secure network channels (TLS, SSH): features, risks, and their management. (1 CFU) Advanced authentication: passkeys and federated authentication architectures (SAML and OIDC for distributed authentication and authorisation) (1.5 CFU) Software security: pitfalls and design principles; trusted computing (TC), Trusted Execution Environment (TEE), and Confidential Computing. (0.5 CFU) Cybersecurity obligations: privacy (GDPR) and infrastructure protection (NIS2). (0.5 CFU) Quantum computing threats and post-quantum security. (2 CFU) The Self-Sovereign Identity (SSI) model and its components: Decentralized IDentitifier (DID), Verifiable Credential (VC), and the Verifiable Presentation (VP). The underlying Triangle of Trust: Issuer vs Holder vs Verifier of the credential. The presentation of the credential and its validation and verification for authentication and authorization purposes in different target systems.

Modalita di esame: Prova scritta (in aula);
Exam: Written test;
... Written test (90 minutes) with up to 10 open- or closed-answer questions to demonstrate the ability to analyse and design security solutions, including the knowledge acquired in the laboratory exercises. For closed questions, there is no penalty for a missing answer, while there is a penalty for a wrong answer. The written test is a "closed-book" one with a maximum grade of 30/30. Optional groupwork will be proposed, which will give up to 4 additional points over the result of the written test. This work must be presented before the end of the lectures.

Handouts of the instructor's foils and manuals for laboratory coursework. The teachers will also provide and link additional material (parts from textbooks and links to online resources) on the course website. All learning stuff is available at the teaching portal. An auxiliary textbook, covering many but not all the topics, is: - W. Stallings, 'Cryptography and Network Security - principles and practice', Prentice-Hall

Students will acquire the following: 1. Ability to define in precise mathematical terms what is a "secure" cryptographic scheme. 2. Knowledge of advanced topics in cryptography, such as zero-knowledge proofs of knowledge and secure multiparty computation.

The course aims to: 1. revisit fundamental topics of cryptography in a more precise mathematical framework (e.g., security assumptions, security proofs, computational security); and 2. introduce advanced cryptography topics (e.g., zero-knowledge proofs of knowledge, secure multiparty computation, digital signature).

Computational security in private-key and public-key cryptography (e.g., security assumptions, proofs by reductions, oracles). Zero-knowledge proofs of knowledge. Secret sharing. Secure multiparty computation. Construction of digital signatures (e.g., the Fiat-Shamir transform, the random oracle model).

Modalita di esame: Prova scritta (in aula); Prova orale facoltativa;
Exam: Written test; Optional oral exam;
... The final exam is written. An oral exam is optional upon request by the student or at the teacher's discretion. Students cannot consult books, notes, or other teaching materials during the written exam. The written exam is considered passed if its result is greater than or equal to 18/30. Only students who have passed the written exam can ask to take the oral exam. The oral exam contributes to determining the final grade of the exam and the written one. In particular, depending on the student's performance, the oral exam can either raise or lower the grade achieved in writing.

The lecturer will provide the reading material. A recommended book is "Katz & Lindell, Introduction to Modern Cryptography."

Students will acquire - knowledge of the legal requirements and safeguards characterizing the field of digital forensics and cybercrime - knowledge of the legal principles and language - ability to interact in the corporate and public sector environment, as well as in a multidisciplinary context. Moreover, from a technical point of view, they will acquire - Knowledge of the general concepts, best practices and standards for computer forensics; - Knowledge of different domains in which computer forensics can be applied (e.g., network forensics, mobile forensics); - Knowledge of the main phases of computer forensics to soundly acquire and preserve digital evidence; - Ability to apply the learned techniques with some of the commonly available tools.

The course, taught in English in the first semester of the second year of the Master of Science in Cybersecurity, is one of the courses characterizing Cyber Analyst and Cyber Designer tracks and is optional for the other tracks. Nowadays, computer forensics is pervasive, as these techniques are commonly used in criminal investigations, civil litigation and corporate investigations, as well as incident response, compliance, and privacy. Hence, the learning objectives are twofold. On the one hand, this course aims to provide a general overview of the legal issues relating to Cybercrime and Digital Forensics. The first part of the course aims to present the relevant legal framework and the best international digital forensics practices. From cyber warfare to the corporate context, cybercriminals increasingly use a deep connection with traditional organized crime. The course will focus primarily on the operational methods by which these organizations carry out their offenses and the investigative techniques used nationally and internationally to combat and investigate the phenomenon of cybercrime. On the other hand, it aims to provide the needed technical background to understand and perform investigative techniques and to gather, analyze, understand and preserve evidence found on computers and other digital devices. The second part of the course will provide an in-depth analysis of real-world scenarios to help students understand the practical applications of digital forensics and cybercrime investigations. Students will learn how to identify and collect evidence, analyze data, and make informed conclusions based on their findings. The course is designed to provide hands-on experience with real-world situations, helping students develop critical thinking and problem-solving skills.

Part I – Cybercrime and fundamental of digital forensics (4CFU) - Digital forensics and cybercrime definitions - Most relevant cybercrimes - Cybercrime and case studies: from cyberwarfare to corporate crimes - Best practices of Digital Forensics (Hash, bit stream copy and hush functions - Future trends of cybercrime and digital forensics: generative AI and IoT Part II – Computer forensics practice General concepts and practice for computer forensics (1CFU) - Definition and classification of computer forensics domains - Definition and classification of the main phases of computer forensics (e.g., acquisition, analysis) - Definition of the best practices for computer forensics analysis - Computer forensics standards Technical aspects of computer forensics (2CFU) - Definition and analysis of file system forensics (e.g., files recovery, metadata) - Definition and analysis of the memory forensics - Definition and analysis of the mobile forensics - Definition and analysis of the cloud forensics - Anti-forensic techniques Computer forensics tools (1CFU) - Application of the studied techniques using common tools (e.g., autopsy, common autopsy plug-ins) on selected use cases.

Modalita di esame: Prova orale facoltativa; Prova scritta in aula tramite PC con l'utilizzo della piattaforma di ateneo;
Exam: Optional oral exam; Computer-based written test in class using POLITO platform;
... Computer-based written test in class using POLITO platform; Optional oral exam; The written test will be taken using the Exams platform in a classroom. In case of technical problems, the students may be asked to write their test with pencil and paper. The test aims to evaluate the student's understanding of the topics discussed during the course and how much students apply the acquired notions to various cases. The test consists of a written test that may include open-answer and closed-answer questions or exercises to check that the student has acquired the expected learning outcomes both from the technical and legal parts. For the part about skills, the questions may be simple exercises or use cases related to the tools experimented with in the laboratories or analysis of legal use cases. The duration of the test is 1 hour and 30 minutes. Each question will specify the maximum grade that can be obtained. The final grade will be the sum of the grades assigned to the answers given to the questions. The test is closed-book, i.e. the student cannot consult any material during the test and cannot use any electronic device except the PC used for the test. The teachers will request an oral exam only in case of doubts about the evaluation of the written test. The oral exam will consist of additional questions to resolve the teachers' doubts about the evaluation. A sample exam test will be made available to the students through the Exercise platform. Homework: Optionally, the exam can be complemented by homework agreed upon with the teacher. This homework will focus on a specific topic among the presented course theory and practice, resulting in a report and an oral presentation. Report and presentation grades, whose maximum obtainable will be specified on a homework-specific basis, will be added to the written exam for the final grade.

• Vaciago Giuseppe, «Digital Forensics, Giappichelli, 2012, https://www.giappichelli.it/digital-forensics-e-book-9788834828052 - A.Yaacou Jean-Paul, N.Noura Hassan Salman Ola, Chehabc Ali, «Advanced digital forensics and anti-digital forensics for IoT systems: Techniques, limitations and recommendations» Internet of Things, Volume 19, August 2022, 100544, Elsevier, https://www.sciencedirect.com/science/article/abs/pii/S2542660522000464 Moreover, the teachers will provide the material (copies of slides and links to online resources) on the course website.

Students will acquire knowledge of the legal requirements and safeguards characterizing the field of cybersecurity. They will have knowledge of the legal principles and language, which will give them the ability to facilitate their interaction in the corporate and public sector environment, as well as in a multidisciplinary context.

The main aim of this course is to provide a general overview of the legal issues relating to cybersecurity and data security. Given the global dimension of data flows and their economic and strategic value, the legal framework will be considered at different levels, namely international, EU and national. The first part of the course focuses on data regulation as the legal protection provided to personal and non-personal data is at the root of cybersecurity laws that aim to safeguard these intangible assets. Moreover, some key data protection regulations, such as the GDPR, already include specific data security and cybersecurity requirements. In line with the transnational dimension of cybersecurity, attention will also be paid to international conventions and frameworks (Convention 108 and 108+ of the Council of Europe, OECD Guidelines). Specific environments, such as IoT and cloud computing, will be considered when dealing with data and cybersecurity issues. Finally, the recent development of AI regulation in Europe and the risk-based approach adopted by legislators will be discussed concerning the requirements that increase the level of data and system security. The second part of the course aims to provide case studies and practical examples in the field of information security. Special attention will be given to the Cybercrime Convention, GDPR-Data Breach, NIS2, Cybersecurity Act, and EU bodies (ENISA, CERT, etc.). The Cybercrime Convention, also known as the Council of Europe Convention on Cybercrime, was signed on November 23, 2001. It is the first international convention to address Internet and computer crime by harmonizing national laws, improving investigative techniques, and increasing cooperation among nations. The General Data Protection Regulation (GDPR), the Network and Information Systems Directive (NIS2), and the Cybersecurity Act are essential pieces of legislation aimed at protecting personal data and ensuring the security of information systems. Together, these pieces of legislation play a crucial role in promoting and protecting the security of personal data information in the digital age. Each of the individual pieces of EU legislation mentioned above will be addressed by highlighting the most relevant aspects and focusing on the practical effects in the cybersecurity world. Through case studies, the student will gain detailed knowledge of the real issues that need to be addressed to manage cybersecurity risks.

Part I - Data and Privacy - The international framework: Council of Europe and OECD - The GDPR and legal compliance - Sector-specific applications and Regulation 2018/1807 on non-personal data - AI regulation and risk-based approach Part II – Cybersecurity and Cybercrime - Cybercrime Convention (Budapest, November 23 2001) - Data Breach and GDPR: 3 leading cases - Nis Directive 2 and Cybersecurity Act - The role of EU bodies (ENISA, CERT) and the most important case studies

Modalita di esame: Prova scritta (in aula); Prova scritta in aula tramite PC con l'utilizzo della piattaforma di ateneo;
Exam: Written test; Computer-based written test in class using POLITO platform;
... Assessment and grading criteria for the ONSITE exam. The final exam aims to evaluate the student's understanding of the topics discussed during the course and how much students apply the acquired notions to various cases. The exam is written and is 45 minutes in duration. It is divided into two sections, one focused on case analysis and one on the general legal framework (open-question).

• Hoofnagle, Chris Jay, Bart van der Sloot, e Frederik Zuiderveen Borgesius. «The European Union general data protection regulation: what it is and what it means». Information & Communications Technology Law 28, fasc. 1 (2 gennaio 2019): 65–98. https://doi.org/10.1080/13600834.2019.1573501 (open access) - Mantelero Alessandro, Giuseppe Vaciago, Maria Samantha Esposito, e Nicole Monte. «The common EU approach to personal data and cybersecurity regulation». 2020, 28(4) International Journal of Law and Information Technology 297–328 https://doi.org/10.1093/ijlit/eaaa021 (open access) - Papakonstantinou Vagelis, «Cybersecurity as praxis and as a state: The EU law path towards acknowledgement of a new right to cybersecurity? », Computer Law & Security Review, Volume 44, April 2022, 105653 https://www.sciencedirect.com/science/article/pii/S0267364922000012

• Knowledge of the concepts, practices, and standards for engineering data protection - Knowledge of the technologies and methodologies for anonymization and pseudonymization - Knowledge of the main threats and protection strategies to online privacy - Ability to apply the learned techniques on anonymization and pseudonymization - Ability to operate and configure the Identity and Access Management - Ability to apply the learned techniques on protection strategies to online privacy

The course, taught in English in the second semester of the second year of the Master of Science in Cybersecurity, is one of the characterizing courses of the Cyber Designer and Cyber Officer tracks. The evolution of technology has brought forward new techniques to share, process and store data. This evolution has generated new models of data (including personal data) processing but has also introduced new threats and challenges. This course presents the leading techniques and methodologies for data protection and anonymization to assure user and data confidentiality and privacy. The students will learn data protection engineering with the practical implementation of technical aspects of data protection.

• Overview of Data Protection and Information Privacy Governance and Management (1.25 CFU) • Data protection by design to data protection engineering • Privacy Threat Taxonomy and Model • Data and Privacy Risk Management - Technical Security Controls on Information Systems (0.75 CFU) • System Access Concepts • Access Control Policies Policy • Identity and Access Management - Privacy Enhancing Technologies in Information Systems (2 CFU) • Anonymization and Pseudonymization • Re-Identification Attacks • Privacy-preserving data storage and publishing • Synthetic Data generation techniques - Privacy Enhancing Technologies in Online Ecosystem (2 CFU) • Web Application Privacy • Tracking • Cloud Privacy • IoT Privacy

E' possibile sostenere l?esame in anticipo rispetto all?acquisizione della frequenza

The teachers will provide the material (copy of slides and links to online resources) on the course website.

In the binary exploitation area, students will acquire: - knowledge and details about memory management; - abilities to attack software binary applications; - knowledge of OS-level protections (e.g., DEP, ASLR, stack canaries); - abilities to circumvent OS-level protections. In the web exploitation area, students will acquire: - Knowledge about technical and logical vulnerabilities in web applications; - abilities to mount different types of attacks from and beyond the OWASP Top 10. Moreover, students will develop the ability to analyse the security properties of components and whole information systems, identify weaknesses and vulnerabilities, and use them to exploit them.

This course introduces students to offensive security techniques. After presenting the fundamental concepts, the weaknesses, and vulnerabilities, students will focus on practical attacks in two of the most critical cybersecurity areas: binary exploitation and web exploitation. For defensive cybersecurity experts, like Cyber Designers and Cyber Analysts, this course allows students to understand attacks and counter them properly. Moreover, the knowledge and abilities obtained from this course are fundamental to building the competence needed for starting a career as a penetration tester.

Memory management (1CFU) - Review of the basics on memory management in Linux applications (stack, functions) and OS-level mitigations (stack canaries, ASLR, DEP) - Dynamic memory, GOT and PLT - Heap in Linux and some heap-level mitigations, use of the heap in Windows (sketch) Binary exploitation (2CFUs) - Code reuse attacks (gadgets, ROP, ret2libc) - Heap exploitation attacks - Bypassing stack canaries and ASLR Web exploitation (3CFUs) - Injection attacks (command injection, basic and advanced SQL injections) - Path traversal attacks - Bypassing authentication and authorization: insecure object references, session authentication attacks (JWT), … - Other OWASP Top 10 attacks (XSS, XXE, …)

E' possibile sostenere l?esame in anticipo rispetto all?acquisizione della frequenza

Slides of the lessons and exercises; Lab exercises texts and some hints and solutions; links to online resources (writeups, exploitation examples); Video recordings of the classes; Some books cover part of the course topics; their use is not encouraged. - Dafydd Stuttard and Marcus Pinto, "The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws 2nd Edition", Wiley, ISBN: 978-1118026472 - Jon Erickson, "Hacking: The Art of Exploitation", No Starch Press, (Old but still a quite good introduction)

Students are expected to acquire the following: • Knowledge about the basis of quantum computing and the use of online simulators of quantum computers for implementing some quantum algorithms (e.g., Grover and Shor algorithms) • Knowledge of the main post-quantum cryptosystems (e.g., NTRU, McEliece, Oil and Vinegar) • Knowledge of the mathematical problems which guarantee the security of post-quantum cryptosystems (e.g., shortest vector problem, syndrome decoding problem, learning with errors) • Knowledge of the NIST selected candidates (e.g., Crystals-Kyber, Falcon, Bike) • Ability to discern the security of cryptosystems against quantum cryptanalysis

Quantum computers are a significant threat to public key cryptography, whose security relies on some problems that are not computationally tractable. The course provides a complete overview of the so-called post-quantum cryptosystems, which can be implemented on classical devices but resist cryptanalysis performed with quantum computers.

• Introduction to quantum computing • Code-based cryptography • Lattice-based cryptography • Multivariate cryptography • Hash-based cryptography • Isogeny-based cryptography • Post-quantum signatures • Protocols standardized by NIST

Modalita di esame: Prova scritta (in aula); Prova orale facoltativa;
Exam: Written test; Optional oral exam;
... The final exam is written. An oral exam is optional, upon request by the student or at the teacher's discretion. Students cannot consult books, notes, or other teaching materials during the written exam. The written exam is considered passed if its result is greater than or equal to 18/30. Only students who have passed the written exam can ask to take the oral exam. The oral exam contributes to determining the final grade of the exam and the written one. In particular, depending on the student's performance, the oral exam can either raise or lower the grade achieved in writing.

The lecturer will provide the reading material. A recommended book is “Daniel J. Bernstein, Johannes Buchmann, Erik Dahmen: Post-Quantum Cryptography�.

• Knowledge of the general concepts, practices and standards for security assessment of IT systems - Knowledge of software security and code security - Knowledge of the main techniques for security verification of IT systems and secure coding - Knowledge of the main techniques for vulnerability assessment and penetration testing - Ability to apply the learned techniques with some commonly available tools.

The course, taught in English in the first semester of the second year of the Master of Science in Cybersecurity, is one of the characterizing courses of the Cyber Analyst and Cyber Designer tracks and optional for the other tracks. It aims at presenting the main techniques for assessing the cyber security of IT systems, including software code security, with particular emphasis on distributed systems. The students are expected to gain knowledge of such techniques and the ability to apply them by using some of the available tools for verification and testing.

General concepts and practice for security assessment (1CFU) - Definition and classification of security assessment techniques (e.g., static vs dynamic, white box vs black box, vulnerability assessment, penetration testing, formal verification, ethical hacking) - Security assessment and certification standards. Security Verification (2CFU) - formal verification techniques and tools (dataflow and control flow static code analysis, model checking, theorem proving) - formal verification of security protocols and security-aware distributed applications Software and Code Security Verification and Testing (3CFU) - software security and principal code vulnerabilities - static and dynamic code analysis for security verification and vulnerability assessment (taint analysis, symbolic and concolic execution, dynamic analysis). Vulnerability Assessment and Penetration Testing (VAPT) (2CFU) - information gathering and scanning techniques and tools with various scopes (host, net DB, service) - penetration testing techniques and tools: attack techniques, exploits, password cracking, decompilers.

Modalita di esame: Prova orale facoltativa; Prova scritta in aula tramite PC con l'utilizzo della piattaforma di ateneo;
Exam: Optional oral exam; Computer-based written test in class using POLITO platform;
... The exam consists of a written test that may include open-answer and closed-answer questions or exercises to check that the student has acquired the expected knowledge and skills (see expected learning outcomes). For the part about skills, the questions may be simple exercises or use cases related to the tools experimented with in the laboratories. For each question, the maximum grade that can be obtained is specified. The final grade will be the sum of the grades assigned to the answers given to the questions. The written test will be taken using the Exams platform in a classroom. In case of technical problems, the students may be asked to write their test with pencil and paper. The total duration of the test, as measured by the Exams platform, which includes the setup time, is 1 hour and 10 minutes. The test is closed-book, i.e. the student cannot consult any material during the test and cannot use any electronic device except the PC used for the test. The teachers will request an oral exam only in case of doubts about the evaluation of the written test. The oral exam will consist of additional questions to resolve the teachers' doubts about the evaluation. A sample exam test will be made available to the students through the Exercise platform.

The teachers will provide the material (copy of slides and links to online resources) on the course website.

At the end of the course, students will have developed foundational competence in - analyzing and managing business decisions related to technology and innovation management in cybersecurity, recognizing it as a key enabler of business development at both strategic and operational levels; - explaining the theoretical foundations of technology & innovation management in cybersecurity, including risk society framing and socio technical systems; - identifying and describe the main sociological and communicative factors that influence cybersecurity decisions and organizational resilience; - integrating technical, managerial, sociological, and communicative analyses to evaluate cybersecurity scenarios and formulate evidence based solutions; - collaborating in multidisciplinary teams, presenting clear, data driven arguments and recommendations.

Emerging digital technologies are playing a major role in improving business efficiency. Organizations collect, store, and manage vast amounts of data from the installed base of physical products and from users accessing their services. As a result, they must contend with the security risks and threats that digital technologies inevitably bring. Digitalization has created new opportunities for cyber threat actors to exploit emerging vulnerabilities. New cybersecurity solutions are increasingly based on system architectures with a high degree of modularity and are characterized by rapid technological advancement and a constantly evolving market. This technological turbulence leads to the continuous entry of new players and the emergence of disruptive shifts in the technology landscape. These dynamics pose significant challenges for decision-making processes regarding technology adoption. At the same time, the evolving nature of cyber threats demands constant adaptation from organizations. The impacts span technical, legal, organizational, communication, and ethical domains, with real-world consequences for businesses, governments, and society. As a result, digitalization has transformed cybersecurity from a traditional risk management tool into a strategic component of business decision-making and innovation. Businesses are now leveraging cybersecurity not just for protection, but as a source of competitive advantage—shifting from a mindset focused solely on risk mitigation to one centered on business continuity and strategic growth. By integrating cybersecurity into their strategic planning, organizations are increasingly using it as a key enabler of innovation and business development, aligning cybersecurity strategies with broader organizational goals. Based on this vision, and in line with the evolutionary perspective in the theory of the firm, the course aims to provide students with an academically grounded and managerially oriented understanding of the processes and dynamics related to technology management, strategic management, and innovation in the field of cybersecurity. The first module of the course will focus on the core concepts underlying these internal and external processes and dynamics. Particular emphasis will be put on integrating technological and business perspectives in understanding innovation and its dynamics at the industry level as well as learning dynamics at the organizational level. Different approaches to innovation strategy will be discussed considering both large established firms and new entrepreneurial ventures. The second module will provide an in-depth examination of the socio technical dimensions of cybersecurity – spanning risk society framing, technoscientific controversies, , cyber risks literacy, and communication in the realm of stakeholder engagement. A particular emphasis will be put on how sociological and communicative factors (e.g.,. tacit norms and role based power dynamics, internal communication processes and styles, continuous training) shape decision making processes concerning the adoption of emerging cybersecurity technologies and/or the development of innovative in house solutions. Lectures will be complemented by case studies that will let students applying knowledge to real-life contexts. These activities will help students connect theoretical concepts to real-world management and entrepreneurial practices. Students will be required to carry out a group-based project work aiming at examining practical cases and outlining the economic and socio-communicative relevance of cybersecurity technological solutions.

The course will comprise both theoretical and practical lessons in English and will be composed of two main modules: Module I –Technology and Innovation Management - Fundamentals of the theory of the firm - Fundamentals of the economics of innovation: the linear model of innovation, the actors involved in the innovation process, technological trajectories and paradigms, taxonomies of innovation and their impact on industries - Dynamics of innovation: technology cycles, dominant designs and standards - Fundamentals of strategy and the determinants of competitive advantage - Entrepreneurial and managerial innovation models - Decision making in cybersecurity (Make or buy & business cases) - Profiting from innovation - Open and collaborative innovation: practices and paradoxes - Barriers to innovation - IP management, diffusion of innovation and appropriation strategies - Creativity management Module II – CyberRisk SocioLab: Creative Communication for a Proactive Cyber Risk Culture - Risk society & socio technical framing of cyber risk: interactive lecture; key topics: systemic vs individual risk, public perceptions, trust and social legitimacy, latent socio-communicaiton factors in cybersecurity. - Technoscience controversies & epistemic authority: debate & role play; key topics: tacit norms, roles, power; open vs proprietary security. - Interpersonal communication, persuasion and social engineering: phishing role play and micro analysis; key topics: Palo Alto axioms, Cialdini’s principles, knowledge deficit model and alternatives. - Leadership communication & cyber risk literacy: mini workshop and self assessment; key topics: leadership cultures and the semiotic informational model, training practices.

Modalita di esame: Elaborato progettuale in gruppo; Prova scritta in aula tramite PC con l'utilizzo della piattaforma di ateneo;
Exam: Group project; Computer-based written test in class using POLITO platform;
... Written test (90 minutes, max 20 points) - ONSITE The written test will be held using students’ personal computers and Respondus Lockdown Browser. The test will be designed to assess the following objectives a)evaluate the degree to which students have learned and understood theoretical concepts ;b) evaluate the degree to which students are able to apply to real-life cases; c) evaluate the degree to which students are able to take informed management decisions based on knowledge acquired during the course. The written test will be based on a mixture of closed questions, open questions and/or a short commentary to a text. The written test will lead to a maximum score of 20/30. For the closed questions (2pt each) penalties will be applied for incorrect answers (-0.5pt) while no penalties will be applied to unanswered questions. The use of any study or reference teaching materials (i.e., books, slides, students’ notes) during the test is not permitted. Group project work (max 10 points) - ONSITE The group-based project work allow to evaluate the degree to which students are able to apply theoretical concepts in practice. The group project work, to be conducted onsite during the teaching semester, will lead to a maximum score of 10/30, based on the assessment criteria highlighted in the section above.

Cantamessa, M., Montagna, F. 2016 Management of Innovation and Product Development Springer Schilling, M. 2022 Strategic Management of Technological Innovation McGrawHill Piccoli, G., Pigni F. 2019. Information systems for managers with cases. 4.0 Edition. Wiley Selected chapters from the textbooks, readings and other teaching materials will be uploaded during the course

La tesi di Laurea Magistrale rappresenta una verifica complessiva della padronanza di contenuti tecnici e delle capacità di organizzazione, di comunicazione, e di lavoro individuali, relativamente allo sviluppo di analisi o di progetti complessi. Le attività previste nella prova finale richiedono normalmente l'applicazione di quanto appreso in più insegnamenti, l'integrazione con elementi aggiuntivi e la capacità di proporre spunti innovativi.

L'argomento e le attività relative alla prova finale sono concordati con un docente del Politecnico (relatore di Tesi). Le attività possono essere condotte anche presso altri enti o aziende, in Italia o all'estero, sotto la supervisione di un docente relatore del Politecnico e di un tutore dell'ente esterno.

Modalita di esame: Prova orale obbligatoria;
Exam: Compulsory oral exam;
... Le attività relative alla preparazione della Tesi di Laurea e i relativi risultati devono essere presentati e discussi pubblicamente, in presenza di una commissione di docenti che esprime una valutazione del lavoro svolto e della presentazione. La commissione preposta alla prova finale esprime i propri giudizi tenendo conto dell'intero percorso di studi dello studente, valutandone la maturità culturale e la capacità di elaborazione intellettuale personale, nonché la qualità del lavoro. La determinazione del voto finale è assegnata alla commissione di laurea che prenderà in esame la media complessiva degli esami su base 110. A tale media la commissione potrà sommare, di norma, sino ad un massimo di 8 punti prendendo in considerazione: • la valutazione del lavoro svolto per la tesi (impegno, autonomia, rigore metodologico, rilevanza dei risultati raggiunti etc.); • la presentazione della tesi (chiarezza espositiva etc.); • l'eccellenza del percorso di studi (ad esempio, il numero delle lodi conseguite, il tempo impiegato per terminare gli studi etc.). La lode potrà essere assegnata al raggiungimento del punteggio complessivo 112,51 a discrezione della commissione. Se la tesi ha le caratteristiche necessarie, può essere concessa la dignità di stampa soltanto qualora il voto finale sia centodieci e lode e il parere della commissione sia unanime.

La tesi di Laurea Magistrale rappresenta una verifica complessiva della padronanza di contenuti tecnici e delle capacità di organizzazione, di comunicazione, e di lavoro individuali, relativamente allo sviluppo di analisi o di progetti complessi. Le attività previste nella prova finale richiedono normalmente l'applicazione di quanto appreso in più insegnamenti, l'integrazione con elementi aggiuntivi e la capacità di proporre spunti innovativi.

L'argomento e le attività relative alla prova finale sono concordati con un docente del Politecnico (relatore di Tesi). Le attività possono essere condotte anche presso altri enti o aziende, in Italia o all'estero, sotto la supervisione di un docente relatore del Politecnico e di un tutore dell'ente esterno.

Modalita di esame: Prova orale obbligatoria; Exam: Compulsory oral exam; ... Le attività relative alla preparazione della Tesi di Laurea e i relativi risultati devono essere presentati e discussi pubblicamente, in presenza di una commissione di docenti che esprime una valutazione del lavoro svolto e della presentazione. La commissione preposta alla prova finale esprime i propri giudizi tenendo conto dell'intero percorso di studi dello studente, valutandone la maturità culturale e la capacità di elaborazione intellettuale personale, nonché la qualità del lavoro. La determinazione del voto finale è assegnata alla commissione di laurea che prenderà in esame la media complessiva degli esami su base 110. A tale media la commissione potrà sommare, di norma, sino ad un massimo di 8 punti prendendo in considerazione: • la valutazione del lavoro svolto per la tesi (impegno, autonomia, rigore metodologico, rilevanza dei risultati raggiunti etc.); • la presentazione della tesi (chiarezza espositiva etc.); • l'eccellenza del percorso di studi (ad esempio, il numero delle lodi conseguite, il tempo impiegato per terminare gli studi etc.). La lode potrà essere assegnata al raggiungimento del punteggio complessivo 112,51 a discrezione della commissione. Se la tesi ha le caratteristiche necessarie, può essere concessa la dignità di stampa soltanto qualora il voto finale sia centodieci e lode e il parere della commissione sia unanime.

Students will develop knowledge, skills, and a comprehensive understanding of the strategies and methodologies underpinning the following areas, with varying levels of depth depending on the topic: • Understanding of key concepts in security governance and how it differs from security management. • Familiarity with methodologies for identifying assets, vulnerabilities, threats, and appropriate security controls. • Awareness of the main risk treatment options and their implications. • Comprehension of the cybersecurity learning continuum and its role in continuous professional development. • Ability to apply various threat modeling and analysis techniques in practical scenarios. • Competence in conducting both qualitative and quantitative risk assessments. • Proficiency in implementing best practices for incident management. • Capability to design a security plan and define a coherent and effective security policy.

This course, delivered in English during the second semester of the second year of the Master’s Degree in Cybersecurity, is a mandatory course of the Cyber Analyst track. It explores key approaches, methodologies, and technologies related to intelligence, as well as best practices and strategies for effective incident management. The knowledge gained provides a critical foundation in cybersecurity governance and management, forming an essential part of any cybersecurity expert's professional and cultural toolkit.

• Fundamentals of Security Governance and Management 0.9 CFU • Threat Modelling and Intelligence 1.5 CFU • Information Risk Assessment 1.5 CFU • Human Resources Security 0.3 CFU • Security Incident Response and Business Continuity 1.5 CFU • Security Auditing 0.3CFU

Modalita di esame: Prova scritta (in aula); Elaborato progettuale in gruppo;
Exam: Written test; Group project;
... The exam consists of i) the realization of a group project and ii) a written test. Both exam parts are mandatory. For what concerns the project, each group of students is expected to carry out a full-fledged study/activity related to relevant use cases for the course topics (e.g., creating a threat model, or investigating incident response techniques in certain thematic areas). The group composition will be defined partially by the students and partially by the teachers, in order to allow for group heterogeneity. At the end, each group will have to deliver a report and give an oral presentation on the results and findings of their activity. In case of adequately documented needs, the group project may be replaced by an individual project. The maximum grade that can be assigned to the project is 16/32. For what concerns the written test, it may include closed-answer questions, open-answer questions, or exercises to check that the student has acquired the expected knowledge and skills on the topics addressed during the course (i.e., Fundamentals of Security Governance and Management, Threat Modelling and Intelligence, Information Risk Assessment, Human Resources Security, Security Incident Response and Business Continuity, Security Auditing). For the part about skills, the questions may be related to the tools experimented with in the laboratories (i.e., some questions on the topics covered in the laboratory activities may be asked). The test is closed book, i.e., the student cannot consult any material during the test or use any electronic device. Moreover, the test duration is 1 hour. The maximum grade that can be assigned to the written test is 16/32. The final grade is the sum of the grades assigned to the group project and the written test results. If this sum is greater than or equal to 18, it can also be increased by evaluating extra activities. A sample exam test will be available to the students.

The teachers will provide the material (copy of slides and links to online resources) on the course website.