Engineering in Computer Science and Artificial Intelligence

LEONARDO QUERZONI
RICCARDO LAZZERETTI

General Objectives

1. Provide a comprehensive vision of cybersecurity, understood as a technical and cultural discipline, essential in contemporary digital society.
2. Train aware professionals, capable of critically evaluating the security of systems, applications and IT infrastructures, even in real and complex contexts.
3. Cultivate a security-oriented design mindset, raising awareness of the need to integrate protection, privacy, authenticity and resilience from the early stages of technology development.
4. Promote autonomy in study and research, providing conceptual and methodological tools to explore advanced or emerging topics in the field of cybersecurity.

Specific objectives

1. Understand the fundamentals of cybersecurity, with particular attention to:
• Symmetric and asymmetric encryption
• Message integrity and authentication
• Digital signatures and their standards ( PAdES , CAdES , XAdES , JAdES )

2. Study real security protocols and systems, including:
• HTTPS, IPsec, TLS/SSL, SSH
• Authentication via password, biometrics, Kerberos, X.509 certificates
• E-mail security
• Methodologies and techniques for network security

3. Analyze threats and attack models, developing:
• Ability to identify vulnerabilities
• Understanding of attack and defense techniques
• Identify common attack patterns to web applications

4. Learn more about the use of secure random number generators, which are essential to cryptography and protocols.

5. Apply theory to practice, through:
• Homework and exercises
• Projects and theses (for interested students)

6. Develop critical thinking about the security of modern digital technologies.

- Knowledge and understanding
At the end of the course, the student will have acquired a solid knowledge of the fundamental principles of computer security, with particular reference to theoretical models and practical tools to guarantee confidentiality, integrity, authentication and availability of information. In particular, you will be able to:
• understand the functioning and limitations of the main cryptographic algorithms, both symmetric and asymmetric;
• recognize and evaluate security threats in communication systems and network protocols;
• analyze the authentication mechanisms, identity management and digital signatures, also in light of the relevant international standards;
• understand security architectures at different levels of the protocol stack , including HTTPS, TLS, IPsec , SSH, and Kerberos.

Understanding will be supported by both real-world examples and application activities and critical discussions, in order to foster a systemic and up-to-date vision of the topic.

- Applying knowledge and understanding:
The student will be able to effectively apply the concepts and tools acquired to analyze, design and evaluate security solutions in the IT field. In particular, you will be able to:
• identify vulnerabilities in communication protocols and computer systems;
• select and implement cryptographic techniques appropriate to specific application contexts;
• configure and evaluate authentication protocols, identity management systems and public key infrastructures (PKI);
• analyze real attack and defense scenarios, formulating security mitigation and improvement strategies;
• understand and use standards and tools for digital signature and data protection in transit and at storage.

Application skills will be developed through hands-on exercises, case study analysis, and guided discussions on known vulnerabilities and incidents.

- Making judgements:
At the end of the course, the student will have developed the ability to critically analyze cybersecurity problems, independently evaluating possible solutions in light of technical, regulatory and ethical constraints. In particular, you will be able to:
• reflect on the implications of adopting (or failing to adopt) security measures in digital systems;
• compare security approaches and technologies, evaluating their effectiveness, scalability and sustainability;
• make reasoned judgments on secure system designs and architectures, taking into account real and multidisciplinary contexts;
• recognize the limitations of existing technologies and the need for continuous updating in a rapidly evolving sector.

The course stimulates critical thinking through case study analysis, discussions of real incidents, and reflections on ethics and responsibility in designing safe systems.

- Communication skills:
The student will acquire the ability to communicate clearly, precisely and appropriately contents, problems and solutions related to cyber security, both to specialist and non-specialist interlocutors. In particular, you will be able to:
• describe and motivate the adoption of security technologies and protocols with accurate technical language;
• explain cybersecurity risks, countermeasures and implications in an understandable way, even to non-technical stakeholders (e.g. in corporate, legal or institutional settings);
• actively participate in critical discussions on cases of attack and defense, including in collaborative or interdisciplinary contexts;
• write short technical reports and clear documentation on configurations, analyses and laboratory results.

The course fosters these skills through oral exercises, group discussions, writing papers and interaction with popular and scientific materials.

- Learning skills:
At the end of the course, the student will have developed solid autonomous and continuous learning skills, essential for updating in a field, such as cybersecurity, in constant technological and regulatory evolution. In particular, you will be able to:
• find and critically understand technical documentation, scientific articles and international standards on cybersecurity;
• independently explore advanced or emerging topics (e.g. new vulnerabilities, post-quantum protocols, privacy regulations);
• apply flexible study strategies to address the heterogeneity of sources (manuals, specifications, white papers, codes of conduct);
• approach research or development projects in safety with method and a critical spirit, even in an academic or professional context.

The course encourages independent learning through open-ended assignments, suggested readings, access to online resources, and a problem-solving approach.

By the end of the course, the student will be able to:
1. Understand the fundamental principles of information security (confidentiality, integrity, authentication, etc.)
2. Identify and compare the main cryptographic tools (symmetric and asymmetric encryption, hash functions, digital signatures)
3. Analyze and evaluate security protocols, identifying potential vulnerabilities
4. Understand how Public Key Infrastructures (PKI) work, including key and certificate management
5. Reason formally about protocol security using models such as Dolev–Yao
6. Discuss the implications of security in real-world and complex scenarios (e.g., attacks, privacy, CSPRNGs, secret sharing)
7. Understand the implications of application level security

Internetworking, TCP/IP, discrete mathematics and group theory, routing

Information security
Symmetric encryption
Data integrity
Public key encryption
Digital signatures and PKI
CSPRNG (Cryptographically Secure Pseudo-Random Number Generators)
Authentication
Secret sharing
Access control
Secure protocols (tls, ipsec, ssh)
Firewalls
Network segmentation
Network monitoring
Email security
DNSSEC e BGP security
DoS attacks and countermeasures
Application security

Slides distributed via Classroom (see website https://sites.google.com/diag.uniroma1.it/cybersecurity/)
Network Security: Private Communication in a Public World, by Charlie Kaufman, Radia Perlman, Mike Speciner, Pearson Education (US), 2022

Interactive lectures in the classroom. Exercises on personal laptops.

Although not mandatory, classroom attendance is strongly recommended.

Written exam is mandatory. An optional oral test is available afterward, but only for students who passed the written exam.
Optional: submitting homeworks during the year.

https://drive.google.com/file/d/11Qor5Y-irvn0v4c97DDnqXqFScEvozcS/view?usp=sharing (non ricordo nulla)