t.BA.WV.SWS2-EN.19HS (Software and System Security 2) 
Module: Software and System Security 2
This information was generated on: 24 April 2024
No.
t.BA.WV.SWS2-EN.19HS
Title
Software and System Security 2
Organised by
T InIT
Credits
4

Description

Version: 2.0 start 01 February 2021
 

Short description

 In SWS2, students acquire knowledge and skills that are central to securing information systems. The main topics of the course are information security management systems, penetration testing, exploitation, malware, security monitoring and the security of mobile applications.

Module coordinator

 tebe

Learning objectives (competencies)
Objectives Competences Taxonomy levels
You know and understand modern techniques and methods to attack and defend IT infrastructures including their strengths and weaknesses.       F K2
You know the basic procedure of a penetration test and can carry out key elements of such a test on your own.   D, M K2, K3
You can implement methods and techniques for monitoring networks and systems in a lab setting and you can assess their fittness for detecting a compromise of the monitored system.      D, M K3, K4
You know important security concepts of mobile platforms and common mistakes made when developing aplications for them. You can apply this know-how to improve the security of your own moblie applications. D, M K2, K3
You know about awareness measures that can help to address the human risk factor and you can judge their effectiveness. F K2, K6

Module contents

 "It's not that you've just breached, you just realized it yet". This statement may be exaggerated. However, it is probably correct in terms of targets that are "interesting" to hackers.
 
Vulnerable (software) products are one of the reason why hackers manage to hack their targets again and again. This is why our other module, SWS1, focuses on methods, tools and procedures that help with developing secure software. However, experience shows that this can hardly be done in perfection. In addition, a system's security can be thwartet by other things like an insecure configuration or intentional or unintentional misconduct by humans. For this reason, further measures are needed to make information systems as secure as possible. This includes, in particular, regular assessments of their security and the implementation of additional security controls such as security monitoring.
 
In this module, you acquire knowledge and skills that are central to securing and verifying the security of information systems.
The module starts with an introduction to information security management systems (ISMS) and the threat landscape (actors, motives, trends, sources of information, ...) to give you a holistic view on the problem of "securing an information system".
Then you learn (almost) everything about penetration testing (process, techniques, tools, ...). We start with the first customer contact, then proceed to collecting information (OSINT) before we land on finding and exploiting vulnerabilities and completing the job. As the phase of finding and exploiting web application vulnerabilities is already discussed in SWS1, we focus on methods and tools for any application and system. In particular, this includes the advanced exploitation technique of Return Oriented Programming (ROP).
Next, we teach you more about malware, anti-malware systems and systems for monitoring the security of complex IT infrastructures (SIEM systems) so that you can assess their strengths and weaknesses and outline the key challenges for a successful use. You will also learn how the security of mobile platforms (Android, iOS) differs from "normal" systems and what to look out for when developing and testing mobile applications. This complements the discussion of web apps and services in SWS1. Finally, we discuss the human factor as an absolutely central element in safeguarding information systems. Using current research in the field of awareness training, we highlight challenges and key findings from research and practice.

This module is highly recommended for anyone who
- develops or manages ICT products,
- builds or manages ICT infrastructure,
- seeks a job as a Security Consultant or Penetration Tester,
- or has a general interest in IT security.

Taking this module does not require to take SWS1 too. However, in view of an otherwise incomplete understanding of the subject of securing information systems, we highly recommend taking  it. For students who want to work as a software developer later, we consider the visit of SWS1 as mandatory.

Modulinhalt:

Securing information systems (16 lessons)
- Information Security Management Systems (ISMS)
- Threat landscape
- Malware technology and anti-malware systems
- Security monitoring (SIEM systems)
- Human risk factor

Penetration Testing (8 lessons)
- Types, standards and phases
- Information gathering strategies and tools
- Vulnerability scanners and Metasploit
- Exploitation: Return Oriented Programming (ROP)

Security on mobile platforms (4 lessons):
- Security concepts of mobile platforms
- Security analysis and development of secure mobile applications

The labs deal with problems related to key topics of the lecture. The tasks focus on the topics threat landscape, penetration testing and exploitation, security monitoring and the analysis and development of secure mobile applications.

Teaching materials

 Lecture slides with additional comments.

Supplementary literature

 Various refrerences and links in the lecture notes.

Prerequisites

 You should have attended and completed the module "IT-Sicherheit".
The content of the module Software and System Security 1 (SWS1) is assumed to be known. However, visiting SWS1 is not a prerequisit.

Teaching language

 ( ) German (X) English

Part of International Profile

 (X) Yes ( ) No

Module structure

 Type 3a
  For more details please click on this link: T_CL_Modulauspraegungen_SM2025

Exams
Description Type Form Scope Grade Weighting
Graded assignments during teaching semester Graded labs Written and oral All labs Points that are added to the points achievend in the final exam 20%
End-of-semester exam Exam Written 90 minutes Grading 80%

Remarks

  

Legal basis

 The module description is part of the legal basis in addition to the general academic regulations. It is binding. During the first week of the semester a written and communicated supplement can specify the module description in more detail.
Course: Software and System Security 2 - Praktikum
No.
t.BA.WV.SWS2-EN.19HS.P
Title
Software and System Security 2 - Praktikum

Note

  • No module description is available in the system for the cut-off date of 24 April 2024.
Course: Software and System Security 2 - Vorlesung
No.
t.BA.WV.SWS2-EN.19HS.V
Title
Software and System Security 2 - Vorlesung

Note

  • No module description is available in the system for the cut-off date of 24 April 2024.