studies
M.Sc. in "Distributed Systems, Security and Emerging Information Technologies"
Computing Systems Security Management and Engineering
1st semester
Network and Communications Security Network and Communications Security
Network and network system security includes all those security methods, techniques and tools that lead to the design, implementation and audit of a structured and well-defined network security pol-icy. The theoretical part of the course includes the analysis of security vulnerabilities in all the net-work layers of TCP/IP and the definition of a network security policy. The practical part of the course includes the practical application of security controls that correctly enforce the security policy such as network and application-layer firewalls, intrusion detection/prevention (IDS/IPS) systems and virtual private networks.
302/Lam.126
+302104142123
Information Security Governance
The first part of the course, focuses on managing security and privacy of Information Systems and the main phases of the ISMS (Information Security Management System) implementation are described. The requirements of the information security management standards (e.g. ISO 27001, 27002) as well as the main steps of the risk assessment / risk management methodologies (e.g. OCTAVE, CRAMM, ISO 27005) are presented. The second part examines the governance of information security involving the evaluation of the implementation of the security and business continuity standards (eg ISO 22301) based on the business needs of the organization. For this purpose the COBIT for Security standard is presented for the specialization of operational needs (goal cascade) to IT goals.
302, Central Building
+30 210 4142137
fax +30 210 4142472
Security Architecture Design
Web technologies have evolved over the last ten years, leading to an interactive Web ecosystem, with numerous distributed components, cooperating with and depending on each other. Instead of simple web pages with optional interactive components, we are now using ubiquitous distributed applications with a client component. The course “Secure Architecture Design” provides a clear and understandable overview of the Web ecosystem, and tries to look in depth the vulnerability landscape, as well as of the underlying attacker models. In addition, it provide a catalog of best practices with existing countermeasures and mitigation techniques, to guide all involved players to improve step-by-step the trustworthiness of their IT infrastructures. Interesting challenges for securing the Web platform and opportunities for future research and trends in improving web security are presented. The aims of the course aims are the following:
- To better understand the complexity of the Web platform.
- The identification of its security features.
- Presentation of best practices, the proper usage of which will help us to protect it.
As-a-Service Business Model
Nowadays, more and more companies choose to satisfy their requirements in Enterprise software not by following traditional approaches such as: buying ready software solutions or developing software solutions to meet their business needs. Instead more and more companies choose a software-as-a-service (SaaS) business model to satisfy their needs. Thus, Customer Relationship Management (CRM) solutions, Enterprise Resource Planning (ERP) systems and Supply Chain Management (SCM) systems are provided as software-as-a-service. A SaaS business model provides flexibility to the companies, but also creates new challenges. In this module we analyze these challenges and the new opportunities that arise in this new and dynamic business environment. At the same time we analyze issues that are related to the three basic types of cloud computing: Infrastructure as a service (IaaS), Platform as a service (PaaS) and Software as a service (SaaS).
302, Central Building
+30 210 4142137
fax +30 210 4142472
302/Lam.126
+302104142123
2nd semester
Penetration Testing
Penetration testing includes the controls that aim to test the correct implementation of the network security policy, as well as of the technical security controls and protocols that have been implement-ed. The course includes the analysis of the methodologies and tools that are used for network and system penetration testing. The theoretical part includes the study of penetration testing methodolo-gies and best practices for the network, as well as for the system. The practical part of the course includes the practical application of penetration testing tools, through the examine of realistic cases that are based on real-world security incidents. The goal of these tests is tο validate the effective-ness of the installed security controls.
302/Lam.126
+302104142123
Digital Forensics and Malware Analysis
The first part of the course studies methodologies and techniques for the detection, collection and analysis of digital evidence regarding to security incidents of Windows systems. Afrerwards, we present methods for the collection of valid and verified digital evidence, filesystem analysis, memory analysis, time and log file analysis. The second part focuses on methods for the analysis fo malware (trojans, rootkits, ransomware etc). This involves the analysis of real-world and recent malware in real time and live environment. We study malware collection tools, techniques for static code analysis through disassemblers and debuggers such as IDA Pro and Ollydbg, as well as dy-namic malware analysis methods and tools. In this regards, we study sandboxing tools, as well wal-ware specific pattern recognition tools such as yara. Scope of the course: Collection and analysis of digital evidence with the least alterations, malware identification and analysis, methodologies for the analysis, detection and handling of real-world security events/incidents.
540, Central Building
Software Security
Companies and organizations around the world are today, much more than ever before, recognizing the value of security in software. Furthermore, vendors heavily invest in security processes that will enable them to produce software that will meet high security standards. This course describes the fundamental principles behind software security and explains the value of secure software in dependable ICT infrastructures. It also describes in detail the basic types of software vulnerabilities and shows how these can be rated and managed according to their respective risk. The primary goal of this course is the development of the following skills: the application of security best practices to software under development, the identification of security issues in open source and closed source software, the demonstration of a vulnerability, the rating of a vulnerability and the management of vulnerabilities throughout the design, implementation and maintenance phases of software projects. Students will also be introduced to state-of-the-art methods for the identification of vulnerabilities and recent techniques for the proactive mitigation of risks. Through lectures, assignments and workshops students will find out how to identify security bugs both in software for which the source code has been made available (code review) but also in software where source code is not available (black box review). The vulnerabilities studied throughout this course come from a wide area of applications including: operating system software, embedded systems software, Internet services, desktop software, web applications and mobile applications.
302/Lam.126
+302104142123
Special Topics
Emerging architectures, technologies and algorithms of the 4th Industrial Revolution (Industry 4.0), Models, methodologies and supply chain security systems (Supply Chain Security), Security and privacy in the age of Cybersecurity in Artificial Intelligence and the European Approach, Requirements arising from the European Legislative framework and the technological challenges that arise in matters of cybersecurity and Artificial Intelligence.
502, Central Building
+302104142270 , Phone Number: +30 6944783685 , +32(0) 485064238 , skype: nineta.polemi
3rd semester
MSc Thesis