Course content

The way that systems are developed and operated has been changing. Professionals who, in the past, might have been regarded as conventional end-users, now play a role in the development and operation of information systems. Contemporary engineers and scientists are now expected to possess a range of information technology skills. For example, they are expected to use these skills to build a web-based front end for their application, to interact with and control IoT devices, to integrate with third-party services and infrastructure, or to leverage data as a commodity. With these everyday skills comes a responsibility to ensure that security and privacy concerns are adequately considered in the systems that they build and work with. However, we see many public examples of where this does not happen: security and privacy breaches are reported for information systems, medical devices, industrial control systems, and more.

The objective of this introductory course is to provide a basic competence in a selection of contemporary information security and privacy topics. It is intended for students who expect to play a role in the development and operation of information systems.

Learning outcome

Knowledge:
- Basic knowledge of security issues in network and web technologies;
- Basic knowledge of the principles and mechanisms for identification and authentication;
- Knowledge of select vulnerabilities and attack mechanisms and methods against information systems;
- Knowledge of information system vulnerability and exposure management;
- Basic knowledge of human-centered security design, and
- Basic knowledge of the concept of data privacy.

Skills:
- Use security APIs and services in order to provide confidentiality, integrety and authentication across networked application systems;
- Use tools to identify security vulnerabilities in selected applications/systems;
- Develop systems that avoid some basic security vulnerabilities, and
- Configure basic network application infrastructure to avoid common security vulnerabilities.

General Competence:
- Discuss and appreciate the dangers of inventing one's own security mechanisms;
- Explain the concept of authentication, authorization, access control, and data integrity;
- Explain the various possible attacks on passwords;
- Describe the concept of privacy including personally identifiable information;
- Describe the concepts of personal tracking and digital footprint, while understanding the invasiveness of such tools in the context of privacy;
- Identify common attack vectors;
- Discuss the need to update software to fix security vulnerabilities;
- Explain how the security of a system's components might impact the security of the system;
- Describe information security policy and its role in a successful information security program, and
- Appreciate the need for adequate security and the limitations of one's own understanding.

Learning methods and activities

The course is based on a combination of lectures and self-defined project work. The projects can be executed individually or in grous. The students are encouraged to work on topics related to their primary interest field with a focus on technological and organizatorical challenges related to information security and privacy. In addition the students are challenged to create digital presentation and execute peer review of the work of other students.

A multi campus course, lectures and activity partly in campus Trondheim and campus Gjøvik, partly online.

Compulsory assignments

• Delivery of two digital presentations (only valid autumn 2020)
• Exercises (not valid autumn 2020)

Specific conditions

Recommended previous knowledge

Recommend as 3. or 4. y K-course.

Required previous knowledge

Students are required to have elementary information technology skills, with a basic understanding of computer systems, programming, web, database and networking.

Course materials

M. Whitman og H. Mattord: Principles of Information Security, CENGAGE, 6. Utgave, 2019

A use-case driven study of security vulnerabilities in selected systems and networked application systems. Attacks include injection, spoofing, scripting, fixation, hijacking, poisoning, parameter tampering, key/password cracking, flooding and overflows. Techniques and tools for identifying, preventing and/or managing the exploitation of these vulnerabilities. The role that human-factors play in security. Introduction to data privacy.

Credit reductions