Course Code | Course Name | Theory | Pratl] Tutorial | Theory | PractzalOa | Tor | Total TCT ——Tnifaractre 04 J =] >a P= Toa Security Course Code 7 Course Examination Scheme Thong Maris Oat & Tarlac Tosasen | Tem [Psu vg. of Exam restt [tesa] ANE 8 | TICE arnare Security 20 | 20 20 80 ~ ~ 100 Course Objectives: Students will try To understand underlying principles of infrastructure security 2. To explore software vulnerabilities, attacks and protection mechanisms To learn security aspects of wireless network infrastructure and protocols To investigate web server vulnerabilities and their countermeasures 4. To develop policies for security management and mitigate security related risks in the organization 5. To Learn the different attacks on Open Web Applications and Web services. 6. To Lear the different security policies, Course Outcomes: Students will be able to: Understand the concept of vulnerabilities, attacks and protection mechanisms Analyze and evaluate software vulnerabilities and attacks on databases and operating systems Explain the need for security protocols in the context of wire! Understand and explain various security solutions for Web and Cloud infrastructure Understand, and evaluate different attacks on Open Web Applications and Web services Design appropriate security policies to protect infrastructure components Prerequisite: Computer Networks, Cryptography and Network Security Detail Syllabus: communication Sr Module Detailed Content No. Hours co ‘Mapping 1 | introduction | Aeeess Control Serviees- RADI TACACSt Cyber-attacks, _ Vulnerabilities, Strategies and Techniques, Methods- Password, Token and Biometric, and Models (DAC,MAC, RBAC, ABAC, BIBA, Bell La Padula), Authentication and Aci Policies US, TACACS, Defense Authentication sss Control and. col University of Mumbai, B. E. (Information Technology), Rev 2016 176n Software Security Software Vulnerabi Buffer overflow, Format String, Cross-Site Scripting, SQL Injection, Malware: Viruses, Worms, Trojans, Logic Bomb, Bots, Rootkits Operating System Security: Memory and Address Protection, File Protection Mechanism, User Authentication. Linux and Windows: Vulnerabilities, File System Security Database Securit Database Security Requirements, Reliability and Integrity, Sensitive Data, Inference Attacks, Multilevel Database Security 12 co2 m1 Wireless, Security able Deve Si Security Threats, UMTS and 4G Security, Vv Cloud Security co3 SAML, OAuth cos Web Security Web Security Considerations, User ‘Authentication and Session Management, Cookies, SSL, HTTPS, SSH, Privacy on Web, Web Browser Attacks, Account Harvesting, Web Bugs, Clickjacking, Cross- Site Request Forgery, Session Hijacking and Management, Phishing and Phatming Techniques, DNS Attacks, Web Service Scourity, Secure Electronic Transaction, Email Attacks, Web Server Security as per OWASP, Firewalls, Penetration Testing vi Taformation Security and Risk Management 12 C04, cos Legal System and Cybercrime, Bihical Tse in| coe University of Mumbai, B. E. (Information Technology), Rev 2016 iwText Boo! 1 2 3. 4 Computer Security Principles and Practice, William Stallings, Sixth Edition, Pearson Education Security in Computing, Charles P. Pfleger, Fifth Edition, Pearson Education ‘Network Security and Cryptography, Bemard Menezes, Cengage Learning Network Security Bible, Eric Cole, Second Edition, Wiley Reference Books: 1 ‘Web Application Hackers Handbook by Wiley. Computer Security, Dieter Gollman, Third Edition, Wiley CCNA Security Study Guide, Tim Boyle, Wiley Introduction to Computer Security, Matt Bishop, Pearson, Cloud Security and Privacy, Tim Mather, Subra Kumaraswamy, Shahed Latif, O’Riely Assessment: Internal Assessment for 20 marks: Consisting of Two Compulsory Class Tests Approximately 40% to 50% of syllabus content must be covered in First test and remaining 40% to 50% of syllabus contents must be covered in second test. End Semester Examination: Some guidelines for setting the question papers are as: © Weightage of each module in end semester examination is expected to be/will be proportional to number of respective lecture hours mentioned in the syllabus. © Question paper will comprise of total six questions, each carrying 20 marks. ‘© Qu will be compulsory and should cover maximum contents of the syllabus, ‘© Remaining question will be mixed in nature (for example if Q.2 has part (a) from module 3 then part (b) will be from any other module. (Randomly selected from all the modules.) Total four questions need to be solved. University of Mumbai, B. E. (Information Technology), Rev 2016 v8