Cybersecurity: Principles and Secure Software Systems

COMP38412 Cybersecurity: Principles and Secure Software Systems 10 Semester 2 Undergraduate Level 3 Dominik Winterer Unit coordinator Department of Computer Science 1 FHEQ level (Framework for Higher Education Qualifications) ' Last part of a Bachelors ' European Credit Transfer & Accumulation System Rating : 5.0 This course introduces students to the principles and practice of cybersecurity, with a strong emphasis on software-intensive systems, including AI-enabled and cyber-physical systems (CPS). The course integrates classical security mechanisms with automated and formal verification techniques, enabling students to identify, analyse, and mitigate security threats systematically. Students will learn to reason about security as a "system property", from threat modelling and secure design to vulnerability detection and formal verification. Through lectures and hands-on laboratories, students will gain practical experience in analysing real-world vulnerabilities and applying automated verification tools to security-critical software written in industrial programming languages (e.g., C, C++, Rust, Java, and Python).  This course introduces students to the principles and practice of cybersecurity, with a strong emphasis on software-intensive systems, including AI-enabled and cyber-physical systems (CPS). The course integrates classical security mechanisms with automated and formal verification techniques, enabling students to identify, analyse, and mitigate security threats systematically. Students will learn to reason about security as a "system property", from threat modelling and secure design to vulnerability detection and formal verification. Through lectures and hands-on laboratories, students will gain practical experience in analysing real-world vulnerabilities and applying automated verification tools to security-critical software written in industrial programming languages (e.g., C, C++, Rust, Java, and Python).  This course introduces students to the principles and practice of cybersecurity, with a strong emphasis on software-intensive systems, including AI-enabled and cyber-physical systems (CPS). The course integrates classical security mechanisms with automated and formal verification techniques, enabling students to identify, analyse, and mitigate security threats systematically. Students will learn to reason about security as a "system property", from threat modelling and secure design to vulnerability detection and formal verification. Through lectures and hands-on laboratories, students will gain practical experience in analysing real-world vulnerabilities and applying automated verification tools to security-critical software written in industrial programming languages (e.g., C, C++, Rust, Java, and Python).  ILO1: Select and apply cryptographic encryption schemes for confidentiality, and authentication schemes for integrity and non-repudiation ILO2: Assess the strengths and limitations of automated security analysis tools ILO3: Identify common software vulnerabilities and apply secure coding practices to mitigate them ILO4: Evaluate security challenges in modern systems, including AI-enabled and cyber-physical systems ILO5: Apply automated and formal verification techniques to detect and reason about security vulnerabilities in software ILO6: Analyse and classify security threats and vulnerabilities in software and systems  Analytical skills Innovation/creativity Problem solving Research 1. Foundations of Cybersecurity and Threat Modelling  - Notion and scope of cybersecurity across software, networked, and cyber-physical systems.  - Security goals, services, and adversary models.  - Threat classification and attack surfaces.  - Systematic threat modelling (assets, trust boundaries, attacker capabilities).  - Overview of formal methods in security assurance.2. Cryptography: Symmetric and Asymmetric Encryption  - Classical encryption techniques.  - Block ciphers.  - Symmetric encryption modes of operation.  - Number theory: Prime numbers, Fermat’s and Euler’s Theorems, Primality Testing (Miller-Rabin), and Discrete Logarithms.  - Asymmetric encryption: Principles of Public-Key Cryptosystems and the RSA scheme.3. Cryptographic Authentication and Access Control  - Cryptographic hash functions.  - Message authentication codes (MACs).  - Authenticated encryption.  - Digital signatures.  - Identification Schemes.4. Software and System Security  - Threat modelling for software systems.  - Malicious software and attack vectors.  - Software vulnerabilities: memory safety, injections, race conditions, and logic errors.  - Secure coding principles and defensive design.  - Software supply-chain security and dependency risks.  - Security challenges in AI-enabled and embedded software systems.5. Automated and Formal Security Analysis  - Static and dynamic analysis techniques for vulnerability detection.  - Security properties vs safety properties.  - Model checking and unbounded verification.  - Formal specification of security requirements.  - Practical verification of security properties in C, C++, Rust, Java, and Python programs.  - Verification challenges in cyber-physical and AI-enabled systems.  Lecture: 20 hours Assessment - Coursework: 20 hours Independent Study: 60 hours   1 Written exam 70% 2 Written assignment (inc essay) 30% Exercises and in-class feedback COMP15111 Fundamentals of Computer Architecture Pre-Requisite Compulsory COMP11212 Fundamentals of Computation Pre-Requisite Compulsory COMP15111 and COMP11212 are pre-requisites. CM students will be missing the COMP15111 pre-requisite so will need to get permission from their Year Tutor and the Unit Coordinator for COMP38412 before they can enrol.COMP15111 and COMP11212 are pre-requisites. CM students will be missing the COMP15111 pre-requisite so will need to get permission from their Year Tutor and the Unit Coordinator for COMP38412 before they can enrol. N <ol><li>William Stallings, Lawrie Brown. (2024). Computer Security Principles and Practice. Pearson Education, Inc. ISBN:<a href="https://www.librarysearch.manchester.ac.uk/discovery/search?query=isbn,contains,9780138091675&search_scope=MyInst_and_CI&sortby=rank&vid=44MAN_INST:MU_NUI&lang=en&mode=advanced&offset=0" target="_blank"> 9780138091675</a>  </li><li>Clarke, Edmund M; Henzinger, Thomas A; Veith, Helmut; Bloem, Roderick. (2018). Handbook of Model Checking. Springer International Publishing. ISBN:<a href="https://www.librarysearch.manchester.ac.uk/discovery/search?query=isbn,contains,9783319105758&search_scope=MyInst_and_CI&sortby=rank&vid=44MAN_INST:MU_NUI&lang=en&mode=advanced&offset=0" target="_blank"> 9783319105758</a>  </li><li>Stallings, William. (2014). Cryptography and Network Security: Principles and Practice. Pearson Education UK. ISBN:<a href="https://www.librarysearch.manchester.ac.uk/discovery/search?query=isbn,contains,9780273793762&search_scope=MyInst_and_CI&sortby=rank&vid=44MAN_INST:MU_NUI&lang=en&mode=advanced&offset=0" target="_blank"> 9780273793762</a>  </li><li>Anderson, Ross. (2020). Security engineering: a guide to building dependable distributed systems. John Wiley & Sons Inc. ISBN:<a href="https://www.librarysearch.manchester.ac.uk/discovery/search?query=isbn,contains,9781119644682&search_scope=MyInst_and_CI&sortby=rank&vid=44MAN_INST:MU_NUI&lang=en&mode=advanced&offset=0" target="_blank"> 9781119644682</a>  </li><li>William Stallings. (2018). Effective Cybersecurity: A Guide to Using Best Practices and Standards. Addison-Wesley. ISBN: <a href="https://www.librarysearch.manchester.ac.uk/discovery/search?query=isbn,contains,978&search_scope=MyInst_and_CI&sortby=rank&vid=44MAN_INST:MU_NUI&lang=en&mode=advanced&offset=0" target="_blank">978</a>  </li><li>Computer Security: Art and Science | 2nd edition | Pearson.  </li></ol> Lectures 20 Practical classes & workshops 20 0 60