The school will focus on the theme of Security of research computing infrastructures. The complete programme will offer around 30 hours of lectures, workshops and hands-on exercises, as well as a student presentations session, and special evening lectures. Classes are prepared and given by speakers who are security professionals with many years of experience in academia and research.
(Please note that this programme may be subject to minor changes.)
Introduction
Security in research and scientific computing (David Crooks, 1h introduction talk)
- computer security: past, present and future
- current risk landscape
- most common threats and attack vectors
- "why are we here?"
Risk management (Sven Gabriel, 1h lecture and 1h exercises)
- overview of the school programme
- various aspects of risk management
- risk assessment
Track 1: Protection and prevention
Security architecture (Barbara Krasovec, 2h lectures)
- fundamental security principles
- develop skills to be a security architect
- how to design and provide secure computing infrastructure
- security standards and frameworks
- data, network and physical security
- endpoint security: hardware, host, OS, BMC, security, system hardening
- defensible security architecture
Application security (Sebastian Lopienski, 2h lectures and 1h exercises)
- basics of software security
- web application security, typical web vulnerabilities
- introduction to pentesting (ethical hacking)
- static analysis tools
Identity, authentication, authorisation (Tom Dack, 1h lecture and 1h exercises)
- An introduction to the concepts of Identity, Authentication, and Authorization
- Authentication and authorisation for distributed research
- Methods for communicating authentication and authorization: Certificates, SAML, OAuth
- How these technologies fit within research infrastructures
Virtualisation and cloud security (Barbara Krasovec, 1h lecture)
- virtualisation security fundamentals
- cloud service models
- authentication and key management
- data security in the cloud
- DevSecOps
- security in private and public cloud
- common threats in the cloud
- security tools
Container security (Daniel Kouril, 1h lectures and 1h exercises)
- key concepts of containers (namespaces, cgroups etc.) and Docker
- container security, threat landscape
- vulnerability and patch management
Vulnerability management (Sven Gabriel / David Crooks, 1h lecture)
- risk analysis and risk mitigation
- vulnerability lifecycle, monitoring, scanning
- CVE, CVSS, CPE, CWE and related standards
- special cases: vulnerable hardware, EOL systems etc.
Track 2: Detection
Logging and traceability (David Crooks, 1h lecture)
- host-based logs (system and application level), network monitoring
- the importance of central logging
- tools and technologies
- data privacy, dealing with personal and sensitive data, log retention
- traceability challenges
Intrusion detection with SOC (David Crooks, 1h lecture and 2h exercises)
- indicators of compromise (IoCs), threat intelligence sharing, TLP protocol
- tools and technologies: MISP, Zeek, OpenSearch etc.
- deploying a Security Operation Center
- security incidents: detecting and alerting
Track 3: Response
Security operations (Sven Gabriel, 1h lecture)
- security operations: history, CERT vs. CSIRT
- CSIRT organisation and provided services
- incident response readiness
- lessons learned from past incidents
Incident response management (Barbara Krasovec, 1h lecture)
- incident management and coordination
- incident analysis and investigation
- communication with stakeholders
- containment and eradication
- recovery
- lessons learnt
Digital forensics (Daniel Kouril, 2h lectures and 2h exercises)
- digital evidence handling
- data acquisition (live systems, storage etc.)
- data analysis (OS, file system, network, executables etc.)
- reporting
Incident response exercise (Sebastian Lopienski, Tom Dack, David Crooks, Romain Wartel, 3h role-playing exercise)
- incident management and coordination
- communication with local users, external communities, and other stakeholders
- working with law enforcement
- privacy aspects
Additional talks
Student lightning talks session
