The course is centered around a project assignement in which students conduct a threat modeling-based cyber risk assessment and suggest a cyber defesne action plan. The course also includes a number of guest lectures related to cyber threat modeling and security risk assessment.
EP2790 Security Analysis of Large-Scale Computer Systems 7.5 credits
Companies today have thousands of software-based computer systems that all are depending on one another in a large complex network, a system-of-systems. That cyberattacks succeed is to a large extent due to this complexity. The security engineers at a company need to understand the whole system with all its potential vulnerabilities, while an attacker only needs find one way in. Luckily for the defenders, as they have access to the system environment they don't have to start on a blank sheet and discover the environment as the attacker has to do. To add to the complexity, attackers can use a large number of different attack techniques but there also exist plenty of defense mechanisms. Coming up with and maintaining an overall defence solution that at the same time enables the supported business to thrive is a great challenge.
This course teaches a threat modeling-based method for analyzing cybersecurity risks for systems-of-systems. It includes developing and combining models for computer system resilience, threat actor capabilities, and business impacts of realized threats into an overall cyber risk assessment. Moreover the course addresses how cyber risk analysis is used for identifying and arguing for cost efficient defense mechanism selection for protecting the analyzed system-of-systems.
Information per course offering
Information for Autumn 2024 Start 28 Oct 2024 programme students
- Course location
KTH Campus
- Duration
- 28 Oct 2024 - 13 Jan 2025
- Periods
- P2 (7.5 hp)
- Pace of study
50%
- Application code
50486
- Form of study
Normal Daytime
- Language of instruction
English
- Course memo
- Number of places
Places are not limited
- Target group
Open for all master's programmes as long as it can be included in your programme.
- Planned modular schedule
- [object Object]
- Schedule
- Part of programme
Master's Programme, Communication Systems, åk 2, SMK, Recommended
Master's Programme, Communication Systems, åk 2, TRN, Recommended
Master's Programme, Cybersecurity, åk 1, Conditionally Elective
Master's Programme, Cybersecurity, åk 2, Conditionally Elective
Master's Programme, Information and Network Engineering, åk 1, Recommended
Master's Programme, Information and Network Engineering, åk 1, NWS, Recommended
Master's Programme, Information and Network Engineering, åk 2, Recommended
Master's Programme, Information and Network Engineering, åk 2, NWS, Recommended
Contact
Course syllabus as PDF
Please note: all information from the Course syllabus is available on this page in an accessible format.
Course syllabus EP2790 (Autumn 2019–)Headings with content from the Course syllabus EP2790 (Autumn 2019–) are denoted with an asterisk ( )
Content and learning outcomes
Course disposition
Course contents
Companies today have thousands of software based computer systems that all are depending on one another in a large complex network, a system-of-systems. That IT attacks succeed to a large extent due to this complexity. A company needs to understand the whole system while an attacker only needs find one way in. At the same time, there is a large set of attack types that are utilised and plenty of proposed defence mechanisms. This course main content aims to develop students' understanding of:
- the complex IT landscape of today by creating models of such.
- which attacks that are utilised today to cause harm and how these can propagate through a large network.
- what defences there are and when they are best suited against different attack types.
- how risk can be calculated and used to prioritise security work.
Intended learning outcomes
After passing the course, the students should be able to:
- model threats in large-scale computer systems (including software, networks etc),
- simulate attacks in large-scale computer systems
- carry out risk analysis based on a model and simulation
- describe which defence mechanisms computer system can have
- report and present models, simulation, risk analysis, and defense strategy for a given system
In order to:
- understand and explain which threats a specific system can have
- understand and explain how attacks work and propagate through a system architecture
- argue why certain risks should be prioritised
- choose the right defence to decrease risk.
Literature and preparations
Specific prerequisites
Completed course in Programming equivalent DD1315 Programming technique and Matlab, DD1316 Programming technique, C, DD1337 Programming and ID1018 programming I or the equivalent.
Equipment
Own computer.
Literature
Information about the course literature will be announced in the course memo.
Examination and completion
If the course is discontinued, students may request to be examined during the following two academic years.
Grading scale
A, B, C, D, E, FX, F
Examination
- PRO1 - Project work, 6.0 credits, grading scale: A, B, C, D, E, FX, F
- SEM1 - Seminars, 1.5 credits, grading scale: P, F
Based on recommendation from KTH’s coordinator for disabilities, the examiner will decide how to adapt an examination for students with documented disability.
The examiner may apply another examination format when re-examining individual students.
Other requirements for final grade
The examiner decides, in consultation with KTH's coordinator for disabilities (Funka), about possible adapted examination for students with documented, permanent disabilities. The examiner may permit other examination format for re-examination of individual students.
Opportunity to complete the requirements via supplementary examination
No information inserted
Opportunity to raise an approved grade via renewed examination
No information inserted
Examiner
Ethical approach
- All members of a group are responsible for the group's work.
- In any assessment, every student shall honestly disclose any help received and sources used.
- In an oral assessment, every student shall be able to present and answer questions about the entire assignment and solution.
Further information
Course room in Canvas
Registered students find further information about the implementation of the course in the course room in Canvas. A link to the course room can be found under the tab Studies in the Personal menu at the start of the course.
Offered by
Main field of study
Computer Science and Engineering
Education cycle
Second cycle
Add-on studies
No information inserted
Supplementary information
In this course, the EECS code of honor applies, see:
http://www.kth.se/en/eecs/utbildning/hederskodex.
This course overlaps with EP279V.