SCHEME OF STUDIES

DIPLOMA IN CYBER PHYSICAL SYSTEM AND SECURITY

(C-20)

Department of Collegiate & Technical Education Bengaluru-560001 Page 1

 CURRICULUM STRUCTURE
V Semester Scheme of Studies - Diploma in Cyber Physical System and Security [C-20]
Course Pathway Title Hours per CIE SEE-1 SEE-2

Min Marks for Passing

(including CIE marks)
Course Category /
Code Semester Marks Marks Mark

Total contact hrs

Assigned Grade

SGPA and CGPA

Total Marks

Grade Point
(Theory (Practical)
Pathway

Credits
Department
)

/Semester
L T P Max Min Max Min Max Min
Teaching

Programme Specialization Pathway

CSE 20CY51I 1. Cyber Physical
Specialization System 104 52 312 468 24 240 96 60 24 100 40 400 160
pathways in
emerging areas 20CS54I 2. Cyber Security
1

Student may
select any one 104 52 312 468 24 240 96 60 24 100 40 400 160
of the
specializations
Entrepreneurship Pathway

Both SGPA & CGPA

ES/CSE/CY 20ET51I Entrepreneurship
and Start up 104 52 312 468 24 240 96 60 24 100 40 400 160
2

Science and Research Pathway L T P Total CIE SEE

Credits
Marks Marks
Max Min Max Min
BS/SC/CSE 2OSC51T Paper 1-Applied
52 26 0 78 6 50 20 50 20 100 40
Specialization Mathematics
pathway in 2OSC52T Paper 2 – Applied
52 0 52 104 6 50 20 50 20 100 40
Science and Science
Research 2ORM53T Paper 3 – Research
(Student need Methodology 52 0 52 104 6 50 20 50 20 100 40
3

to take all four 2OTW54P Paper 4 – Technical

papers in this Writing 39 13 52 104 6 60 24 40 16 100 40
pathway)
Total 195 39 156 390 24 210 84 190 76 400 160
L:- Lecture T:- Tutorial P:- Practical BS- Basic Science:: ES-Engineering Science:: SC: Science , I: Integrated :: CS: Computer Science and Engineering

Note : In 5th Semester student need to select any one of the pathways consisting of 24 credits
Students can continue their higher education irrespective of the pathways selected.

Department of Collegiate & Technical Education Bengaluru-560001 Page 2

 VI Semester Scheme of Studies - Diploma in Cyber Physical System and Security [C-20]

Marks for

(includin
Assigned
/Semeste

SGPA and
Passing

marks)
Credits

Marks

Grade
Grade
CIE SEE

Point
Total

g CIE
contact

CGPA
Min
Course Category /

Total
Marks Marks
Pathway

hrs
Course

r
Department
Pathway Course
Code

Teaching
Max Min Max Min

40 Hours /
Specialisatio Internship/ week
20CY61S 640 16 240 96 160 64 400 160
n pathway project Total 16
Weeks
40 Hours /
Science and
Research week
20CY61R Research 640 16 240 96 160 64 400 160
project Total 16
Pathway
Internship

Weeks
ES/CSE/CY

Minimum
Viable Product - 40 Hours /
Entrepreneurs
MVP/ week
20CY61E hip and Start 640 16 240 96 160 64 400 160
up pathway
Incubation/ Total 16
Startup Weeks
proposal

Note : Student shall undergo Internship/Project/research project/MVP/Incubation/Startup proposal in the same area as opted

in 5th semester pathway.

Department of Collegiate & Technical Education Bengaluru-560001 Page 3

 Cyber Physical System

Department of Collegiate & Technical Education Bengaluru-560001 Page 4

 Diploma in Cyber physical system & Security C 20: 2020 - 21

Government of Karnataka
DEPARTMENT OF COLLEGIATE and TECHNICAL EDUCATION
Program Cyber Physical System and Semester 5
Security
Course Code 20CY51I Type of Course L: T: P (104:52:312)
Course Name Cyber Physical System Credits 24
CIE Marks 240 SEE Marks 160
Introduction:
Welcome to the curriculum for the Cyber Physical System Specialisation. This specialisation course
is taught in Bootcamp mode. Bootcamps are 13 weeks, intense learning sessions designed to
prepare you for the practical world – ready for either industry or becoming an entrepreneur. You
will be assisted through the course, with development-based assessments to enable progressive
learning.

In the era of connected computing devices, securing the personal data, application, system, network
and organization becomes the challenging task in the field of Cyber Physical System. The
specialization prepares students to take up job or to become entrepreneur in the challenging area
of Cyber Physical System

Pre-requisite

Before the start of this specialisation course, you would have completed the following
courses;

In the 1st year of study, you would have studied Engineering Mathematics, Communication Skills,
Computer Aided Engineering Graphics, Statistics & Analysis, Basic IT Skills, Fundamentals of
Computer, Fundamentals of Electrical and Electronics Engineering, Project Management skills and
Multimedia & Animation.
In the 2nd year of study, you would have studied Python Programming, Computer Hardware,
Maintenance and Administration, Computer Networks, Database System Concepts and PL/SQL,
Data Structures with Python, Operating System and Administration, Object oriented programming
and Design with Java, Software Engineering principles and practices.
In this year of study, you shall be applying your previous years learning along with specialised field
of study into projects and real-world applications.
Course Cohort Owner

A Course Cohort Owner is a faculty from the core discipline, who is fully responsible for one
specialised field of study and the cohort of students who have chosen to study that specialised field
of study.
 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Guidelines for Cohort Owner

1. Each Specialized field of study is restricted to a Cohort of 20 students which could include
students from other relevant programs.
2. One faculty from the Core Discipline shall be the Cohort Owner, who for teaching and
learning in allied disciplines can work with faculty from other disciplines or industry experts.
3. The course shall be delivered in boot camp mode spanning over 12 weeks of study, weekly
developmental assessments and culminating in a mini capstone.
4. The industry session shall be addressed by industry subject experts (in contact
mode/online / recorded video mode) in the discipline only.
5. The cohort owner shall be responsible to identify experts from the relevant field and
organize industry session as per schedule.
6. Cohort owner shall plan and accompany the cohort for any industrial visits.
7. Cohort owner shall maintain and document industrial assignments, weekly assessments,
practices and mini project.
8. The cohort owner shall coordinate with faculties across programs needed for their course to
ensure seamless delivery as per time table
9. The cohort owner along with classroom sessions can augment or use supplementally
teaching and learning opportunities including good quality online courses available on
platforms like Karnataka LMS, Infosys Springboard, NPTEL, Unacademy, SWAYAM , etc.

Course outcome: A student should be able to

Select appropriate devices, technology, protocol, and platform for a cyber physical system
CO1
application
Design, implement, and analyse a simple cyber physical system with security measures for a
CO2
real world application
Test, simulate attacks in cyber physical systems, evaluate effectiveness of security measures
CO3
and take appropriate actions and optimize the system.
Apply incident response and recovery, risk assessment and management plan in CPS
CO4
applications.
Apply concept of cloud computing, cryptography and Artificial intelligence in cyber physical
CO5
systems and security

Department of Collegiate & Technical Education Bengaluru-560001 Page 6

 Diploma in Cyber physical system & Security C 20: 2020 - 21

Detailed course plan

Wee Da
CO PO 1st session (9am to 1 pm) L T P 2ND session (1.30pm to 4.30pm) L T P
k ys
Introduction to Cyber Physical Systems (CPS)
What are Cyber-Physical Systems (CPS)?
• Definition of CPS
• Key characteristics and components of CPS
Explore Cyber Physical System through • Examples of CPS applications (e.g.,
case studies autonomous vehicles, smart grids, medical
a. CPS in transportation devices)
b. CPS in Energy Evolution of Cyber-Physical Systems
c. CPS in Critical Infrastructure
1,2, Foundations of Cyber-Physical Systems
1 1 d. CPS in medical devices 4 2 1
3
The cohort owner can consider any other Sensor Networks
example to ignite interest in CPS and
understand application of Cyber Physical Embedded Systems
systems practically Secure Networked Control Systems
1
Demonstration of Simple components of Cyber
Physical systems such as sensors, actuators,
Arduino/ raspberry pi boards
Principles of Cyber-Physical Systems
- Introduction and Basic concepts of cyber
Distinguishing Features of Cyber-Physical
- security
Systems
1,2, 1,2, - What is Cyber security, Security
2 CPS applications in various industries 3 1 3
3 3,4
• Manufacturing - principles
• Healthcare - CIA, AAA
• Agriculture
• Transportation - Vulnerability, Threat, Risk, attack and
 Diploma in Cyber physical system & Security C 20 : 2020 - 21

• Energy - Impact
• Smart cities - People, Process and Technology
- McCumbers Cube
Demonstration of a simple Cyber Physical System
- Cyber Security
using Arduino based project or Simulator
- - Brief history and types
( Packet tracer).
- - Infrastructure, network, cloud, IOT,
Example : Temperature sensor,
- application.
Controlling a fan or heater
- - Purpose and Importance
- - Challenges
- - Applications
- How does cyber security work?
Recap –
Topology
Hackers
OSI Model
Who are they?
TCP/IP Model
What is not hacking
1,2, 1,2, Internet protocols
3 3 1 Types of hackers 1 2
3 3,4 Network resources
Hacking methodologies
Router and Firewall, Hub, switch – security
Purpose
issues
Activity: Stuxnet - a case study
Basic Network terminologies

Analysing a Cyber Attack

- Defence in depth
1,2, 1,2, Types of Malwares
4 3 1 3
3 3,4 Spyware - What is defence in depth
Malware
Department of Collegiate & Technical Education Bengaluru-560001 Page 8
 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Backdoor - Layers
Ransomware
- Needs for Defence in depth
Scareware
Rootkit - Examples
Virus
- Host encryption
Trojan horse
Worms - Anti-virus
Symptoms of attack
- Firewall
Methods of Infiltration - E-Mail gateway
Social Engineering
- Password management
Pretexting
Tailgating - Honeypot
Something for something (quid
Multi Factor Auth
pro quo)
Denial-of-Service and DDoS
Botnet
On the Path attack
SEO Poisoning
Wi-Fi Password Cracking
Password Attacks
Password spraying
Dictionary attack
Brute force
Password Cracking Times
Rainbow
Traffic interception

Advanced Persistent Threats

Security Vulnerability and Exploits
Hardware Vulnerabilities
Meltdown and Spectre
Software Vulnerabilities
Categorizing Software
Vulnerabilities

Department of Collegiate & Technical Education Bengaluru-560001 Page 9

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

- Software updates

5 Developmental Assessment Assessment Review and corrective action 3

Industry Class : Cyber Physical System –
1,2,
6 1 4 Weekly Assignment(1PM-2PM)
3 Challenges and Opportunities
Interplay between Cyber and Physical
Components:
• Understanding the integration of cyber and
physical components in CPS
1,2, 1,2, • Importance of communication and
1 Peer Review 4 2 1
3 3,4 coordination between cyber and physical
systems
Challenges and opportunities in CPS design and
operation.
Overview of CPS Architecture and Design Practical Work:
CPS architecture and components Setting up a Cyber-Physical System:
• Designing and configuring a small-scale
2 Physical Components and architecture
CPS prototype
Computational Elements • Selecting appropriate sensors, actuators,
and communication components
Networking Infrastructure
• Integrating cyber and physical
1,2, 1,2, Sensors and Actuators components
2 2 2 2 1
3 3,4 Vulnerability Assessment:
Control Systems
• Identifying potential security
Data processing vulnerabilities in the CPS prototype
Communication • Conducting penetration testing and
vulnerability scanning
Security and privacy Analysing the results and prioritizing
Human – Machine interface vulnerabilities

Overview of Key Technologies in CPS:

Department of Collegiate & Technical Education Bengaluru-560001 Page 10

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

• Sensors and actuators

• Internet of Things (IoT)
• Cloud computing and edge computing
• Machine learning and artificial
intelligence
Real-time systems and control theory
Security Mechanisms in CPS
Security Solutions for CPS:
Security Threats in CPS Secure communication protocols and
Security Measures Implementation: encryption techniques (TLC, SSH, IPsec,
• Implementing secure communication DTLS. WirelessHart, Zigbee security,
protocols (e.g., Transport Layer Security) MQTT, CoAP, OPC UA, DDS, Modbus,
1,2, 1,2, EthernetIP, CAN etc )
3 • Configuring intrusion detection and 0 4 1 2
3 3,4
prevention systems • Intrusion detection and prevention
Applying access control mechanisms (e.g., role- systems
• Access control mechanisms
based access control) • Risk assessment and management in CPS
• Incident response and recovery in CPS

Incident Response and Recovery:

• Developing an incident response plan for

the CPS prototype
• Simulating security incidents and Overview of CPS Security Standards
practicing incident response procedures
1,2, 1,2, Evaluating the effectiveness of the response and NIST Cybersecurity Framework
4 2 2 1 2
3 3,4 ISO 27001/2 Standards
recovery measures
IEC 62443 Standards
Note : Take example of any real world security
incident in recent time and simulate same for
prating incident response procedure

Department of Collegiate & Technical Education Bengaluru-560001 Page 11

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

5 Developmental Assessment Assessment Review and corrective action 3

1,2,
6 Industry Class : Security of CPS 1 4 Weekly Assignment
3
Risk Assessment and Management:
• Conducting a risk assessment for the CPS
prototype
1,2, 1,2, Peer review
3 1 4 • Identifying potential risks and their 1 2
3 3,4
impact on the system
Developing risk mitigation strategies and
implementing them
Case Studies and Practical Examples:
• Real-world examples of CPS and their
security challenges
• smart cities
• Industrial control systems Real-World Case Study Analysis:
• Analysis of recent security incidents in • Analyzing real-world CPS security
CPS incidents and breaches
2 Practical demonstrations of CPS security 1 3 3
• Understanding the causes, impacts, and
measures. lessons learned from these incidents
Discussing possible preventive measures and
Note : Any other example can also be used to
countermeasures
demonstrate security challenges, however
minimum 2 detailed demonstration is
essential
Future Trends and Research:
Emerging Trends and Future Directions:
• Exploring emerging technologies and
• Advances in CPS technologies and their
trends in CPS security
1,2, 1,2, implications for security
3 1 3 • Researching novel approaches and 1 2
3,5 3,4 • Integration of CPS with emerging
solutions for CPS security challenges
technologies (e.g., blockchain, quantum
Identifying potential research areas and
computing)
opportunities for further exploration

Department of Collegiate & Technical Education Bengaluru-560001 Page 12

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

• Policy and regulatory considerations for

CPS security
• Cloud Computing in CPS
• Machine learning in CPS
Creating a simple Arduino-based project
using Arduino IDE and basic electronic
1,2, components for building simple Arduino-
1,2, Simulated Smart Home Security System using
3,4, 4 based projects. 4 3
3,4 openHAB
5 Example : Temperature sensor that controls
a fan or heater

5 CIE 1 – Written and Practice Test Assessment Review and corrective action
Industry Class : Modelling CPS using simulation
1,2, tools
6 2 3 Weekly Assignment
3,5 Simulation Tools such as Simulink
CPS Design Principles:
Interdisciplinary Approach:
• Collaboration between experts in cyber,
physical, and domain-specific domains
• Understanding the interdependencies and
1,2, Peer review interactions between cyber and physical
1,2, 1
3,4, 4 components 1 2
3,4
5 Incorporating knowledge from diverse fields, such
4
as computer science, engineering, control
systems, and domain-specific knowledge (e.g.,
transportation, healthcare)
Practical Work:
System Integration:
1,2, 1,2, CPS Design and Integration:
2 4 • Seamless integration of cyber and physical 1 2
3 3,4 • Selecting a specific CPS application or use
components
case

Department of Collegiate & Technical Education Bengaluru-560001 Page 13

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

• Designing the architecture and • Designing interfaces and protocols for

components of the CPS system efficient communication and coordination
Integrating cyber and physical components using Ensuring compatibility and interoperability of
appropriate communication protocols and different subsystems and components
interfaces.
Demonstrating CPS system ( Physical or
simulation)
Note : Covert the simple CPS system from the
previous week to a solution for an identified
problem.
Real-Time Responsiveness:
Case Study Analysis: • Designing CPS to respond and adapt in
• Analyzing real-world CPS designs and real-time to changing conditions and
their adherence to design principles requirements
• Evaluating the effectiveness of different • Utilizing real-time data from sensors and
1,2, 1,2,
3 design approaches in achieving desired 4 actuators for decision-making and control 1 2
3 3,4
system characteristics Employing feedback loops and control
Identifying potential design improvements and
mechanisms to maintain system stability and
lessons learned from
performance
Scalability and Flexibility:
Real-Time Responsiveness Implementation:
• Designing CPS to be scalable and
• Developing algorithms and control
adaptable to varying system sizes and
mechanisms to enable real-time
complexities
responsiveness
1,2, 1,2, • Allowing for the addition or removal of
4 • Implementing feedback loops and control 2 2 3
3 3,4 components without significant
strategies based on real-time sensor data
disruptions
Evaluating the system's performance and
Supporting modular and plug-and-play
responsiveness under various conditions architectures for easy system expansion and
upgrades

Department of Collegiate & Technical Education Bengaluru-560001 Page 14

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

5 Developmental Assessment Assessment Review and corrective action

1,2, Industrial Class : Scalability and Flexibility in
6 2 3 Weekly assignment
3 CPS design
Scalability and Flexibility Assessment:
• Evaluating the system's scalability and
flexibility requirements
1,2, 1,2, • Designing and implementing mechanisms
1 Peer review 4 1 2
3,5 3,4 to support system expansion and
adaptability
Testing the system's ability to handle varying
workloads and component additions/removals
Resilience and Fault Tolerance Resilience and Fault Tolerance Mechanisms:
• Designing CPS to be resilient to failures, • Identifying potential failure points and
disruptions, and malicious attacks vulnerabilities in the CPS system
• Incorporating redundancy and fault • Implementing redundancy and fault
1,2, 1,2,
2 tolerance mechanisms at both cyber and 2 2 tolerance mechanisms (e.g., backup 1 2
3 3,4
5 physical levels systems, fault detection algorithms)
Implementing robust error handling, fault Conducting fault injection and testing to evaluate
the system's resilience and fault tolerance
detection, and recovery mechanisms
capabilities
Security and Privacy: Security and Privacy Implementation:
• Considering security and privacy • Integrating security measures into the CPS
requirements from the initial design system design
phase • Implementing secure communication
• Employing secure communication protocols, authentication mechanisms,
1,2, 1,2, 3 protocols and encryption techniques and access control mechanisms.
2 2 1 2
3,5 3,4 • Implementing access control mechanisms • Conducting security testing and
and authentication mechanisms vulnerability assessments to identify and
• Addressing privacy concerns and mitigate potential security risks.
ensuring data protection throughout the Verification and Validation:
system • Performing rigorous testing and validation
Verification and Validation: of the CPS system design
Department of Collegiate & Technical Education Bengaluru-560001 Page 15
 Diploma in Cyber physical system & Security C 20 : 2020 - 21

• Performing rigorous testing, verification, • Conducting simulations, modeling, and

and validation of the CPS design analysis to verify system correctness and
• Conducting simulations, modeling, and performance
analysis to ensure system correctness • Incorporating user feedback and iterative
and performance improvements based on testing results
Incorporating feedback from testing and user
feedback to improve the design
Sensors and Actuators in CPS:
Practical Work:
Introduction to Sensors and Actuators:
Sensor Selection and Integration:
• Definition and role of sensors and
• Identify the requirements of a specific CPS
actuators in CPS
application
• Types of sensors (e.g., temperature,
1,2, 1,2, • Research and select appropriate sensors
4 pressure, motion) and actuators (e.g., 2 2 3
3,4 3,4 based on the application's needs
motors, valves, switches)
Integrate the sensors into the CPS system,
Importance of sensing and actuation in
considering placement and calibration
gathering data and controlling physical
requirements
processes

5 CIE 2 – Written and Practice Test Assessment Review and corrective action 3
2,3
2,5 6 Industrial Class : Sensor Technologies 2 3 Weekly Assignment
,4
Sensor Technologies for CPS:
• Overview of commonly used sensor
technologies in CPS
Peer review • Principles of operation for different types
1,2, 1,2, of sensors
1 4 3
3 3,4 Considerations for sensor selection based on
6
application requirements (e.g., accuracy, response
time, environmental factors)
1,2, 1,2,
2 Actuator Control and Synchronization: 2 2 Actuator Technologies for CPS: 1 2
3 3

Department of Collegiate & Technical Education Bengaluru-560001 Page 16

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

• Design and implement control • Overview of commonly used actuator

algorithms for actuator operation technologies in CPS
• Develop synchronization mechanisms for • Principles of operation for different types
coordinated actuator control of actuators
Test and evaluate the performance of the Considerations for actuator selection based on
actuator control system under different application requirements (e.g., force, speed,
scenarios precision)
Sensor Data Fusion and Aggregation:
Sensor Integration in CPS:
• Collect data from multiple sensors in the
• Techniques for sensor deployment and
CPS system
placement in CPS
• Implement sensor data fusion techniques
1,2, 1,2, • Calibration and calibration techniques for
3 to combine and extract meaningful 1 3 3
3 3,4 accurate sensor measurements
information
Sensor fusion and data aggregation for combining
Develop data aggregation algorithms to
data from multiple sensors
process and analyze the fused sensor data
Sensor-Actuator Interface Implementation:
• Select appropriate communication
protocols and interfaces for sensor-
actuator connectivity Actuator Control in CPS:
TLC, SSH, IPsec, DTLS. WirelessHart, • Control algorithms and strategies for
Zigbee security, MQTT, CoAP, OPC UA, actuator operation in CPS
DDS, Modbus, EthernetIP, CAN etc • Feedback control systems and closed-loop
1,2, 1,2, • Configure and program the interfaces to control
4 1 3 3
3 3,4 establish communication between Actuator coordination and synchronization in
sensors, actuators, and the cyber multi-actuator systems.
component Implement and test the sensor-actuator
Implement and test the sensor-actuator Actuator coordination and synchronization in
multi-actuator systems.
communication to ensure proper data
exchange and control commands

5 Developmental Assessment Assessment Review and corrective action

Department of Collegiate & Technical Education Bengaluru-560001 Page 17

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

6 Industrial Class 1 4 Weekly Assignment

Energy Efficiency Optimization:
• Analyze the power requirements and
energy consumption of the sensors and
actuators
Peer Review • Optimize the energy efficiency of sensor
1,2, 1,2,
1 4 and actuator operation through power 1 2
3,4 3,4
management techniques
Explore energy harvesting methods and
implement them in the CPS system to reduce
reliance on external power sources

Sensor-Actuator Interfaces: Performance Evaluation and Optimization:

• Communication protocols and interfaces • Conduct performance testing and
for connecting sensors and actuators to evaluation of the sensor and actuator
the cyber component of CPS subsystems
• Standardization efforts in sensor- • Measure the accuracy, response time, and
7 actuator interfaces (e.g., OPC UA, MQTT) reliability of the sensors and actuators
• Interoperability considerations for • Identify areas for improvement and
integrating sensors and actuators from optimize the sensor and actuator
1,2, 1,2, different manufacturers. subsystems based on the evaluation
2 Energy Efficiency and Power Management: 2 2 1 2
3,4 3,4 results
• Energy-efficient sensor and actuator Integration with Cyber Component:
designs for CPS • Integrate the sensor and actuator
• Power management techniques to subsystems with the cyber component of
optimize energy consumption the CPS system
• Energy harvesting and wireless power • Develop software interfaces and protocols
transfer for remote or battery-powered for data exchange between the cyber and
sensors and actuators physical components
Test
Communication Networks for CPS:
2,3, 1,2, Practical Work:
3 Introduction to Communication Networks in 2 2 3
4 3,4 Network Design and Configuration:
CPS:

Department of Collegiate & Technical Education Bengaluru-560001 Page 18

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Recap : TCP/IP Protocol Suite • Identify the communication requirements

• Importance of communication networks of a specific CPS application
in enabling information exchange • Design the network architecture and
between cyber and physical components select appropriate network technologies
• Overview of network architectures and Configure network devices (routers, switches)
communication models in CPS
and set up the network infrastructure
Key requirements and challenges in designing
communication networks for CPS
Addressing (IPV4, V6), Routing, Firewall,
firmwares
Network Technologies for CPS: Protocol Implementation and Testing:
Network topologies and protocols for CPS • Implement communication protocols
• Wired network technologies (e.g., suitable for CPS (e.g., MQTT, CoAP)
1,2, Ethernet, Fieldbus, CAN bus) • Develop software interfaces for data
4 2 2 1 2
3,4 • Wireless network technologies (e.g., Wi- exchange between cyber and physical
Fi, Bluetooth, Zigbee) components
Hybrid network approaches for CPS (combining Test the communication protocols for reliability,
wired and wireless technologies) real-time performance, and interoperability
5 CIE 3 – Written and Practice Test Assessment Review and corrective action

6 Industrial Class: 1 4 Weekly Assignment

CPS security standards
Network Protocols and Standards for CPS:
• Protocols for reliable and real-time
communication in CPS (e.g., MQTT, CoAP)
1,2, 1,2, Peer Review
1 4 • Time-Sensitive Networking (TSN) 1 2
3 3,4
standards for real-time communication in
8
Ethernet networks
Standardization efforts and frameworks for
interoperability in CPS (e.g., OPC UA, DDS)
Network Design and Architecture for CPS:
1,2, 1,2,
2 QoS Provisioning and Traffic Engineering: 2 2 • Determining network requirements based 1 2
3 3,4
on CPS application needs

Department of Collegiate & Technical Education Bengaluru-560001 Page 19

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

• Define QoS requirements for CPS • Network topology selection (e.g., star,
communication (e.g., latency, bandwidth, mesh, bus) and scalability considerations
packet loss) Quality of Service (QoS) provisioning for real-time
• Configure network devices to prioritize
communication and control in CPS
traffic and enforce QoS policies
Perform traffic engineering to optimize network Network Security Implementation:
• Implement network security measures
performance and resource allocation
(e.g., encryption, authentication) in CPS
communication networks
• Set up intrusion detection and prevention
systems to detect and mitigate security
threats
Conduct security testing to evaluate the
effectiveness of the implemented security
measures
Network Security for CPS:
• Security threats and vulnerabilities in
CPS communication networks
• Encryption and authentication
techniques for secure communication Designing and implementing a wireless
Intrusion detection and prevention systems for sensor network with security features.
1,2, 1,2, 2
3 network security in CPS 2 3
3 3,4 Note : Virtualization tools can be used to
Wireless Networks standards,
implement wireless sensor network.
security standard for wireless networks ( WEP,
WPA, WPA2 etc)
Wireless sensor networks.
Edge/Fog Computing Integration:
1,2, 1,2, Edge Computing and Fog Computing in CPS
4 • Integrate edge/fog computing nodes into 2 2 3
3,5 3,4 Networks:
the CPS network

Department of Collegiate & Technical Education Bengaluru-560001 Page 20

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

• Configure communication and • Distributed computing paradigms for data

coordination between edge/fog nodes processing and analysis at the edge of the
and the cloud network
Implement data processing and analysis • Edge/fog computing architectures and
their benefits in CPS
algorithms at the edge/fog nodes
• Communication and coordination between
edge/fog nodes and the cloud in CPS
networks
Network Management and Monitoring in CPS:
• Network management protocols and tools
for monitoring and maintaining CPS
networks
• Fault detection and localization
techniques in CPS networks
Performance monitoring and optimization of CPS
communication networks
5 Development Assessment Assessment Review and corrective action 3

6 Industry Class: Future of CPS and Security 1 4 Weekly Assignment

Network Monitoring and Fault Detection:

• Set up network monitoring tools for real-
time monitoring of CPS communication
networks
• Implement fault detection mechanisms to
Peer review
1,2, 1,2, identify network failures and disruptions
9 1 4 3
3,5 3,4 • Develop automated alerting and reporting
systems for network management and
troubleshooting
Performance Evaluation and Optimization:
• Measure the performance metrics of the
CPS communication network (e.g., latency,
throughput)

Department of Collegiate & Technical Education Bengaluru-560001 Page 21

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

• Analyze the network performance under

different traffic loads and scenarios
Optimize the network configuration and
parameters to improve performance and
efficiency
Vulnerability Assessment & Penetration
Testing
• Ethics of Penetration Testing
• Goal of Penetration Testing Set up a basic network with a firewall and
2,3, 1,2, • Thinking like a Hacker router, and simulating a network attack to
2 2 2 3
5 3,4 evaluate the effectiveness of security
• ATT&CK Framework Overview
measures.
• Introduction to the framework
Penetration testing for Cyber physical
systems
Basics of cloud computing
Why is cloud computing necessary?
Introduction to key cloud services (Compute,
storage, networking)
Forensic analysis for CPS Cloud delivery models
Evidence Collection IaaS v/s PaaS v/s SaaS
2,3, 1,2, Incident Reconstruction Introduction to cloud vendors(Azure,AWS, GCP)
3 2 2 1 2
5 3,4 Log Analysis Key Cloud Security Principles
Data Recovery and Reconstruction Shared responsibility model
Principle of least privilege
Defense in depth
Threat actors, diagrams & trust boundaries
Practice :
Create a cloud account

Department of Collegiate & Technical Education Bengaluru-560001 Page 22

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Create 2 accounts
Setup 2Factor Authentication on both account
Cloud asset management Using Cloud for Cyber physical systems
Identity & Access management in the cloud Data storage in cloud
Introduction to IAM Data Processing in cloud
2,3, 1,2, Introduction to Federal Identity Management Command and control in cloud
4 4 3
5 3,4
IAM Best Practices Cloud based cyber physical systems
IAM Audit
Intro to AWS/Azure clint and Web Portal

5 CIE 4 – Written and Practice Test Assessment Review and corrective action 3

6 Industrial Class: Cloud Computing for CPS 1 4 Weekly Assignment

Cloud Computing Continued..
Network security in Cloud
Peer review
2,3, 1,2, Security groups
1 4 3
5 3,4
VPC
WAF
Data protection in the cloud
10 Incident response
• Data protection at rest and at transit
- Log analysis
2,3, 1,2, • Cloud data storage - AWS EBS, S3 / Azure
2 1 3 3
5 3,4 - Events & alerts
SAS
- Key metrics (MTTD & MTTR)
• Secrets Management
Algebra: groups, rings, fields - definitions +
2,3, 1,2, Cryptography
3 2 2 1 3
5 3,4 examples

Department of Collegiate & Technical Education Bengaluru-560001 Page 23

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

History of cryptography (overview: Caesar AES (SPN structure, rounds, modes of operation -
cipher, enigma cipher) high level overview with diagram)
Introduction (high level overview only) MAC + SHA2/3 (high level + security
Enc (sym - stream + block ciphers, asym) requirements))
Hashing RSA (with numerical examples)
Digital signature, MAC Digital signature (RSA)
- PRNG
Number theory - primes, modular arithmetic,
gcd, Euler totient function - definitions +
examples
Practice sessions/ student activities:
- Numerical/programming exercises: subset of
math / Caesar cipher / one time pad / RSA / GCD
/ primality Virtualization software (e.g., VirtualBox), Kali
2,3, 1,2, Cryptanalysis (brute force over keys, birthday Linux, and Wireshark for setting up and
4 4 3
5 3,4 securing a network and simulating network
attacks on hash functions, hardness of factoring attacks.
integers, discrete log problem, side-channel
attacks – high level overview)
Practice sessions/ student activities:
Inspect digital certificates using a web browser
and visiting popular websites
- Identify the crypto algorithms in TLS

Department of Collegiate & Technical Education Bengaluru-560001 Page 24

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

- Design a toy crypto algorithm like key

generation + encryption + decryption / digital
signature / hash function

5 Development Assessment Assessment Review and corrective action 3

Industrial Class : Artificial intelligence and
6 1 4 Weekly Assignment
machine learning for CPS security
Fundamentals Real-time Operating Systems
Peer Review
2,3, 1,2, 4 (RTOS)
1 1 2
5 3,4
Components of RTOS
RTOS Architecture and features Real-time Systems for CPS
2,3, 1,2, Real-time Scheduling 2 2 Real Time communication in CPS
2 1 2
5 3,4
Real-time System Security
11 CPS security threats and vulnerabilities. Risk assessment and management
2,3, 1,2, 2 2
3 1 2
5 3,4 Cybersecurity challenges for CPS Introduction to Threat Modeling for CPS
Techniques for Threat Modeling in CPS
2,3, 1,2, 1 3 Mitigating Security Risks in CPS
4 1 2
5 3,4 Attack Surface Analysis for CPS

5 CIE 5 – Written and Practice Test Assessment Review and corrective action

6 Industry Class 1 4 Weekly Assignment

Understanding of Industrial Control Systems (ICS)

Peer review
2,3, 1,2, 4 Security 2
12 1 1
4,5 3,4
Threats and vulnerabilities to ICS

Department of Collegiate & Technical Education Bengaluru-560001 Page 25

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Techniques for securing ICS

Communication protocols
Understanding Industrial Control Systems (ICS)
2,3, 1,2, SCADA Systems for CPS 2
2 2 2 1
4,5 3,4 in CPS
Security of ICS in CPS
Overview of ICS Architecture
2,3, 1,2, Programmable Logic Controllers (PLCs) Distributed Control Systems (DCS) 3
3 1 3
4,5 3,4
Machine Learning for CPS 3
Data-driven Modeling and Prediction Cybersecurity and Intrusion Detection
2,3, 1,2,
4 1 3 Intelligent Decision Support
4,5 3,4 Anomaly Detection and Fault Diagnosis
Human-CPS Interaction and User-Centered Design
Adaptive Control and Optimization
3
5 Development Assessment Assessment Review and corrective action

6 Industry class: 1 4 Weekly Assignment

Internship Project
a) Secondary research on various a) Identification of the problem statement
industries and their operations to identify at (from at least 3 known problems) the students
least 3 companies along with the areas of work would like to work as part of the project – either
interest and develop an internship plan that as provided by faculty or as identified by the
1
2,3, clearly highlights expectations from the student. Document the impact the project will
13 to
4,6
5 industry during the internship. have from a technical, social and business
b) Design and develop a cover letter for perspective.
an internship request to all 3 identified b) Design and develop the project solution
companies and the resume to be submitted to or methodology to be used to solve at least one
potential companies. of the problems identified.

Department of Collegiate & Technical Education Bengaluru-560001 Page 26

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Prepare for an internship interview to Prepare a project plan that will include a
highlight your interests, areas of study, career schedule, WBS, Budget and known risks along
aspirations and personnel competence – with strategies to mitigate them to ensure the
including the areas of learning you expect to project achieves the desired outcome.
learn during internship.

**Note: Saturday session from 9 AM -2 PM

Department of Collegiate & Technical Education Bengaluru-560001 Page 27

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

References
Sl. No Description

1 Principles of Cyber-Physical Systems – Rajiv Alur

2 Cyber-Physical Systems – Rajkumar

3 Cyber-Physical Systems: From Theory to Practice – Danda B Rawath

4 Cyber-Physical Systems: A Comprehensive Guide

5 Cyber-Physical Systems: NPTEL

Department of Collegiate & Technical Education Bengaluru-560001 Page 28

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

CIE and SEE Assessment Methodologies

Duration
CIE Assessment Assessment Mode Max Marks
In hours

Week 3 CIE 1– Written and practice test 4 30

Week 5 CIE 2– Written and practice test 4 30
Week 7 CIE 3– Written and practice test 4 30
Week 9 CIE 4– Written and practice test 4 30
Week 11 CIE 5– Written and practice test 4 30
On line Course work (Minimum 10 hours online course with certification
40
from (SWAYAM/NPTEL/Infosys Springboard)
Profile building for Internship / Submission of Synopsys for project work 20
Portfolio evaluation (Based on industrial assignments and weekly developmental assessment) * 30
TOTAL CIE MARKS (A) 240
SEE 1 - Theory exam (QP from BTE) Conducted for 100 marks 3 hrs duration reduced to 60
3 60
marks
SEE 2 – Practical 3 100
TOTAL SEE MARKS (B) 160
TOTAL MARKS (A+B) 400
* The industrial assignment shall be based on peer-to-peer assessment for a total of 10 marks (on a scale of 1 to 10) and in the event of a group
assignment the marks awarded will be the same for the entire group, the developmental assessment will be for a total of 20 marks and based on
MCQ/case study/demonstration and such other assignment methods

Department of Collegiate & Technical Education Bengaluru-560001 Page 29

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Assessment framework for CIE

Note : Theory to be conducted for 1 hour and practice for 3 hours, total duration of exam – 4 hours
Programme Cyber Physical System and Security Semester V
Course Cyber Physical System Max Marks 30
Course Code 20CY51I Duration 4 hours
Name of the course coordinator
Note: Answer one full question from each section.
Qn.No Question CL CO PO Marks
L3/L4
Section-1 (Theory) – 10 marks
1.a) What is firewall and how can firewall technology be used in cyber physical systems L4 5
b) What is the need of defence in depth for a network ? L3 5
2.a) How does Control are network – CAN protocol facilitate communication in industrial L3 5
setup ?
b) How Does the NIST CSF provide guidance for managing third-party cybersecurity risks? L3 5
Section-2 (Practical) - 20 marks
3). a) Create a simple CPS to control fan/ac based on room temperature L3,L4 1,2 20

Scheme of evaluation
Sl. Description Marks
No
1 Selecting components 5

2 Designing the system 5

3 Implementation 5

Department of Collegiate & Technical Education Bengaluru-560001 Page 30

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

4 Testing and demonstration 5

Total 20

b) Simulated Smart Home Security System 20

Scheme of evaluation
Sl. Description Marks
No
1 Installation of simulation software 5

2 Selecting the components 5

3 Coding the logic 5

4 Demonstration and refining the rules 5

Total 20

Note : Theory questions shall be aligned to practical questions

Department of Collegiate & Technical Education Bengaluru-560001 Page 31

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Assessment framework for SEE 1 (Theory) – 100 Marks / 3 hours (Reduced to 60 marks)

Programme: Semester: V
Course: Max Marks: 100
Course Code: Duration: 3 Hrs
Instruction to the Candidate: Answer one full question from each section.
Qn.No Question CL CO Marks
Section-1
1.a) What is firewall and how can firewall technology be used in cyber physical systems L4 1 10
b) What is the need of defence in depth for a network ? L3 10
2.a) How does Control are network – CAN protocol facilitate communication in industrial setup ? L3 10
b) How Does the NIST CSF provide guidance for managing third-party cybersecurity risks? L3 10
Section-2
3.a) Explore challenges in integrating physical and cyber components in cyber physical systems ? L3 2 10
b) Design a smart city cyber physical system – components, communication, command and L4 10

control, security and data processing.

4.a) Design a traffic management system using wireless hart protocol. L4 10

b) What sensor technology can be used in waste management systems? L4 10
Section- 3
5.a) Describe steps in conducting security testing on cyber physical systems L3 2,3 10
b) Describe Time-Sensitive Networking (TSN) standards for real-time communication in L4 10
Ethernet networks
6.a) Describe steps to fallow in conducting penetrating testing on cyber physical systems L3 10
b) What are the performance metrics of the CPS communication network L4 10
Section-4
7.a) Given an implementation of RSA algorithm that uses primes p = 5 and q = 11, if the L4 2,4,5 10
encryption key

Department of Collegiate & Technical Education Bengaluru-560001 Page 32

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

is 27, what is the decryption key?

b) What is the final digit and two final digits of 310000? L4 10
8.a) Describe risk mitigating strategies in cyber physical systems with example L3 10
b) Illustrate lifecycles of security incident management and describe incident reconstruction L4
steps and strategies.
Section-5
9.a) Describe IAM ( Cloud) best practices when CPS control and command in in cloud L4 2,5 10
b) Illustrate use of Artificial Intelligence in Anomaly Detection and Fault Diagnosis L3 10

10.a) Write a note on Communication protocols used in SCADA systems L3 10

b) Illustrate strategies to implement data processing and analysis algorithms at the edge/fog L3 10
nodes

Assessment framework for SEE 2 (Practice)

Design and Implement a Cyber physical system to regulate fan/ac speed based on room temperature with appropriate security measures

Scheme of evaluation
Sl. No Description Marks

1 Selecting appropriate devices, protocols and technologies 10

2 Design of Cyber physical system with security measures 10

3 Executing the design ( Physical or simulation) 40

Simulating the cyber attacks on the system and implementing effective measures to secure the
4 40
system
Total 100

Department of Collegiate & Technical Education Bengaluru-560001 Page 33

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Equipment/software list with Specification for a batch of 20 students

Sl. No. Particulars Specification Quantity

1. Intel i7, 4GB RAM,
Computers 20
500GB SSD
2.
Python (Anaconda Distribution), Git, Jira, Jenkins, TensorFlow or similar tools
3.
Cloud – AWS/AZURE/GCB or any similar cloud environment
4.
Broadband connection
5.
Sensors, Actuator and processing units such as Rasberry Pi

Department of Collegiate & Technical Education Bengaluru-560001 Page 34

 Diploma in Cyber physical system & Security C 20: 2020 - 21

Cyber Security
 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Government of Karnataka
DEPARTMENT OF COLLEGIATE and TECHNICAL EDUCATION
Cyber Physical System &
Program Semester 5
Security

Course Code 20CS54I Type of Course L:T:P (104:52:312)

Course Name Cyber Security Credits 24

CIE Marks 240 SEE Marks 160

Introduction:
Welcome to the curriculum for the Cyber Security Specialisation. This specialisation course is taught
in Bootcamp mode. Bootcamps are 13 weeks, intense learning sessions designed to prepare you for
the practical world – ready for either industry or becoming an entrepreneur. You will be assisted
through the course, with development-based assessments to enable progressive learning.

In the era of connected computing devices, securing the personal data, application, system, network
and organization becomes the challenging task in the field of Computer science and Engineering.
The specialization prepare students to take up job or to become entrepreneur in the challenging
area of Cyber security

Pre-requisite

Before the start of this specialisation course, you would have completed the following courses;

In the 1st year of study, you would have studied Engineering Mathematics, Communication Skills,
Computer Aided Engineering Graphics, Statistics & Analysis, Basic IT Skills, Fundamentals of
Computer, Fundamentals of Electrical and Electronics Engineering, Project Management skills and
Multimedia & Animation.

In the 2nd year of study, you would have studied Python Programming, Computer Hardware,
Maintenance and Administration, Computer Networks, Database System Concepts and PL/SQL,
Data Structures with Python, Operating System and Administration, Object oriented programming
and Design with Java, Software Engineering principles and practices.

In this year of study, you shall be applying your previous years learning along with specialised field
of study into projects and real-world applications.

Department of Collegiate & Technical Education Bengaluru-560001 Page 36

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Course Cohort Owner

A Course Cohort Owner is a faculty from the core discipline, who is fully responsible for one
specialised field of study and the cohort of students who have chosen to study that specialised field
of study.

Guidelines for Cohort Owner

1. Each Specialized field of study is restricted to a Cohort of 20 students which could include
students from other relevant programs.
2. One faculty from the Core Discipline shall be the Cohort Owner, who for teaching and
learning in allied disciplines can work with faculty from other disciplines or industry experts.
3. The course shall be delivered in boot camp mode spanning over 12 weeks of study, weekly
developmental assessments and culminating in a mini capstone.
4. The industry session shall be addressed by industry subject experts (in contact
mode/online / recorded video mode) in the discipline only.
5. The cohort owner shall be responsible to identify experts from the relevant field and
organize industry session as per schedule.
6. Cohort owner shall plan and accompany the cohort for any industrial visits.
7. Cohort owner shall maintain and document industrial assignments, weekly assessments,
practices and mini project.
8. The cohort owner shall coordinate with faculties across programs needed for their course to
ensure seamless delivery as per time table
9. The cohort owner along with classroom sessions can augment or use supplementally
teaching and learning opportunities including good quality online courses available on
platforms like Karnataka LMS, Infosys Springboard, NPTEL, Unacademy, SWAYAM , etc.
Course outcome: A student should be able to
Design, optimize, operate and maintain a secure network/system/application/cloud and data
CO1
resources for given requirements
CO2 Apply cryptography to secure a cyber system.

CO3 Respond to incidents to mitigate immediate and potential threats .

Test, implement, deploy, maintain and review the infrastructure to effectively manage the
CO4
network and resources.

CO5 Monitor network to actively remediate unauthorized activities.

Department of Collegiate & Technical Education Bengaluru-560001 Page 37

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Detailed course plan

We Da
CO PO 1st session (9am to 1 pm) L T P 2ND session (1.30pm to 4.30pm) L T P
ek ys
- Protecting your personal data
- Online identity Introduction and Basic concepts of cyber
- Where is your data ? security
- Smart devices What is Cyber security, Security
- What do attackers want ? principles
- Identity theft CIA, AAA
- Protecting your organization data Vulnerability, Threat, Risk, attack and
- Traditional data Impact
- Cloud; IoT; Big data People, Process and Technology
- Types of data McCumbers Cube
1 1 1 1 4 - - 3
- Sensitive and non sensitive data Cyber Security
- Personal data, PII data - Brief history and types
- Data classification - Infrastructure, network, cloud, IOT,
- Ex: Govt. of India classification of data application.
- Unclassified - Purpose and Importance
- Restricted - Challenges
- Confidential - Applications
- Secret How does cyber security work?
- Top secret
-

Department of Collegiate & Technical Education Bengaluru-560001 Page 38

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Recap –
Topology Hackers
OSI Model Who are they?
TCP/IP Model What is not hacking

1 1,5 2 Internet protocols 3 1 Types of hackers 1 2

Network resources Hacking methodologies
Router and Firewall, Hub, switch – security Purpose
issues Activity: Stuxnet - a case study
Basic Network terminologies
Analysing a Cyber Attack
Types of Malwares
Spyware - Defence in depth
Malware
- What is defence in depth
Backdoor
Ransomware - Layers
Scareware
- Needs for Defence in depth
Rootkit
Virus - Examples
Trojan horse
- Host encryption
1,2, 1,2, Worms
3 3 1 3
3 3 Symptoms of attack - Anti-virus
- Firewall
Methods of Infiltration
Social Engineering - E-Mail gateway
Pretexting
- Password management
Tailgating
Something for something (quid - Honeypot
pro quo)
- Multi Factor Auth
Denial-of-Service and DDoS
Botnet
On the Path attack

Department of Collegiate & Technical Education Bengaluru-560001 Page 39

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

SEO Poisoning
Wi-Fi Password Cracking
Password Attacks
Password spraying
Dictionary attack
Brute force
Password Cracking Times
Rainbow
Traffic interception

Advanced Persistent Threats

Security Vulnerability and Exploits
Hardware Vulnerabilities
Meltdown and Spectre
Software Vulnerabilities
Categorizing Software
Vulnerabilities
Software updates
Data Maintenance
Using free tools
Back Up Your Data
How Do You Delete Your Data
Permanently? Protecting Your Computing Devices
Tools
turn the firewall on
Who owns your data?
Terms of service install antivirus and antispyware
1,2, 1,2,
4 Understand the term; what are you 2 1 1 3
3 3 manage your operating system and
agreeing to?
The data use policy browser
Privacy settings
set up password protection.
Before you sign up protect your data
Activity: Check terms of service of the
popular application you use on your phone and
check their data sharing policy, access to device
etc.

Department of Collegiate & Technical Education Bengaluru-560001 Page 40

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Safeguarding Your Online Privacy

Two Factor Authentication
Open Authorization
Social Sharing
Email and Web Browser Privacy
Activity: Discover your own risky online
behaviour
Scenario 1: posting private info on
social media
Scenario 2: What password you choose
when creating new account for social service
Scenario 3: Using public Wi-Fi
- Scenario 4: Using trial version of the
software
Activity: Check if your password is
compromised
Note :Use Have I been pwned
-

5 Developmental Assessment Assessment Review and corrective action 3

2,3, class: Cyber security at workplace
1,2 6 2 3 Weekly Assignment(1PM-2PM)
4
Reference materials : skillsforall.com – Introduction to Cyber security
Why Do We Need a Version Control System?
Peer review Fundamentals of Git
1,2, 2,3, Project / activity Git installation and setup
2 1 4 1 2
3,4 4
Propose problem statement basic local Git operations
▪ creating a repository,

Department of Collegiate & Technical Education Bengaluru-560001 Page 41

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

▪ cloning a repository,
▪ making and recording changes
▪ staging and committing changes,
▪ viewing the history of all the changes
undoing changes
History of cryptography (overview: Caesar Algebra: groups, rings, fields - definitions +
cipher, enigma cipher) examples
Introduction (high level overview only) AES (SPN structure, rounds, modes of operation
2,3, Enc (sym - stream + block ciphers, asym) 2 2 - high level overview with diagram)
2,3 2 1 2
4
Hashing MAC + SHA2/3 (high level + security
Digital signature, MAC requirements))
- PRNG

RSA (with numerical examples) Number theory - primes, modular arithmetic,

2,3, 2 2
2,3 3 1 2
4 Digital signature (RSA) gcd, Euler totient function - definitions +
examples
Practice sessions/ student activities:
Practice sessions/ student activities:
Inspect digital certificates using a web browser
- Numerical/programming exercises: subset of
and visiting popular websites
math / Caesar cipher / one time pad / RSA /
2,3, - Identify the crypto algorithms in TLS
2,3 4 1 3 3
4 GCD / primality
- Design a toy crypto algorithm like key
Cryptanalysis (brute force over keys, birthday
generation + encryption + decryption / digital
attacks on hash functions, hardness of
signature / hash function

Department of Collegiate & Technical Education Bengaluru-560001 Page 42

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

factoring integers, discrete log problem, side-

channel attacks – high level overview)

Applied crypto (PKI, Full disk encryption,

blockchain: overview

5 Developmental Assessment Assessment Review and corrective action 3

Industrial class : Application of
6 2 3 Weekly Assignment
cryptography
References :

• https://www.youtube.com/user/Computerphile - YouTube channel by Dr. Mike Pound

• https://nptel.ac.in/courses/106105031/ : Cryptography and Network Security by Prof. Debdeep Mukhopadhyay, IIT Kharagpur

• https://www.coursera.org/learn/crypto and https://www.coursera.org/learn/crypto2 : by Prof. Dan Boneh, Stanford University

• http://williamstallings.com/Cryptography/ - student resources by Prof. William Stallings

How Internet/Application works (Security
Peer review aspects – end-to-end packet path)
Project / activity
2,3, Propose problem statement and network Network architecture concepts
3 1,4 1 4 3
4
design requirements Understanding vulnerabilities in different OSI
layers and protocols (TCP, UDP, IP, ICMP)

Department of Collegiate & Technical Education Bengaluru-560001 Page 43

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Network Security : Concepts- Firewall, IDS, IPS, Protocols : IPSec, SSL, TLS (versions and
2,3,
1,5 2 2 2 1 2
4 VPN vulnerabilities)

Web Security : Concepts-HTTP, HTML, Frames, Attacks and vulnerabilities: Injection attacks :
1,5 1,4 3 2 2 SQL, HTTP header, OS command 1 2
browser design

o Wireless Security : Introduction to

- DOS attacks, countermeasures (in
2,3, security issues in cellular networks,
1,5 4 2 2 1 2
4 relation to wireless networks)
WIFI, LAN systems, RFID systems

5 CIE 1 : Written and practice test Assessment Review and corrective action 3
Industrial class : High availability and load
2,3,
2,3 6 2 3 Weekly Assignment
4 balancing
References :
1. https://www.cisco.com/c/en_in/products/security/what-is-network-security.html
2. https://purplesec.us/firewall-penetration-testing/
3. How hackers do it: Tricks, Tools, and Techniques
4. https://cse29-iiith.vlabs.ac.in/
5. https://nptel.ac.in/courses/106105031/ : Cryptography and Network Security by Prof. Debdeep Mukhopadhyay, IIT Kharagpur.
6. https://wiki.apnictraining.net/netsec-20220627-bdnog14/agenda
Windows Security
Peer review Windows Security Infrastructure
2,3, 2,3, 1 Project status review Windows Family of Products
4 4 2 1
5 4
Demonstration of artifacts of the project Windows Workgroups and Accounts
Windows Active Directory and Group Policy

Department of Collegiate & Technical Education Bengaluru-560001 Page 44

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Windows Access Controls

Windows as a Service NTFS Permissions

Shared Folder Permissions
End of Support
Servicing Channels Registry Key Permissions
Windows Update Active Directory Permissions
1,2, 2,3,
2 Windows Server Update Services 2 2 1 2
3,5 4 Privileges
Windows Autopilot
Windows Virtual Desktop BitLocker Drive Encryption
Third-Party Patch Management Secure Boot
Practice : Process observation and analysis - Practice : NTFS file system practical
with Process Hacker using NTFS Permissions Reporter
Enforcing Security Policy Linux Security
Applying Security Templates Linux Fundamentals
Employing the Security Configuration and Operating System Comparison
Analysis Snap-in Linux Vulnerabilities
Understanding Local Group Policy Objects Linux Operating System
Understanding Domain Group Policy Objects Shell
1,2, 2,3, Administrative Users Kernel
3 2 2 1 2
3,5 4
Privileged Account Management Filesystem
Reduction of Administrative Privileges Linux Unified Key Setup
AppLocker Linux Security Permissions
User Account Control Linux User Accounts
Windows Firewall Pluggable Authentication Modules
IPsec Authentication and Encryption Built-in Command-Line Capability

Department of Collegiate & Technical Education Bengaluru-560001 Page 45

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Remote Desktop Services Service Hardening

Recommended GPO Settings. Package Management
Practice :
Auditing and enforcement of system baseline
configurations with security templates
PowerShell scripting and automation
techniques

Linux Security Enhancements and

Log Files
Infrastructure
○ Key Log Files
Operating System Enhancements
○ Syslog
○ SE Linux
○ Syslog Security
○ App Armor
○ Log Rotation
1,2, 2,3, Linux Hardening
4 2 2 1 2
3,5 4 ○ Centralized
○ Address Space Layout Randomization
○ Logging
○ Kernel Module Security
○ Audit id
○ SSH Hardening
○ Firewalls: Network and Endpoint
○ Open SCAP
○ Rootkit Detection
○ CIS Hardening Guides and Utilities
Development Assessment
5 (Hardening the image win and linux Assessment Review and corrective action 3
CIS controls)
1,2, 2,3, Industrial Class : System Security
6 2 3 Weekly Assignment
3,5 4
1,2, Peer review Introduction to Application Security
2,3,
5 3,4, 1 4 2 1
4 Project status review Secure SDLC
5

Department of Collegiate & Technical Education Bengaluru-560001 Page 46

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Introduction to Software Application Provide a use case – Microsoft Secure SDLC

Development – How was it created, Why is it Practice and Security controls covered in each
important? How does it work. stage at a higher level.
Types of Application Software – Thick Client, Requirements (Determine Application Risk
Web Applications, Web Services, RESTFul Profile based on Security Requirements,
Services, Middle Ware, Mobile Applications etc Determine Control Requirements, Establish
(Give an example of each). Quality Gates)
Explain Software Development Lifecycle – b. Design (Architecture Design Review and
Requirements, Design, Develop, Deploy, Threat Modeling)
Operate and Purge. c. Implementation (Static Analysis, Software
Life Cycle Models – Waterfall, Agile, Iterative Composition Analysis, Secret Detection,
etc. Deprecate unsafe functions, use of plugins in
SDLC Best Practices IDE, Safe Commit and Change Management in
Repositories)
d. Verification (Dynamic Analysis, Interactive
Application Security Testing, Fuzz Testing,
Abuse use case Testing, Architecture
Verification).
e. Release (Run Time Application Self
Protection, Web Application Firewall, SOP for
Operations, Secure Provisioning, Deployment
and De commissioning)
- f. Response (Incident Response).

Department of Collegiate & Technical Education Bengaluru-560001 Page 47

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Application Security – Requirements

1. Functional and Non Functional

Requirements for an application

2. Security Requirements for an

Application Security Design:
application
Secure Architecture Review – For a given use
1,3, 2,3, case, with examples; conduct security
2 3. Determining Application Risk Profile 1 3 1 2
4,5 4
architecture review using the OWASP standard.
Based on the security requirements.

4. Determining Control Requirements

Based on Application Risk Profile and
Eligibility Criteria for an application to
undergo a certain security control.
Establish Security Toll Gates
Application Security Design – Threat Modelling.
1. Why Threat Modelling
2. What is Threat Modelling
- Using the Microsoft Threat Modeling
3. Threat Modelling Methodologies –
methodology, execute a threat model for
1,3, 2,3, 3 STRIDE, PASTA, OCTAVE, TRIKE, VAST. 1 3 3
4,5 4 a given application architecture using
4. Threat Model Ranking – DREAD, CVSS,
Microsoft threat modeling tool.
CWSS etc.
Threat Model Execution Phases: - Planning,
Scoping, Deep Dive Discussions, Drawing a

Department of Collegiate & Technical Education Bengaluru-560001 Page 48

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Threat Model, Identifying Threats, Threat

Objects, Security Controls, Threat Actors,
Threat Traceability Matrix, Reporting and
Debrief.
Application Security – Implementation
- Explain use of Security Tools within Explain Secret Detection using tools like
IDE. Githound.
- Static Code Analysis Tools – Explain - Change Management during pre-commit
with examples. and post-commit in repositories.
1,3, 2,3,
4 1 3 3
4,5 4 - Explain Software Composition - Safe SCM practices (Take Github as an
Analysis, Identifying Software example).
Dependencies and CVE in underlying - Highlight deprecated unsafe functions in
libraries. Demonstrate a tool like common programming languages.
OWASP Dependency Check.

5 CIE 2 – Written and Practice Test Assessment Review and corrective action 3
1,2, Industrial class : Source Code Scan using a
2,3,
3,4, 6 commercial tool like Microfocus Fortify or 2 3 Weekly Assignment
4
5 Checkmarz.
Application Security – Verification.

Peer review
Explain Dynamic Analysis using an example –
1,2, 2,3, Project status review
6 1 4 3
3,5 4 owasp zap.
Interactive Application Security Testing –
Demonstrate using Contrast Security Tool.

Department of Collegiate & Technical Education Bengaluru-560001 Page 49

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

- For a given site (local), conduct a dynamic Introduce Manual Security Testing using OWASP
2,3, 2,3, analysis scan using OWASP ZAP, Check for Testing Guide. Add Misuse case testing to the
2 4 1 2
5 4
False positives and create a report framework in addition
Conduct a manual security testing for a local
web application or an API using proxy tools
like burp suite/paros etc and provide a
report. Compare the results of both manual
and automated scans.
Application Security – Release
- 1. Cover OWASP ASVS and its aid as a tool
1. Explain Run Time Application Self in architecture verification.
2,3, 2,3,
3 1 3 Introduce OWASP SAMM – to attain software 1 2
5 4 Protection – Contrast Security or Microfocus
Fortify Software can be used as an example. assurance maturity.

2. Define Web Application Firewall.

Demonstrate using a tool.
Elaborate on Standard Operating Procedure
for Operations, Secure Provisioning,
deployment and decommissioning
Measurement of Application Security –
Define Metrics, Type of Metrics (Operations,
For the previous run scans, define metrics and
2,3, 2,3, Efficiency, Quality etc).
4 1 3 evaluate the values at operational level. 3
5 4
Example Application Security Metrics from
OWASP.

Department of Collegiate & Technical Education Bengaluru-560001 Page 50

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

5 Development assessment Assessment Review and corrective action 3

Weekly Assignment
Weekly Assignment (Suggestive Student
Activities)

1. Install Web Goat and do an automated

Industrial class : Dynamic Analysis using scan using one of the dynamic analysis tools.
2,3, 2,3,
6
5 4 Qualys
2. Follow up with a manual security testing
with OWASP Testing guide as an aid and
compare the results of automated and
dynamic scan.

References:
1. https://www.synopsys.com/glossary/what-is-sdlc.html
2. https://www.synopsys.com/blogs/software-security/secure-sdlc/
3. https://www.microsoft.com/en-us/securityengineering/sdl
4. https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling
5. https://www.microsoft.com/en-in/download/details.aspx?id=49168
6. https://medium.com/@melsatar/software-development-life-cycle-models-and-methodologies-297cfe616a3a
7. https://owasp.org/www-project-application-security-verification-standard/
8. https://resources.infosecinstitute.com/topic/application-architecture-review/
9. https://owasp.org/www-community/controls/Static_Code_Analysis
10. https://owasp.org/www-project-web-security-testing-guide/
11. https://owasp.org/www-project-zap/
12. https://owasp.org/www-project-dependency-check/
13. https://www.synopsys.com/glossary/what-is-software-composition-analysis.html
14. https://owasp.org/www-project-samm/
15. https://github.com/tillson/git-hound
16. https://owasp.org/www-project-security-qualitative-metrics/
17. https://www.qualys.com/apps/web-app-scanning/
18. https://www.veracode.com/security/interactive-application-security-testing-iast
19. https://en.wikipedia.org/wiki/Runtime_application_self-protection
20. https://en.wikipedia.org/wiki/ModSecurity
Department of Collegiate & Technical Education Bengaluru-560001 Page 51
 Diploma in Cyber physical system & Security C 20 : 2020 - 21

21. https://github.com/WebGoat/WebGoat
22. https://spectralops.io/resources/how-to-choose-a-secret-scanning-solution-to-protect-credentials-in-your-code/
23. https://www.geeksforgeeks.org/functional-vs-non-functional-requirements/
24. https://owaspsamm.org/model/design/threat-assessment/stream-a/
25. https://docs.42crunch.com/latest/content/concepts/security_quality_gates.htm
Basics of cloud computing
Why is cloud computing necessary?
Introduction to key cloud services (Compute,
storage, networking)
Cloud delivery models
IaaS v/s PaaS v/s SaaS
Introduction to cloud vendors(Azure,AWS, GCP)
Peer review
Key Cloud Security Principles
1,3, 2,3, Project status review
1 4 3
4 4 Shared responsibility model
Principle of least privilege
7
Defense in depth
Threat actors, diagrams & trust boundaries
Practice :
Create a cloud account
Create 2 accounts
Setup 2Factor Authentication on both account
Identity & Access management in the cloud
Introduction to IAM
1,3, 2,3, Cloud asset management
2 1 3 3
4 4 Introduction to Federal Identity Management
IAM Best Practices

Department of Collegiate & Technical Education Bengaluru-560001 Page 52

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

IAM Audit
Intro to AWS/Azure clint and Web Portal
Vulnerability management
Network security
Discovering cloud misconfiguration
Security groups
2,3, Remediating vulnerabilities
3,4 3 1 3 1 2
4 VPC
Tracking open vulnerabilities using cloud
WAF
native tools
Data protection in the cloud
Incident response
• Data protection at rest and at transit
- Log analysis
2,3, • Cloud data storage - AWS EBS, S3 / Azure
3,4 4 1 3 3
4 - Events & alerts
SAS
- Key metrics (MTTD & MTTR)
• Secrets Management
CIE 3 – Written and Practice Test
5 Assessment Review and corrective action 3
Secure a vulnerable cloud env
Industrial class :
2,3, 1. Preventing DDoS in a cloud native
3,4 6 env 2 3 Weekly Assignment
4
Hybrid cloud env
Intro to VAPT
Developing a Hacker Mindset
• Ethics of Penetration Testing
Peer review
1,3, 2,3, • Goal of Penetration Testing
8 1 Project status review 4 1 2
4,5 4 • Thinking like a Hacker
• ATT&CK Framework Overview
• Introduction to the framework
• Deep dive into the key topics

Department of Collegiate & Technical Education Bengaluru-560001 Page 53

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

○ Reconnaissance
○ Initial Access
○ Privilege Escalation
○ Lateral Movement
○ Exfiltration
Web Application Penetration Testing
Web Application Penetration Testing
• Finding common web vulnerabilities (OWASP
• Basics of Web
top 10)
1,3, 2,3, o HTTP Methods
2 4 • Burp Suite Essentials
3
4,5 4
o HTTP Requests & Response
Practical:Setup Burp Suite on local machine and
o Session management & Cookies
observe traffic of 1 website..
Cloud Penetration Testing Introduction to OSINT:
• Finding common cloud vulnerabilities • Scanning the internet (example: Shodan)
1,3, 2,3, 4
3 • Google dorking
3
4,5 4 • Introduction to tools: Nessus, NMAP,
Prowler • Subdomain enumeration & asset monitoring
Hands-on exercise 1: Complete 3 server-side and 3
client-side topic from Burp Suite academy:
1,3, 2,3, Hands-on exercise 2: Complete either the
4 1 3 1 2
4,5 4 https://portswigger.net/web-security/learning- attacker or defender track in http://flaws2.cloud
path

5 Developmental Assessment Assessment Review and corrective action 3

Industrial class :
How penetration testing is used in
1,3, 2,3,
6 Weekly Assignment
4,5 4 companies to improve their Security
posture

Department of Collegiate & Technical Education Bengaluru-560001 Page 54

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Mobile Application Security Testing

Peer review o Basics of Mobile Application
1,3, 2,3, o Introduction to Android Mobile OS
1 Project status review 4 1 2
4,5 4 o Understanding Android Security
Architecture
o Introduction to iOS Mobile OS
o Understanding iOS Security Architecture

Setting up the environment:

• Installing Android Studio

Understanding Android Application security
• Installing Geny Motion Emulator (Free)
• Reversing Android Application • Creating Android Virtual Devices
9 Package • Using Android Debug Bridge (ADB) to
1,3, 2,3, • Analysing Android Application interact with the Android Virtual Devices
2 1 3 1 2
4,5 4, 7 Certificates and Signatures (AVD)
• Verifying Android Application • Transferring files between Host machine
Signatures and AVD using ADB
• Analysing the Android Manifest file
• Installing Android Applications onto AVD
via ADB

Setup the following tools onto your machine

Mobile Application Security Testing
and reverse the application on the DIVA
1,3, 2,3, ● Introduction to Mobile OWASP Top 10
3 4 1 2
4,5 4, 7 Android application. ● Burp Suite/OWASP Zap for Mobile
Applications
- Apktool

Department of Collegiate & Technical Education Bengaluru-560001 Page 55

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

- Dex2Jar
- JDGUI

Setting up for Android Application Security

Testing

Install DIVA Android Application

(https://github.com/payatu/diva-android)
Exercise: Setup MobSF locally on your system and
1,3, 2,3, ● Mobile Security Exploitation
4 1 3 1 2
4,5 4 ● Exploiting Insecure Data Storage scan any 5 Android Applications.
● Exploiting Insecure Cryptographic
Implementations
● Exploiting Data Leakage
Vulnerabilities

5 CIE 4 – Written and Practice Test Assessment Review and corrective action 3
Industrial class :
1,3, 2,3,
6 Weekly Assignment
4,5 4 Bug bounty hunting
References :
1. Basics of Web: https://www.hacker101.com/sessions/web_in_depth.html
2. NMAP Basics: https://www.freecodecamp.org/news/what-is-nmap-and-how-to-use-it-a-tutorial-for-the-greatest-scanning-tool-of-all-
time/
3. HTTP Proxy:
a. Burp Suite Essentials: https://www.youtube.com/playlist?list=PLoX0sUafNGbH9bmbIANk3D50FNUmuJIF3\
b. OWASP Zed Attack Proxy: https://www.zaproxy.org/getting-started/
4. Vulnerability Scanning with Nessus: https://www.tenable.com/blog/how-to-run-your-first-vulnerability-scan-with-nessus

Department of Collegiate & Technical Education Bengaluru-560001 Page 56

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

5. How to think like a Hacker: https://www.darkreading.com/vulnerabilities-threats/how-to-think-like-a-hacker

The Cuckoo’s egg (book)
Incident management introduction and
objectives
Stages and life cycle of incident management
Tracking incidents
Peer review Incident remediation
2,3, Project status review Reporting and documentation
3,4 1 4 1 2
4, 7
Incident Closure
Incident management teams and models
Incident management services and integration
tools
- Best practices of Incident Management
10
Fundamentals Network
· CIA · Quick revision of OSI model,
· Threat Actors
· Different kinds of hackers encapsulation, IP, Subnets, TCP/UDP, well
· Different kinds of teams – Blue, Red, known ports, TCP/IP, Layer 2
Purple
· Criminal Groups Network Protocols
2,3, · Hactivist Groups · Quick revision of SMTP, HTTP,
3,4 2 1 3 1 2
4, 7 · APT
· Attack Vectors HTRPS/TLS, DNS
· Protect/Prevent Web technologies
· Detect/Respond
· Trust Positive vs False Positive · Quick revision of DOM, CSS, Javascript,
Ajax, MVC, Databases, SQL
Data
· Bits and Bytes Authentical protocols

Department of Collegiate & Technical Education Bengaluru-560001 Page 57

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

· Charter Encoding (ASCII, UTF- · Quick revision of Kerberos, SAML,

8,Base64)
OpenID, OAuth
· File Magic Bytes, Hashes
· Imphash
· Ssdeep

Windows & Linux

- · Quick revision on basic commands,
important files and directories, windows
registry and processes, Audit in Linux
Understanding the tools and products used in
any organization
· Firewall, load balancers, proxy, email
infrastructure, IDS, DNS, Ani-virus, Content
2,3, Continued..
3,4 3 1 3 3
4 Delivery Solutions, Malware Protection System,
Endpoint Detection and Response, Network
Access Control, Placement of all devices in the
organization – Tier1, Tier 2, Tier 3, DMZ
SIEM Basics of Incident Response
· Understanding logs · Alert processing
· Email, Proxy, DNS, IDS, Firewall, AV, · Procedures, runbooks and reference
EDR, Web application, Unix, Windows · Response options
2,3, Attack Types/Vectors · Escalations
3,4 4 1 3 3
4
· Phishing, Malware, Distributed Denial · Incident categories
of Service, Vulnerabilities (Infrastructure, · Incident Resolution Codes
Application, third party), Web attacks,
Misconfigurations, Brute force Data Analysis

Department of Collegiate & Technical Education Bengaluru-560001 Page 58

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Attack Models · Data vs Intelligence

· The cyber kill chain, MITRE ATT&CK · Indicators of compromise (IoCs)
Framework, Pyramid of Pain · Malware analysis
· Accessing IoCs
· Contacting threat intelligence

Analysis tools
· Anomaly
· Domain tools
· WhoIS
· Passive DNS
· Virus total
· Dynamic File analysis

5 Developmental Assessment Assessment Review and corrective action 3

Industrial class : Handling Internal and
external incidents Complexity of Incident
2,3,
3,4 6 Weekly Assignment
4, 7 management
Demo of real world SOC
References :
1. https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf

2. https://www.cisa.gov/uscert/bsi/articles/best-practices/incident-management
https://www.infotech.com/research/ss/develop-and-implement-a-security-incident-management-program

Lab : https://letsdefend.io

Department of Collegiate & Technical Education Bengaluru-560001 Page 59

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

GRC
(a) 1) Definition of GRC, introduction to IT
governance
(b) 2) Importance of GRC in cyber security
(c) 3) Policies, processes and procedures
Peer review (d) 4) Importance of checklists, templates and
3,4, 2,3, Project status review 4 guidelines
1 1 2
5 4
Enterprise risk management
(a) Understanding risks that enterprises face –
Operational Risks, Strategy Risks, Credit risks,
Reputational risk, Market risks, Cyber risk
11 (b) Cyber risk integration with Operational risk
management
Patch management
- Introduction to basics of risk management
Probability, Impact:-- [Financial, Legal, Importance of patch management; pre-requisites
Regulatory, Reputational ], Threat, Risk and sample patch management process
Assessment, Risk Treatment:-- [Accept,
3,4, 2,3, 1 3 Vulnerability Management
2 1 2
5 4, 7 Mitigate, Transfer, Avoid ], Residual risk, risk
acceptance, Control objective, Controls:-- Vulnerability management lifecycle
Preventive control, detective control and understanding – Identify, Evaluate, Remediate,
corrective control Report

Department of Collegiate & Technical Education Bengaluru-560001 Page 60

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Types of vulnerabilities – Hardware, Network,

Operating systems, Application, Human and
Process related vulnerabilities

Vulnerability Management process

Practice Session:

(a) Define one control statement each for

access control, physical security and
backup management ITIL Process overview –
Incident Management, Problem Management,
(b) Explain one human vulnerability with Change Management, Configuration
example and how it can be exploited Management, Release Management, Supplier
3,4, 2,3, 4
3 including remedial measures 3
5 4, 7 Management, IT Security Management, Service
level management, Capacity Management,
(c) Design IT asset register template with
Availability Management, Service continuity
5 sample rows populated with data
Management
Give examples for each category of classified
information in an organization – do a
combination of government organization and
private organisation

4 Security frameworks and Compliances 4 Cyber Security Governance: 1 2

Department of Collegiate & Technical Education Bengaluru-560001 Page 61

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Introduction to standards/best (a) Security organization, Responsibilities

practices/framework and its primary and authority, Management/Board
objective, responsibilities on cyber security,
Resource allocation and cyber security budget
ISO 27001, COBIT, PCI-DSS, Hi-Tech (HIPAA),
management, Security Education, training and
NIST, IT Act 2000 (amendment in 2008), CERT-
awareness, Cyber metrics, KRI/KPIs
IN Guidelines.

Regulatory requirements

(a) RBI framework for banking (Cyber

security framework, Gopalakrishna
committee, UCB tiered framework)

(b) SEBI framework for Securities market

(c) Guidelines on Information and cyber

security for insurers from IRDAI

(d) TRAI requirements on security for

telecom sector

(e) GDPR

5 CIE 5 – Written and Practice Test Assessment Review and corrective action 3

Department of Collegiate & Technical Education Bengaluru-560001 Page 62

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Weekly Assignment (Suggestive Student

Activities)

(a) Identify use case of how changes or

configuration in IT systems impacts security
configuration resulting in cyber risk
Industrial class :
exposure
1. An industry perspective of GRC, VM
2,3,
3,4 6
4,7 and Security frameworks (b) Design a sample cyber security
Demo of a GRC tool dashboard for reporting to top management

(c) Give two KRI examples each for the

following domains:
a. Patch Management
b. Anti-virus management
c. Change Management
References :
1) https://www.armosec.io/blog/kubernetes-security-frameworks-and-guidance - Security Frameworks table
2) https://www.cybersaint.io/blog/what-is-grc
3) https://www.ibm.com/cloud/learn/grc
4) https://unece.org/fileadmin/DAM/trade/Publications/WP6_ECE_TRADE_390.pdf

5) https://www.pcisecuritystandards.org/documents/PCI_DSS-QRG-v3_2_1.pdf

Department of Collegiate & Technical Education Bengaluru-560001 Page 63

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

6) https://www.nist.gov/

7) https://www.isaca.org/resources/cobit

8) https://www.meity.gov.in/writereaddata/files/itact2000/it_amendment_act2008.pdf

9) https://www.coso.org/SitePages/Guidance-on-Enterprise-Risk-Management.aspx?web=1

10) https://rbidocs.rbi.org.in/rdocs/notification/PDFs/NT41893F697BC1D57443BB76AFC7AB56272EB.PDF

11) https://rbidocs.rbi.org.in/rdocs/notification/PDFs/LBS300411F.pdf

1) https://rbidocs.rbi.org.in/rdocs/notification/PDFs/NOTI129BB26DEA3F5C54198BF24774E1222E61A.PDF

14) https://www.sebi.gov.in/legal/circulars/dec-2018/cyber-security-and-cyber-resilience-framework-for-stock-brokers-depository-
participants_41215.html

15) https://www.sebi.gov.in/sebiweb/home/HomeAction.do?doListing=yes&sid=1&ssid=6&smid=0

16) https://www.aicofindia.com/AICEng/General_Documents/Notices%20And%20Tenders/IRDAI-GUIDELINES.pdf

17) https://www.irdai.gov.in/ADMINCMS/cms/whatsNew_Layout.aspx?page=PageNo4315&flag=1

18) https://www.rapid7.com/fundamentals/patch-management/

19) https://www.rapid7.com/fundamentals/vulnerability-management-and-scanning/

1)18. https://www.techtarget.com/searchsecurity/tip/IT-security-frameworks-and-standards-Choosing-the-right-one

Department of Collegiate & Technical Education Bengaluru-560001 Page 64

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

21)https://www.irdai.gov.in/ADMINCMS/cms/Uploadedfiles/07.04.2017-
Guidelines%20on%20Information%20and%20Cyber%20Security%20for%20insurers.pdf

https://www.trai.gov.in/sites/default/files/RecommendationDataPrivacy16072018_0.pdf
DevOps and Security Challenges 2
Peer review Understand the Core Principles and Patterns
3,4, 2,3, Project status review 4 behind DevOps
1 1
5 4
Recognize how DevOps works and identify keys
to success
Secure DevOps tools and workflows 2
Conduct effective risk assessments and threat Pre-Commit Security Controls
modeling in a rapidly changing environment Rapid Risk Assessment
Design and write automated security tests and Git Hook Security
checks in CI/CD Code Editor Extensions
12 Understand the strengths and weaknesses of Branch Protections
3,4, 2,3,
2 1 3 1
5 4 different automated testing approaches in CodeOwners
Continuous Delivery Peer Reviews
Inventory and patch your software Commit Security Controls
dependencies Static Analysis Security Testing
Wire security scanning into Jenkins, Code Component Analysis
Pipeline, and Azure DevOps workflows
3
Secrets Management
3,4, 2,3, Cloud Infrastructure as Code
3 4
5 4
Managing secrets in CI / CD

Department of Collegiate & Technical Education Bengaluru-560001 Page 65

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Azure Key Vault Introduction to Cloud Infrastructure as

AWS SSM Parameter Store Code
AWS Secrets Manager AWS Cloud Formation
HashiCorp Vault Terraform
Deploying
Cloud Infrastructure as Code security analysis
2
Container Security

Dockerfile and BuildKit Security

Base Image Hardening with Hadolint and
Conftest
Container Image Security
Configuration Management as Code Scanning Container Images with Docker
Scan and Trivy
Automating Configuration Management Container Registry Security
in CI / CD Container Scanning with AWS ECR and
3,4, 2,3, Azure ACR
4 Using Ansible to Configure Virtual 1 3 1
5 4 Container Runtime Security
Machines
Building Gold Images with Vagrant and
Exercises
Packer
Certifying Gold Images with InSpec Attacking the DevOps Toolchain
Version Control Security
Automating Static Analysis
Protecting Secrets with Vault
Infrastructure as Code Network
Hardening
Gold Image Creation
Container Security Hardening

Department of Collegiate & Technical Education Bengaluru-560001 Page 66

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

5 Developmental Assessment Assessment Review and corrective action

6 Industry Class : 2 3
Project
Internship
a) Secondary research on various a) Identification of the problem
industries and their operations to identify at statement (from at least 3 known problems)
least 3 companies along with the areas of the students would like to work as part of the
work interest and develop an internship project – either as provided by faculty or as
plan that clearly highlights expectations identified by the student. Document the
from the industry during the internship. impact the project will have from a technical,
b) Design and develop a cover letter for social and business perspective.
13 1 an internship request to all 3 identified
companies and the resume to be submitted b) Design and develop the project
to potential companies. solution or methodology to be used to solve at
c) Prepare for an internship interview to least one of the problems identified.
highlight your interests, areas of study,
career aspirations and personnel c) Prepare a project plan that will include a
competence – including the areas of schedule, WBS, Budget and known risks along
learning you expect to learn during with strategies to mitigate them to ensure the
internship. project achieves the desired outcome.

**Note: Saturday session from 9 AM -2 PM

Department of Collegiate & Technical Education Bengaluru-560001 Page 67

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

CIE and SEE Assessment Methodologies

Duration
CIE Assessment Assessment Mode Max Marks
In hours

Week 3 CIE 1– Written and practice test 4 30

Week 5 CIE 2– Written and practice test 4 30
Week 7 CIE 3– Written and practice test 4 30
Week 9 CIE 4– Written and practice test 4 30
Week 11 CIE 5– Written and practice test 4 30
On line Course work (Minimum 10 hours online course with certification
40
from (SWAYAM/NPTEL/Infosys Springboard)
Profile building for Internship / Submission of Synopsys for project work 20
Portfolio evaluation (Based on industrial assignments and weekly developmental assessment) * 30
TOTAL CIE MARKS (A) 240
SEE 1 - Theory exam (QP from BTE) Conducted for 100 marks 3 hrs duration reduced to 60 marks 3 60
SEE 2 – Practical 3 100
TOTAL SEE MARKS (B) 160
TOTAL MARKS (A+B) 400
* The industrial assignment shall be based on peer-to-peer assessment for a total of 10 marks (on a scale of 1 to 10) and in the event of a group assignment
the marks awarded will be the same for the entire group, the developmental assessment will be for a total of 20 marks and based on MCQ/case
study/demonstration and such other assignment methods

Department of Collegiate & Technical Education Bengaluru-560001 Page 68

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Assessment framework for CIE

Note : Theory to be conducted for 1 hour and practice for 3 hours, total duration of exam – 4 hours
Programme Diploma in Cyber physical system & Security Semester V
Course Cyber Security Max Marks 30
Course Code 20CS54I Duration 4 hours
Name of the course coordinator
Note: Answer one full question from each section.
Qn.No Question CL CO PO Marks
L3/L4
Section-1 (Theory) – 10 marks
1.a) Why do see this kind of “Captcha” in web applications ? What difference does it make to any L4 1 6

web based application ?

b) Your creating new password for your online banking, how will you strengthen your password L4 1 4
elaborate ?
2.a) Let p = 191 and q = 2. Alice picks x = 42 and B picks y = 33. Compute the shared secret L4 1 5
between Alice and Bob using Diffie-Hellman key exchange protocol.
b) Given an implementation of RSA algorithm that uses primes p = 5 and q = 11, if the encryption L4 1 5
key is 27, what is the decryption key?
Section-2 (Practical) - 20 marks
3).a You’ve just been issued with a new laptop at your organization and are getting ready to set it L4 1 10
up. What steps would you take to secure it before use?

Department of Collegiate & Technical Education Bengaluru-560001 Page 69

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Scheme of evaluation

Sl. Description Marks

No
1 Setting up password 5

2 Installing antivirus and fire wall 10

3 Firewall Windows/Linux settings 5

Total 20

b Design a simple crypto system (including key generation, encryption, decryption, digital
signature or hash function) using any tool
Scheme of evaluation

Sl. Description Marks

No
1 Designing crypto system 5

2 Key generation 5

3 Encryption/Decryption 5

4 digital signature or hash function 5

Total 20

Note : Theory questions shall be aligned to practical questions

Department of Collegiate & Technical Education Bengaluru-560001 Page 70

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

Assessment framework for SEE (Theory) – 100 Marks / 3 hours (Reduced to 60 marks)

Programme: Diploma in Cyber physical system & Security Semester: V

Course: Cyber Security Max Marks: 100
Course Code: 20CS54I Duration: 3 Hrs
Instruction to the Candidate:
Answer one full question from each section.

Qn.No Question CL CO Marks

Section-1
1.a) Which is the security protocol applied at layer 3 of the OSI stack? What are its benefits L3/L4 1 10
b) What is the need of defence in depth for a network ? L3/L4 10
2.a) How do you apply Microsoft Secure SDLC in each stage of software development ? L3/L4 12

b) Your creating new password for your online banking, how will you strengthen your password L3/L4 8
elaborate ?
Section-2
3.a) Let p = 191 and q = 2. Alice picks x = 42 and B picks y = 33. Compute the shared secret between L3/L4 2 14
Alice and Bob using Diffie-Hellman key exchange protocol.

b) Find Euler totient function: φ(255), φ(256) L3/L4 6

4.a) Given an implementation of RSA algorithm that uses primes p = 5 and q = 11, if the encryption key L3/L4 12
is 27, what is the decryption key?
b) What is the final digit and two final digits of 310000? L3/L4 8
Section- 3
5.a) Describe Stages and life cycle of incident management L3/L4 3 12
b) What is the need of Dynamic File analysis ? L3/L4 8

6.a) Create a Threat Model for a social media Web Application at Design Time L3/L4 10

Department of Collegiate & Technical Education Bengaluru-560001 Page 71

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

b) Describe shared responsibility model in cloud L3/L4 10

Section-4
7.a) How do you find vulnerability in your cloud based web application ? what are the common L4 4 12
vulnerabilities ?
b) Illustrate setting up multi factor authentication on any public cloud system L3 8

8.a) Highlight deprecated unsafe functions in common programming languages L4 10

b) What is the need of static code analysis, Static Code Analysis Tools – Explain with examples L4 10

Section-5
9.a) Illustrate lifecycles of security incident management L3 5 8
b) Design a sample cyber security dashboard for reporting to top management L4 12
Identify use case of how changes or configuration in IT systems impacts security configuration L4 12
10.a)
resulting in cyber risk exposure
Give two KRI examples each for the following domains: L4 8
b) a. Patch Management
b. Anti-virus management

Assessment framework for SEE 2 (Practice)

Problem Statement : Conduct Penetration testing on any web site/web application and report the vulnerabilities

Scheme of Evaluation
1 ) Installing ZAP 20
2 ) Running an automated scan 20
3 ) Exploring the application manually
1. Explore pages protected by login 30
2. Exploring web application over a defined sequence
4 ) Prepare a vulnerability report 20

Department of Collegiate & Technical Education Bengaluru-560001 Page 72

 Diploma in Cyber physical system & Security C 20 : 2020 - 21

5) Viva-voce ( about the attack on discovered vulnerability and possible solutions) 10

Total 100
Note: Examiner to prepare/identify the web site/application to be tested and the vulnerabilities present in the web site/web
application before exam

Equipment/software list with Specification for a batch of 20 students

Sl. No. Particulars Specification Quantity

6. Intel i5, 4GB RAM,
Computers 20
500GB SSD
7.
Cloud – AWS/AZURE/GCP or any similar public cloud environment 20
8.
Broadband connection Atleast 50MBPS 1

Department of Collegiate & Technical Education Bengaluru-560001 Page 73