CSE392/ISE331: Fundamentals of Computer Security (Spring 2015)

CSE392/ISE331: Fundamentals of Computer Security (Spring 2015)

Course description:

The course will introduce the concepts and terminology of computer security. It will cover main security topics such as basic cryptography, operating systems security, network security, and language-based security.

We are not using any specific textbook 100%. However, a main reference I plan on using is Security Engineering by Ross Anderson.

Further references:

Free: Handbook of Applied Cryptography by Alfred J. Menezes, Paul C. van Oorschot and Scott A. Vanstone
Practical Cryptography by Niels Ferguson and Bruce Schneier is a nice and easy introduction to security
Applied Cryptography (Second Edition) by Bruce Schneier
Free: Hardcore crypto fans take a look at this
Free: Crypto Class at Stanford
This is a great (still) reference on firewalls: Firewalls and Internet Security: Repelling the Wily Hacker, First Edition, William R. Cheswick and Steven M. Bellovin
http://www.cryptool.org/ - a free e-learning application that you can use to apply and analyze cryptographic algorithms
http://thehackernews.com

Times: 10:00-11:20 TUTH
Place: Computer Science 2129
TA Contact Info: rpelizzi @ cs (Riccardo Pelizzi)
TA Office Hours: 13:00-14:00 MON and TUE (CSE 2321)
Prof. Office Hours: 11:20-13:00 TUE (CSE 1210), additional times by email appointment
Prof. Contact Info: sion @ cs

Evaluation and Schedule (this is orientative and these are subject to change): 0-4 written homeworks, a midterm and a final. Grading criteria (subject to minor changes): midterm evaluation (30-40%), final (40-50%), homeworks (0-10%), activity and quizzes (0-10%). I expect you to mostly come to class.

Approximate summary of lectures:

02/05	Introduction: What is security ? What isn't security ? Security by obscurity. View: The pleasure of finding things out - RP Feynman Read: Current Cryptogram Slides: class01 Reference: Chapter 1
02/10	Crypto: Crypto-hashes. Encryption Read: Encryption, Ciphers, crypto hashes Slides: class02 Reference: Chapter 5
02/12	Crypto: Key Exchange, Public key cryptography Read: Diffie Hellman, forward secrecy Read: discrete logarithm (read entries in section Algorithms also) Slides: class02 Reference: Chapter 5
02/17	Crypto: PKI, Randomness Read: PKI, Certificate Authority, RNG Slides: class03 Reference: Chapter 5
02/19	Crypto: More PKI Read: Current Cryptogram Read: Breaking News: Lenovo Caught Installing Adware on New Computers and Compromising their certification ability!!! Slides: class03 Reference: Chapter 5
02/24	Crypto: Cipher Modes Read: EFF: How Secure is HTTPS today?, TLS Slides: class04 Reference: Chapter 5
02/26	Passwords, Ciphers continued Read: Passwords Slides: class05 Reference: Chapter 2
03/03	Passwords (continued) Read: Two Factor Authentication Slides: class05 Reference: Chapter 2
03/10	Midterm Prep and Recap
03/12	Midterm: in class
03/17	Spring Break
03/19	Spring Break
03/24	Malware Read: Malware Read: Current Cryptogram Slides: class06 Reference: Chapter 21
03/26	Malware Watch: Stuxnet: Deep Dive Slides: class06 Reference: Chapter 21
03/31	Access Control Slides: class07 Reference: Chapter 4
04/02	Access Control Slides: class07 Reference: Chapter 4
04/07	Software Security: Buffer Overflows, Memory Exploits Slides: class08 Reference: Chapter 4
04/09	Virtualization, Sandboxing Read: virtualization, sandboxie: how it works Reference: Chapter 4 Slides: class09
04/14	Web Browser Security (invited lecture: Prof. Nick Nikiforakis) References: HTTP, cookies! Slides: class10.nick
04/16	Web Browser Attacks (invited lecture: Prof. Nick Nikiforakis) References: Cross-site scripting, some examples Slides: class11.nick
04/21	Intrusion Detection Read: Current Cryptogram Reference: Chapter 21 Slides: class12, notes
04/23	Trusted Computing, Trusted Hardware, TPMs Read: Trusted Computing Slides: hardware_tut_short02b
04/28	Remote Attestation, TPMs Read: Remote Attestation Slides: hardware_tut_short02b
04/30	Smart Cards, Cloud Computing Security Read: Cloud Computing Slides: Hey, You, Get Off of My Cloud! Exploring Information Leakage in Third-Party Clouds, Cross-VM Side Channels and Their Use to Extract Private Keys
05/05	Encryption File Systems, OS Scheduling and VM Introspection etc. Read: Context Switch Explained Slides: class14
05/07	Recap
05/15	Final Exam starting at 11:15am (location: in class unless otherwise posted)

Policy on seeing graded Exams/Homeworks: You can request to see a graded exam/homework only up to two weeks after it was graded. You should not come for re-grades at the end of the semester for homeworks graded in the beginning of the semester.

Policy on Missing Exams or Homeworks: Missing an exam/homework/project implies a grade of zero in that exam/homework/project, unless there is a properly documented reason (e.g., medical with documentation). Examples of non-valid reasons include oversleeping, forgetting, discretionary travel (travel whose timing is under your control, such as an interview trip), and a host of others. Such policy precedents are difficult for an instructor to deviate from without running the risk of being accused of "treating people unequally" ... etc, so I hope none of you will put me in that situation.

Ethics:

"Each student must pursue his or her academic goals honestly and be personally accountable for all submitted work. Representing another person's work as your own is always wrong. Any suspected instance of academic dishonesty will be reported to the Academic Judiciary. For more comprehensive information on academic integrity, including categories of academic dishonesty, please refer to the academic judiciary website."
Note: If you have a physical, psychological, medical or learning disability that may impact on your ability to carry out assigned course work, please contact the staff in the Disabled Student Services office (DSS), Room 133, Humanities, 632-6748v/TDD. DSS will review your concerns and determine with you what accommodations are necessary and appropriate. All information and documentation of disability are confidential.