CS 675 - Secure Computer Systems

Course Overview:

Instructor:

Dr. Sven Dietrich (spock AT cs DOT stevens DOT edu)
Office hours: Tuesdays before class, and by appointment. Babbio 635.



Prerequisites:


• CS 520.  CS 579
• or permission of the instructor



Textbook:


Matt Bishop
Computer Security: Art and Science
Addison-Wesley Publishing
2002
Book web page and errata: http://nob.cs.ucdavis.edu/book/book-aands/index.html


Other recommended books:


“Applied Cryptography,” by Bruce Schneier.

“Cryptography and Network Security,” by William Stallings.

“Firewalls and Internet Security,” by William Cheswick, Steven Bellovin and Aviel Rubin.

"Internet Denial of Service: Attack and Defense Mechanisms," by Jelena Mirkovic, Sven Dietrich, David Dittrich, and Peter Reiher.


Other materials will include recent papers on the various subject areas.



Projects/Programming:

Grading:


• Quizzes (unannounced): 30%
  
• Midterm paper/presentation: 20%
• Final paper/presentation: 30 %
• Class participation/peer review: 20%
  

Policies:

• A make-up project presentation will be granted only if the instructor is notified before the exam and there is serious illness or similarly important reason for missing that day.
• No make-up quizzes.
  
• For fairness to all students there will be no individual extra credit work.
• Assignments are due before the lecture begins at 6:15pm. After 6:15pm, 25% will be deducted from your grade. For homeworks late more than one (two) day(s), 50% (75%) will be deducted. No credit will be given for assignments that are more than 3 days late. Exceptions may be granted only if there is an important reason. Exceptions must be cleared with the instructor in advance. If you must miss a class at which an assignment is due, you may email your assignment to the instructor postmarked BEFORE it is due.
• You may collaborate on projects with your fellow students to a limited degree. I.e., you may discuss concept clarifications with other students, but the specific details of your projects must be your own work.
• You must specify in writing any resources (web, books etc.) other than the textbook that you used for completing the assignments.
• It is cheating to collaboratively work out a detailed solution, to copy a solution from another student or some other resource without specifying it, or to give away a solution.
• ALL parties involved in a case of cheating get an automatic grade of zero (0) in the assignment/exam. Repeated cases get an F in the course. Any case of cheating will be reported to the honor board or the Dean of the Graduate School.



Syllabus:


Week	Date	Topics	Reading
1	January 15, 2008	Introduction.  Host security and network security. Security mechanisms.  Failures. Basic cryptography types. History & terminology. Cryptanalysis. Steganography.	Bishop 1
2	January 22, 2008	Basic cryptography cont. Block ciphers. Stream ciphers. Hash functions. Public key cryptography. Digital Signatures. Cryptographic protocols. Attacks.	Bishop 9-11 Stallings 3-6
3	January 29, 2008	Authentication and authorization. Password based attacks.  Address based attacks. Cryptographic based biometrics protocols. Project I topic discussions.	Bishop 12 Stallings 7-10
4	February 5, 2008	Security models. Access matrix. Mandatory access control. Discretionary access control. Role based access control.  Biba model.	Bishop 2, 4-6
5	February 12, 2008	Intrusion detection components. Categories. Anomaly detection. Misuse detection. Virus/worm scanners. Honeypots. Intrusion prevention systems countermeasures. Problems.	Bishop 25
6	February 19, 2008	No classes. Monday schedule.
7	February 26, 2008	Firewalls. Types of firewalls. De-militarized zones. Distributed firewalls. Personal firewalls. Attacks. Project presentations I	Bishop 26 Stallings 16
8	March 4, 2008	Denial of service. Types of DoS. Host network defense detection and countermeasures.	Bishop 26 Mirkovic 4-6
9	March 11, 2008	Worms and viruses definitions. Exploits. Detection.  Protection.	Bishop 29 Stallings 15
10	March 18, 2008	No classes - Spring Break
11	March 25, 2008	Vulnerabilities.  Protocol attacks. Code attacks. Buffer overflows. Race conditions. Argument attacks. SQL Injection.	Bishop 23
12	April 1, 2008	Analysis. Safe languages. Proof-carrying code. Software fault isolation. Code signing. Program shepherding.  Sandboxing. Protecting the stack.	Bishop 29
13	April 8, 2008	System security. Email security. Web security. File system security.	Bishop 27 Stallings 12, 14
14	April 15, 2008	Wired security. IPsec. VPNs. SSL. Attacks & defenses.
15	April 22, 2008	Wireless security. WEP. Radius attacks & defenses. Special topics. Draft presentations/papers due.
16	April 29, 2008	Special topics / Project presentations II.