Basic notions of confidentiality, integrity, availability; authentication models; protection models; security kernels; secure programming; audit; intrusion detection and response; operational security issues; physical security issues; personnel security; policy formation and enforcement; access controls; information flow; legal and social issues; identification and authentication in local and distributed systems; classification and trust modeling; risk assessment.
Ferit Erin
Office: MATH B15
Office hours: M 14:00-15:00 & F 10:00-11:00, or by appointment.
Phone: 49-66232
Email: ferit@cs.purdue.edu
Please send questions to the course newsgroup purdue.class.cs526. This should be used for most questions. If you have something you don't want made public, send it to cs526@ics.purdue.edu. We will also be using WebCT for recording and distributing grades.
Please add yourself to the course mailing list. Send mail to mailer@cs.purdue.edu containing the line:
add your email to cs526
Feel free to send things to the course mailing list if you feel it is appropriate. An example might be a pointer to a particularly helpful on-line manual describing an API used in one of the projects.
The official requirement is CS 503 (Operating Systems) or equivalent, and by extension the material required as a prerequisite to CS 503. If you do not have this background please look at the discussion of prerequisites, then come talk with me.
Matthew Bishop, Computer Security: Art and Science Addison-Wesley, 2003. ISBN 0-201-44099-7
I suggest you get the latest printing of the textbook; earlier printings had some typos that made follwoing the text a challenge. Also get the appropriate Errata pages.
Some students have found primary material in the research literature easier to understand than the (condensed) treatment in the textbook. The text contains extensive references (over 1000); you are encouraged to go to these for material you have difficulty with.
Another suggestion is the text used for the undergraduate course (CS426):
Charles P. Pfleeger and
Shari Lawrence Pfleeger
Security in Computing, 3/e
Prentice Hall, 2003.
You may find this book easier to read, however it does not provide
the level of mathematical rigor needed for this course.
The exact mix of projects, written homeworks, papers, etc. is yet to be determined. However, at this point I expect there will be one to two programming projects, and two to four paper reviews (See here for a discussion of what I mean by paper review.) During weeks when you are not working on a project or paper review, there will be analytical written homework problems, with a mix of mathematical work (e.g., proving correctness of a protocol) and case studies (e.g., discuss different methods used to secure an example system.)
Evaluation will be a subjective process (see my grading standards), however it will be based primarily on your understanding of the material as evidenced in:
Exams will be open note / open book. To avoid a disparity between resources available to different students, electronic aids are not permitted.
Projects and written work will be evaluated on a ten point scale:
Late work will be penalized 1 point per day (24 hour period). This penalty will apply except in case of documented emergency (e.g., medical emergency), or by prior arrangement if doing the work in advance is impossible due to fault of the instructor (e.g., you are going to a conference and ask to start the project early, but I don't have it ready yet.)
Qualifying exam, time and place to be determined. Advance registration required.
If you plan to use this course as part of your Part 1 Qualifying Exams, you should have emailed your availability during final exam week to cs526@ics.purdue.edu by September 20, 2004. Check your exam schedule first! (it will be available September 16.)
Please read and sign the Department of Computer Sciences Academic Integrity Policy. This will be followed unless I provide written documentation of exceptions.
Late work will be penalized except in case of documented emergency (e.g., medical emergency), or by prior arrangement if doing the work in advance is impossible due to fault of the instructor (e.g., you are going to a conference and ask to start the project early, but I don't have it ready yet.) The penalty for late work is 20% if turned in after the deadline. Work beyond one week may not be accepted (additional delay in posting solution sets is unfair to other class members), however if accepted the penalty will be an additional 20% for each week late.
You may also be interested in reviewing Professor Spafford's Policy on Intellectual Honesty.
Note: The course outline is being updated from Fall 2003, and will change. In particular, the assignments (and due dates) will change. They are provided at this time to assist you in planning for the course.
Penetration Analysis of a XEROX Docucenter DC 230ST: Assessing the Security of a Multi-purpose Office Machine, 23rd National Information Systems Security Conference, Baltimore, Maryland, October 16-19, 2000.
You may also want to see the canonical syllabus and a previous offering of the course.
Final Exam (solutions), Monday, December 13, 08:00-10:00, CS G066.
Qualifying exam, Wednesday, December 15, 13:00-14:00, Math 431. (Sample from last year.)