CS 526 Lectures, Handouts & Homeworks

(Fall 2011)

	Tuesday	Thursday
Week 1 (Aug 22 -- Aug 26)	Overview of the course (PPT) Readings Information Security on Wikipedia	Cryptography: Classical Ciphers (PPT) Readings Cryptography on wikipedia
Week 2 (Aug 29 -- Sept 2)	Cryography: One-Time Pad, stream ciphers, etc. (PPT) A note on perfect secrecy. Readings (on wikipedia) One-Time Pad Information Theoretic Security Stream cipher Pseudorandom number generator	Cryography: Block cipher, etc. (PPT) Readings (on wikipedia) Block Cipher Data Encryption Standard Advanced Encryption Standard Semantic Security Block cipher modes of operation Homework 1 (Latex source) Readings for Homework 1 Intercepting Mobile Communications: The Insecurity of 802.11
Week 3 (Sept 5 -- Sept 9)	Cryptographic hash functions and message authentication code. (PPT) Readings (on wikipedia) Cryptographic hash function Message Authentication Code Optional Readings The Order of Encryption and Authentication for Protecting Communications"	Public key cryptography. (PPT) Readings Public key cryptography RSA Diffie-Hellman ElGamal New Directions in Cryptography
Week 4 (Sept 12 -- Sept 16)	User authentication. (PPT) Readings Password Password strength Password cracking Password salts Trusted Path One-time Password	No new slides. Continue with previous topic. Homework 2 (Latex source) Readings for Homework 2 New Directions in Cryptography Ross Anderson Why Cryptosystems Fail Steven Alexander Password protection for modern operating systems
Week 5 (Sept 19 -- Sept 23)	Web Security (1). (PPT) Readings HTTP Cookie Same Origin Policy Cross Site Scripting Cross Site Request Forgery	Web Security (2). (PPT) Slides on SQL injection from Prof. V. N. Venkatakrishnan at UIC Slides on Side Channel attacks Optional Readings Bandhakavi et al.: CANDID : Preventing SQL Injection Attacks Using Dynamic Candidate Evaluations Chen et al.: Side-Channel Leaks in Web Applications: a Reality Today, a Challenge Tomorrow
Week 6 (Sept 26 -- Sept 30)	Project 1 Assigned No new slides. Continue with previous topic.	Secure communication. (PPT) Secure communication. Readings Needham-Schroeder protocol (only the symmetric key part) Public Key Certificate Transport Layer Security HTTP Secure
Week 7 (Oct 3 -- Oct 7)	OS Security Basics & Unix Access control. (PPT) Readings CPU modes System call Filesystem permissions UNIX File and Directory Permissions and Modes Unix file permissions	No new slides. Continue with previous topic.
Week 8 (Oct 10 -- Oct 14)	No class. (October break)	Software Vulnerabilities (PPT) Readings Privilege escalation Directory traversal Time-of-check-to-time-of-use Stack buffer overflow Buffer overflow protection Format string attack Integer overflow Smashing The Stack For Fun And Profit by Aleph One
Week 9 (Oct 17 -- Oct 21)	Watch the following vides Virtual Memory Organization Functions Stack Smashing The Stack Writing Exit Shellcode) Executing Shellcode The above videos are selected from the following two series Assembly Language Megaprimer for Linux (11 videos) Buffer Overflow Exploitation Megaprimer for Linux (9 videos)	No new slides. Continue with previous topic.
Week 10 (Oct 24 -- Oct 28)	No new slides. Continue with previous topic.	Mid-term exam. Covering topics 1-11.
Week 11 (Oct 31 -- Nov 4)	Overview of Malware (PPT) Readings Malware Computer virus Computer worm Botnet Spyware Rootkit	Worms (PPT) Readings Morris worm Homework 3 (Latex source) Readings for Homework 3 Reflections on trusting trust Section IA of The Protection of Information in Computer Systems Software Security Design Principles (A local PDF version is here)
Week 12 (Nov 7 -- Nov 11)	No new slides. Continue with previous topic.	Discretionary Access Control(PPT) Readings Discretionary Access Control The Confused Deputy Problem
Week 13 (Nov 14 -- Nov 18)	Presentation about Project 2 The Bell LaPadula Model(PPT) Readings The Bell LaPadula Model Looking Back at the Bell-La Padula Model	Quiz 3. Covering Topics 12-14. No new slides. Continue with previous topic.
Week 14 (Nov 21 -- Nov 25)	Non-interference and non-deducability(PPT) Optional Readings Goguen and Meseguer. "Security Policies and Security Models".	No class. (Thanksgiving.)
Week 15 (Nov 28 -- Dec 2)	No new slides. Continue with previous topic.	Integrity Protection Models(PPT) Optional Readings A Comparison of Commercial and Military Computer Security Policies Biba: Integrity Considerations for Secure Computer Systems
Week 16 (Dec 5 -- Dec 9)	Trusted Operating Systems and Assurance(PPT)	Intrusion Detection Slides on "The Base Rate Fallacy and its Implications for the Difficulty of Intrusion Detection"