CS 526 Lectures, Handouts & Homeworks

(Fall 2012)

	Monday	Wednesday	Friday
Week 1 (Aug 20 -- Aug 24)	Overview of the course (PPT) Readings Information Security on Wikipedia	No new slides.	Cryptography: Classical Ciphers (PPT) Readings Cryptography on wikipedia HW1 assigned, available via Piazza.
Week 2 (Aug 27 -- Aug 31)	Cryography: One-Time Pad, stream ciphers, etc. (PPT) Readings (on wikipedia) One-Time Pad Information Theoretic Security Stream cipher Pseudorandom number generator	Guest lecture by Prof. Bertino	No new slides.
Week 3 (Sep 3 -- Sep 7)	No class (Labor day)	No new slides.	Cryography: Block cipher, etc. (PPT) Readings (on wikipedia) Block Cipher Ciphertext indistinguishability Block cipher modes of operation
Week 4 (Sep 10 -- Sep 14)	No new slides.	Cryptographic hash functions and message authentication code. (PPT) Readings (on wikipedia) Cryptographic hash function Message Authentication Code	HW2 assigned. Due Wed Sept 26. Readings for Homework 2 Intercepting Mobile Communications: The Insecurity of 802.11
Week 5 (Sep 17 -- Sep 21)	Quiz 1 (Covering topics 1-5) Public key cryptography. (PPT) Readings Public key cryptography RSA Diffie-Hellman ElGamal New Directions in Cryptography	No new slides.	User authentication. (PPT) Readings Password Password strength Password cracking Password salts Trusted Path One-time Password
Week 6 (Sep 24 -- Sep 28)	No new slides.	Web Security (1). (PPT) Readings HTTP Cookie Cross Site Scripting Cross Site Request Forgery	Project 1 will be assigned. No new slides otherwise.
Week 7 (Oct 1 -- Oct 5)	Slides on SQL injection from Prof. V. N. Venkatakrishnan at UIC Slides on Side Channel attacks Web Security (2). (PPT) Optional Readings Bandhakavi et al.: CANDID : Preventing SQL Injection Attacks Using Dynamic Candidate Evaluations Chen et al.: Side-Channel Leaks in Web Applications: a Reality Today, a Challenge Tomorrow	No new slides.	OS Security Basics & Unix Access control. (PPT) Readings CPU modes System call Filesystem permissions UNIX File and Directory Permissions and Modes Unix file permissions
Week 8 (Oct 8 -- Oct 12)	No class (October break)	No new slides.	Software Vulnerabilities (PPT) Readings Privilege escalation Directory traversal Stack buffer overflow Buffer overflow protection Format string attack Integer overflow Smashing The Stack For Fun And Profit by Aleph One Quiz #2: Covering topics 6-9
Week 9 (Oct 15 -- Oct 19)	Guest lecture by Charles Carmakal from MANDIANT Slides posted in Piazza	Guest lecture by Prof. Sam Wagstaff Secure communication. (PPT) Readings Needham-Schroeder protocol (only the symmetric key part) Public Key Certificate HTTP Secure	Mid-term exam.
Week 10 (Oct 22 -- Oct 26)	No new slides. Continue with topic 10, then 12.	No new slides. Continue with topic 12.	No new slides. Continue with topic 12. HW3 Posted. Due on November 7. Readings needed for HW3 Operating System Framed in Case of Mistaken Identity Scriptless Attacks Reflections on trusting trust New Directions in Cryptography
Week 11 (Oct 29 -- Nov 2)	No new slides. Continue with topic 12.	Malwares (PPT) Readings Malware Computer virus Botnet Rootkit Morris worm	No new slides. Continue with topics 12 and 13.
Week 12 (Nov 5 -- Nov 9)	No new slides. Continue with topics 13.	Project 2	Discretionary Access Control(PPT) Readings Discretionary Access Control The Confused Deputy Problem
Week 13 (Nov 12 -- Nov 16)	No new slides. Continue with topics 14.	The Bell LaPadula Model(PPT) Readings The Bell LaPadula Model	Non-interference and non-deducability(PPT) Optional Readings Goguen and Meseguer. "Security Policies and Security Models".
Week 14 (Nov 19 -- Nov 23)	No new slides. Continue with topics 16. Readings for Homework 4 Section IA of The Protection of Information in Computer Systems Software Security Design Principles (A local PDF version is here)	No class (Thanksgiving break)	No class (Thanksgiving break)
Week 15 (Nov 26 -- Nov 30)	Integrity Protection Models(PPT) Optional Readings A Comparison of Commercial and Military Computer Security Policies Biba: Integrity Considerations for Secure Computer Systems	No new slides. Continue with topics 17. Quiz 4: Covering topics 14,15,16.	TCSEC and Common Criteria(PPT)
Week 16 (Dec 3 -- Dec 7)	CodeShield: Towards Personalized Application Whitelisting. To appear in ACSAC. Presented by Chris Gates.	Topic 19: DNS Security (PPT) Optional Readings Steve Friedl: An Illustrated Guide to the Kaminsky DNS Vulnerability Dan Kaminsky: Presentation at BlackHat 2009	Topic 20: Intrusion Detection Slides on "The Base Rate Fallacy and its Implications for the Difficulty of Intrusion Detection"