CS 526 Lectures, Handouts & Homeworks

(Spring 2009)

	Tuesday	Thurssday
Week 1 (Jan 12 -- Jan 16)	Guest lecture by Ziqing Mao: Web Security: (PPT) Readings Cross Site Scripting on Wikipedia Samy Worm Cross Site Request Forgery on Wikipedia	Guest lecture by Tiancheng Li. Data Anonymization (PPT) Readings
Week 2 (Jan 19 -- Jan 23)	Overview of the Course (PPT) Readings Information Security on Wikipedia	Classical Ciphers (PPT) Readings Cryptography on wikipedia Reference The Code Book by Simon Singh
Week 3 (Jan 26 -- Jan 30)	One-Time Pad and Stream Ciphers (PPT) Readings One-Time on wikipedia Stream Ciphers on wikipedia A Natural Language Approach to Automated Cryptanalysis of Two-time Pads Homework 1 (Latex source) Readings for Homework 1 Defeating Cross-Site Request Forgery Attacks with Browser-Enforced Authenticity Protection t-Closeness: Privacy Beyond k-Anonymity and l-Diversity Intercepting Mobile Communications: The Insecurity of 802.11 The Final Nail in WEP's Coffin	Block ciphers and cryptographic hash functions (PPT) Wikipedia Topics Block cipher Block cipher modes of operation
Week 4 (Feb 2 -- Feb 6)	Message Authentication Code (PPT) Reading:Wikipedia Topics Cryptographic hash functions Message Authentication Code Reading: The Order of Encryption and Authentication for Protecting Communications	Operating System Security Basics & User Authentication (PPT) Reading:Wikipedia Topics CPU modes System call Salt_(cryptography) Password cracking Trusted path One time password
Week 5 (Feb 9 -- Feb 13)	Unix Access Control (PPT) Readings UNIX File and Directory Permissions and Modes H.Chen,D.Wagner, and D.Dean: Setuid Demystified, In USENIX Security 2002 Homework 2 Readings for Homework 2 Authentication in an Internet Banking Environment by Federal Financial Institutions Examination Council Why Cryptosystems Failby Ross Anderson	Biometrics
Week 6 (Feb 16 -- Feb 20)	Input Validation Issues (PPT)	Buffer overflow (PPT) Readings Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade, Crispin Cowan, et al. Smashing The Stack For Fun And Profit, Aleph One Buffer Overflow Documents
Week 7 (Feb 23 -- Feb 27)	Other Vulnerabilities (PPT) Wikipedia topics Format string attack, Integer Overflow Lab 1 (Slides)	Malwares (PPT) Wikipedia topics Malware, Computer virus, Timeline of notable computer viruses and worms
Week 8 (Mar 2 -- Mar 6)	Dealing with Malwares (PPT) Readings Best Practices for UNIX chroot() Operations, The Linux kernel capabilities FAQ Wikipedia topics Market Failure, Paravirtualization, Full virtualization, Operating system-level virtualization	The Bell Lapadula Model (PPT) Optional reading: D. Bell and L. LaPadula. "Secure computer systems: Unified exposition and Multics interpretation". Technical Report ESD-TR-75-306, MITRE Corp., March 1976. Section II: Description of the Model Complete Report J. McLean: "Reasoning about security Models". D.E. Bell: "Concerning 'Modeling' of Computer Security".
Week 9 (Mar 9 -- Mar 13)	Mid Term Exam	No New Slides
Week 10 (Mar 16 -- Mar 20)	No class. Spring break	No class. Spring break
Week 11 (Mar 23 -- Mar 27)	Cancelled for CERIAS Symposium	Non-interferecne and non-deducibility (PPT) Readings Goguen and Meseguer. "Security Policies and Security Models". Homework 3 (Latex source) Homework 3 Readings Reflections on trusting trust David A. Wheeler's Page on Countering Trusting Trust
Week 12 (Mar 30 -- Apr 3)	Integrity models: Biba and Clark-Wilson (PPT) Readings D.D. Clark and D.R. Wilson. "A Comparison of Commercial and Military Computer Security Policies".	No new slides
Week 13 (Apr 6 -- Apr 10)	UMIP & IFEDAC (PPT) Readings Li, Mao, Chen: "Usable Mandatory Integrity Protection for Operating Systems" Mao, Li, Chen, Jiang: " Trojan Horse Resistant Discretionary Access Control" Lab 2 (Slides)	Trusted Operating Systems and Assurance (PPT)
Week 14 (Apr 13 -- Apr 17)	Role Based Access Control (PPT) Reading R.S. Sandhu, et al. Role-Based Access Control Models. 1996. N. Li et al. A Critique of the ANSI Standard on Role Based Access Control. 2007.	Public-Key Cryptography (PPT) Wikipedia topics public key cryptography, digital signature, Homework 4 (Latex source) Readings for Homework 4 Diffie and Hellman: New Directions in Cryptography Part 1A of The Protection of Information in Computer Systems
Week 15 (Apr 20 -- Apr 24)	Network Security (PPT) Wikipedia topics Arp Spoofing, Denial of Service,	DNS Security (PPT)
Week 16 (Apr 27 -- May 1)	Intrusion Detection Slides on Intrusion Detection Slides on "The Base Rate Fallacy and its Implications for the Difficulty of Intrusion Detection"	Preventing SQL Injection (PPT)