CS 526 Lectures, Handouts & Homeworks

(Spring 2011)

	Monday	Wednesday	Friday
Week 1 (Jan 10 -- Jan 14)	Overview of the course (PPT) Readings Information Security on Wikipedia	No new slides.	Cryptography: Classical Ciphers (PPT) Readings Cryptography on wikipedia
Week 2 (Jan 17 -- Jan 21)	No class (MLK day)	Cryography: One-Time Pad, stream ciphers, etc. (PPT) A note on perfect secrecy. Readings (on wikipedia) One-Time Pad Information Theoretic Security Stream cipher Pseudorandom number generator	Cryography: Block cipher, etc. (PPT) Readings (on wikipedia) Block Cipher Data Encryption Standard Advanced Encryption Standard Semantic Security Block cipher modes of operation
Week 3 (Jan 24 -- Jan 28)	No new slides. Homework 1 (Latex source) Readings for Homework 1 Intercepting Mobile Communications: The Insecurity of 802.11	Cryptographic hash functions and message authentication code. (PPT) Readings (on wikipedia) Cryptographic hash function Message Authentication Code	No new slides.
Week 4 (Jan 31 -- Feb 4)	Public key cryptography. (PPT) Readings Public key cryptography RSA Diffie-Hellman ElGamal New Directions in Cryptography	No class (holiday given by snow).	No new slides.
Week 5 (Feb 7 -- Feb 11)	User authentication. (PPT) Readings Password Password strength Password cracking Password salts Trusted Path One-time Password	No new slides. Homework 2 (Latex source) Readings for Homework 2 New Directions in Cryptography Ross Anderson Why Cryptosystems Fail Saar Drimer, Steven J. Murdoch, and Ross Anderson: Optimised to Fail: Card Readers for Online Banking Steven Alexander Password protection for modern operating systems	No new slides.
Week 6 (Feb 14 -- Feb 18)	Web Security (1). (PPT) Readings HTTP Cookie Cross Site Scripting Cross Site Request Forgery	Slides on SQL injection from Prof. V. N. Venkatakrishnan at UIC Slides on Side Channel attacks Optional Readings Bandhakavi et al.: CANDID : Preventing SQL Injection Attacks Using Dynamic Candidate Evaluations Chen et al.: Side-Channel Leaks in Web Applications: a Reality Today, a Challenge Tomorrow	Project 1 assigned. Web Security (2). (PPT) Readings Browser Plugins vs Extensions - the difference
Week 7 (Feb 21 -- Feb 25)	Secure communication. (PPT) Readings Needham-Schroeder protocol (only the symmetric key part) Public Key Certificate Transport Layer Security HTTP Secure Quantum key distribution	No new slide.	No new slide.
Week 8 (Feb 28 -- Mar 4)	OS Security Basics & Unix Access control. (PPT) Readings CPU modes System call Filesystem permissions UNIX File and Directory Permissions and Modes Unix file permissions	No new slides.	Software Vulnerabilities (PPT) Readings Privilege escalation Directory traversal Stack buffer overflow Buffer overflow protection Format string attack Integer overflow Smashing The Stack For Fun And Profit by Aleph One
Week 9 (Mar 7 -- Mar 11)	No new slides.	Mid-term exam.	No new slides. Project 1 due.
Week 10 (Mar 14 -- Mar 18)	No class (Spring break)	No class (Spring break)	No class (Spring break)
Week 11 (Mar 21 -- Mar 25)	Guest lecture by Prof. Clifton on Privacy	Guest lecture on wireless security by Prof. Nita-Rotaru. Homework 3 (Latex source) Readings for Homework 3 The Internet Worm Incident Reflections on trusting trust Countering Trusting Trust through Diverse Double-Compiling Section IA of The Protection of Information in Computer Systems Software Security Design Principles (A local PDF version is here)	Slides on return-oriented computing attacks (optional) Return-oriented Programming: Exploitation without Code Injection
Week 12 (Mar 28 -- Apr 1)	Overview of Malware (PPT) Readings Malware Computer virus Computer worm Botnet Spyware Rootkit	Worms (PPT) Readings Morris worm Conficker worm	No new slides.
Week 13 (Apr 4 -- Apr 8)	Discretionary Access Control(PPT) Readings Discretionary Access Control The Confused Deputy Problem	The Bell LaPadula Model(PPT) Readings The Bell LaPadula Model Looking Back at the Bell-La Padula Model Homework 4 (Latex source) Readings for Homework 4 Readings Role Based Access Control Models	No new slides
Week 14 (Apr 11 -- Apr 15)	The HRU Model(PPT) Optional Readings Protection in Operating Systems	Non-interference and non-deducability(PPT) Optional Readings Goguen and Meseguer. "Security Policies and Security Models".	Project 2 assigned.
Week 15 (Apr 18 -- Apr 22)	Integrity Protection Models(PPT) Optional Readings A Comparison of Commercial and Military Computer Security Policies Biba: Integrity Considerations for Secure Computer Systems	No new slides	Trusted Operating Systems and Assurance(PPT)
Week 16 (Apr 25 -- Apr 29)	No new slides	Role Based Access Control(PPT)	Intrusion Detection Slides on "The Base Rate Fallacy and its Implications for the Difficulty of Intrusion Detection"