Basic notions of confidentiality, integrity, availability; authentication models; protection models; security kernels; secure programming; audit; intrusion detection and response; operational security issues; physical security issues; personnel security; policy formation and enforcement; access controls; information flow; legal and social issues; identification and authentication in local and distributed systems; classification and trust modeling; risk assessment.
Ashish Kundu
Office: LWSN 2161 Cubicle 13
Office hours: Tuesday, Thursday: 3:30pm-4:30pm, or by appointment.
Office hours to be held at: LWSN 2161 conference room in the lab.
Phone: 49-69399
Email (preferred contact mechanism): firstname followed by k at cs d0t purdue d0t edu
There will be a course email list used for high-priority announcements.
This will use your @purdue.edu
email address; make sure this
is forwarded to someplace you look on a regular basis.
We will be using Blackboard for turning in assignments, recording and distributing grades, as well as a discussion tool.
For review (and if you miss a lecture), you can pick them up as a vodcast/podcast. Be warned that the audio isn't great, and that you only see what is on the screen, not what is written on the chalkboard.
The official requirement is CS 503 (Operating Systems) or equivalent, and by extension the material required as a prerequisite to CS 503. If you do not have this background please look at the discussion of prerequisites, then come talk with me.
Matthew Bishop, Computer Security: Art and Science Addison-Wesley, 2003. ISBN 0-201-44099-7
I suggest you get the latest printing of the textbook; earlier printings had some typos that made follwoing the text a challenge. Also get the appropriate Errata pages.
Some students have found primary material in the research literature easier to understand than the (condensed) treatment in the textbook. The text contains extensive references (over 1000); you are encouraged to go to these for material you have difficulty with.
Another suggestion is the text used for the undergraduate course (CS426):
Charles P. Pfleeger and
Shari Lawrence Pfleeger
Security in Computing, 3/e
Prentice Hall, 2003.
You may find this book easier to read, however it does not provide
the level of mathematical rigor needed for this course.
The exact mix of projects, written homeworks, papers, etc. is yet to be determined. However, at this point I expect there will be one to two programming projects, and two to four paper reviews (See here for a discussion of what I mean by paper review.) During weeks when you are not working on a project or paper review, there will be analytical written homework problems, with a mix of mathematical work (e.g., proving correctness of a protocol) and case studies (e.g., discuss different methods used to secure an example system.)
Evaluation will be a subjective process (see my grading standards), however it will be based primarily on your understanding of the material as evidenced in:
Exams will be open note / open book. To avoid a disparity between resources available to different students, electronic aids are not permitted.
Projects and written work will be evaluated on a ten point scale:
Late work will be penalized 1 point per day (24 hour period). This penalty will apply except in case of documented emergency (e.g., medical emergency), or by prior arrangement if doing the work in advance is impossible due to fault of the instructor (e.g., you are going to a conference and ask to start the project early, but I don't have it ready yet.)
Qualifying exam, time and place to be determined. Advance registration required.
If you plan to use this course as part of your Part 1 Qualifying Exams, you should have emailed your availability during final exam week to clifton@cs.purdue.edu by October 17, 2010 . Check your exam schedule first! (it will be available September 16.)
Please read and sign the Department of Computer Sciences Academic Integrity Policy. This will be followed unless I provide written documentation of exceptions.
Late work will be penalized except in case of documented emergency (e.g., medical emergency), or by prior arrangement if doing the work in advance is impossible due to fault of the instructor (e.g., you are going to a conference and ask to start the project early, but I don't have it ready yet.)
You may also be interested in reviewing Professor Spafford's Policy on Intellectual Honesty.
Note: The course outline is being updated from Fall 2004, and will change. In particular, the assignments (and due dates) will change. They are provided at this time to assist you in planning for the course.
Penetration Analysis of a XEROX Docucenter DC 230ST: Assessing the Security of a Multi-purpose Office Machine, 23rd National Information Systems Security Conference, Baltimore, Maryland, October 16-19, 2000.
You may also want to see the canonical syllabus.
Final Exam Wednesday, 15 December, 13:00-15:00, LAMB 108. (old solutions).
Qualifying exam, Friday, 17 December, 10:00-11:00, LWSN 3102B (Sample from a past year.)
This page last modified