CS 526 Lectures, Handouts & Homeworks

(Fall 2015)

	Tuesday	Thursday
Week 1 (Aug 24 -- Aug 28)	Overview of the course (PPT) Readings Information Security on Wikipedia	Cryptography: Classical Ciphers (PPT) Readings Cryptography on Wikipedia One-Time Pad
Week 2 (Aug 31 -- Sept 4)	Cryography: Modern Ciphers and Their Security. Cryography: Modern Ciphers and Their Security (PPT) Readings (on wikipedia) Information Theoretic Security Stream cipher Pseudorandom number generator Semantic Security Block Cipher Block cipher modes of operation Data Encryption Standard Advanced Encryption Standard	Cryptographic hash functions and message authentication code. (PPT) Readings (on wikipedia) Cryptographic hash function Message Authentication Code
Week 3 (Sept 7 -- Sept 11)	Public key cryptography. (PPT) Readings Public key cryptography RSA Diffie-Hellman ElGamal New Directions in Cryptography	User authentication. (PPT) Readings Password Password strength Password cracking Password salts Trusted Path One-time Password
Week 4 (Sept 14 -- Sept 18)	No new slides. Continue with previous topic. Quiz 1, covering topics 1-4.	OS Security Basics & Unix Access control. (PPT) Readings Section IA of The Protection of Information in Computer Systems CPU modes System call Filesystem permissions UNIX File and Directory Permissions and Modes Unix file permissions
Week 5 (Sept 21 -- Sept 25)	No new slides. Continue with previous topic.	Topic 8: Software Vulnerabilities. (PPT) Software Vulnerabilities (PPT) Readings Privilege escalation Directory traversal Time-of-check-to-time-of-use Stack buffer overflow Buffer overflow protection Format string attack Integer overflow Smashing The Stack For Fun And Profit by Aleph One
Week 6 (Sept 28 -- Oct 2)	Slides on Lab 1 (PPT)	Malwares (PPT) Readings Malware Computer virus Computer worm Botnet Spyware Rootkit
Week 7 (Oct 5 -- Oct 9)	Market Failure of Secure Software (PPT) Quiz 2	Topic 10: Symbolic Execution (PPT) Readings: Symbolic Execution and Program Testing Symbolic Execution for Software Testing: Three Decades Later A Few Billion Lines of Code Later Using Static Analysis to Find Bugs in the Real World KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs DART: Directed Automated Random Testing CUTE: A Concolic Unit Testing Engine for C
Week 8 (Oct 12 -- Oct 16)	No class. (October break)	Project 2 Continue with Topic 10
Week 9 (Oct 19 -- Oct 23)	Web Security (1). (PPT) Readings HTTP Cookie Same Origin Policy Cross Site Scripting Cross Site Request Forgery	Mid-term Exam.
Week 10 (Oct 26 -- Oct 30)	Web Security (2). (PPT) Slides on SQL injection from Prof. V. N. Venkatakrishnan at UIC Slides on Side Channel attacks Optional Readings Bandhakavi et al.: CANDID : Preventing SQL Injection Attacks Using Dynamic Candidate Evaluations Chen et al.: Side-Channel Leaks in Web Applications: a Reality Today, a Challenge Tomorrow	Topic 13: Mobile Security: See Slides on Piazza Optional Readings Xing et al.: Cracking App Isolation on Apple: Unauthorized Cross-App Resource Access on MAC OS X and iOS
Week 11 (Nov 2 -- Nov 6)	Secure communication. (PPT) Secure communication. Readings Needham-Schroeder protocol (only the symmetric key part) Public Key Certificate Transport Layer Security HTTP Secure	Malware Defense (PPT) Slides on "The Base Rate Fallacy and its Implications for the Difficulty of Intrusion Detection"
Week 12 (Nov 9 -- Nov 13)	Discretionary Access Control(PPT) Readings Discretionary Access Control The Confused Deputy Problem	The Bell LaPadula Model(PPT) Readings The Bell LaPadula Model Looking Back at the Bell-La Padula Model
Week 13 (Nov 16 -- Nov 20)	Quiz 3. Covering Topics 11-15. Non-interference and non-deducability(PPT) Optional Readings Goguen and Meseguer. "Security Policies and Security Models".	Integrity Protection Models(PPT) Optional Readings A Comparison of Commercial and Military Computer Security Policies Biba: Integrity Considerations for Secure Computer Systems
Week 14 (Nov 23 -- Nov 27)	Trusted Operating Systems and Assurance(PPT)	No class. (Thanksgiving.)
Week 15 (Nov 30 -- Dec 4)	Data Privacy(PPT) Optional reading t-Closeness: Privacy Beyond k-Anonymity and l-Diversity. Membership Privacy: A Unifying Framework For Privacy Definitions	No new slides. Continue with the previous topic.
Week 16 (Dec 7 -- Dec 11)	Topic 22: Role Based Access Control (PPT) Readings Role Based Access Control Models	Topic 23: DNS Security (PPT) Optional Readings Steve Friedl: An Illustrated Guide to the Kaminsky DNS Vulnerability Dan Kaminsky: Presentation at BlackHat 2009