CIS 433/533

Computer and network security

Logistics

Course Description

Computer security is one of the most exciting and challenging areas in all of computer science. Many of the world's largest technology companies have unreservedly made security their largest concern, and many of the fundamental issues in securing systems and networks that have vexed us for man years continue to do so or have become even more problematic.

This course provides an introduction to computer and entwork security. Students successfully completing this class will be able to evaluate works in academic and commercial security, and will have rudimentary skills in security research. The course begins by covering the basic elements of cryptography, cryptanalysis, and systems security, and continues by considering applications of these concepts in real-world practice. At the graduate level, selected seminal and current papers in the field will also aid in providing context and further understanding of the area.

Topics covered include network security, authentication, security protocol design and analysis, security modeling, trusted computing, key management, program safety, intrusion detection, DDoS detection and mitigation, architecture/operating systems security, security policy, group systems, biometrics, web security, and other emerging topics. A detailed list of lecture by lecture contents, assignments, and due dates (subject to change as the term evolves) will be available on the course schedule.

We will make extenive use of the textbook required for the course:

• William Stallings and Lawrie Brown, Computer Security: Principles and Practice, 1/E, Prentice Hall, 2008.

Course material will also be drawn from influential papers in the field.

Please contact the instructor if you have questions regarding the material or concerns about whether your background is suitable for the course.

Course Expectations

The expectations for the course are that students will attend every class, do the readings assigned for class, actively and constructively participate in class discussions. For the graduate component of this class, readings of papers will be required, and some additional readings may also be required of the undergraduate students. The graduate component will include a research project in security, with the chief product being a conference-style paper. Project topics will be discussed in class and may be proposed through email or during meetings outside of class with Prof. Butler. Do not delay: quarters are very short and in order to be able to perform any interesting work, the sooner a topic is chosen, the better the end-result will be. While time is constrained, there should be real thought and effort exhibited by the work. The project grade will be based on novelty, correctness, depth of understanding, clarity of presentation, and effort. More information about the project will be given during class.

The undergraduate component will focus more heavily on the core material, with mastery demonstrated through examination. At the discretion of the instructor, highly motivated undergraduates may consider pursuing a research project. This option will be discussed further in the first class.

The tentative grading policy is as follows:

20% Quizzes & Assignments (30% for undergrad)

10% Participation

15% Midterm Exam (25% for undergrad)

30% Project (graduate and project option)

25% Final Exam (35% for undergrad)

Quizzes will be assigned sporadically throughout the term and test comprehension of the reading material as well as the previous day's class. Being late for or missing a quiz without an extremely sound reason will result in a zero for it.

Class participation will be a measure of contributing to the discourse both in class, through discussion and questions, and outside of class through contributing and responding to the mailing list. I have little interest in having people spam the class or the list with content-free statements in the hopes of sounding like they are participating; this will be more a measure of engagement with the material. The ability to comprehend the material and the papers read will be essential towards passing the course.

Academic Integrity Policy

Students are required to follow the university guidelines on academic conduct at all times. Students failing to meet these standards will automatically receive a 'F' grade for the course. The instructor carefully monitors for instances of offenses such as plagiarism and illegal collaboration, so it is very important that students use their best possible judgement in meeting this policy. The instructor will not entertain any discussion on the discovery of an offense, and will assign the 'F' grade and refer the student to the appropriate University bodies for possible further action.

Note that students are explicitly forbidden to copy anything off the Internet (e.g., source code, text) for the purposes of completing an assignment or the final project. Also, students are forbidden from discussing or collaborating on any assignment except were explicitly allowed in writing by the instructor.

Ethics Statement

This course considers topics involving personal and public privacy and security. As part of this investigation we will cover technologies whose abuse may infringe on the rights of others. As an instructor, I rely on the ethical use of these technologies. Unethical use may include circumvention of existing security or privacy measurements for any purpose, or the dissemination, promotion, or exploitation of vulnerabilities of these services. Exceptions to these guidelines may occur in the process of reporting vulnerabilities through public and authoritative channels. Any activity outside the letter or spirit of these guidelines will be reported to the proper authorities and may result in dismissal from the class and possible more severe academic and legal sanctions.

When in doubt, please contact the course professor for advice. Do not undertake any action which could be perceived as technology misuse anywhere and/or under any circumstances unless you have received explicit permission from Professor Butler.

Tentative Syllabus/Schedule