Computer Science 530 - Syllabus and Reading List -- Fall 2022

This is our expected Syllabus and reading list. Most topics will take several lectures to cover. In addition to the primary discussion for each lecture, 5-10 minutes of each lecture will be set aside for discussion of current events in the computer security arena. Specific coverage within each leacture will be updated from year to year to keep the course material up to date with current practice.

Dates may change depending on progress throug the semester. Reading assignments are designated as such. Links from system names in the syllabus are for general information only.

Readings are on topics related to the lecture, but lectures are not from the book. Students are expected to have completed the assigned readings prior to lecture so that they have backround appropriate for class discussion.

p

Date	Topic/Readings	Slides	Lab Info
Lecture 1 August 26 2022	The Security Problem A working definition of security Evaluating security Systems security vs network security vs data security Societal aspects of security, ethical and legal foundations Readings: Bishop, Chapter 1, An Overview of Computer Security	PPT, PDF	Lab Introduction.
Lecture 2 September 2 2022	Cryptography - An Overview Secret key cryptography Public key cryptography Hashes and message digests Steganography Readings: Bishop, Chapter 9, Basic Cryprography Bishop, Chapter 11 (only through section through 11.2), Cipher Techniques Garfinkel (Is Encryption Doomed) New Reading fromt the NSA in August 2021 (releated to questions posed in article above: Quantum Computing and Post-Quantum Cryptography	PPT, PDF @ Slide 37	Cryptography
Lecture 3 September 9 2022	Key management Diffie-Hellman Key Exchange Ties to Authentication Protocols Public-key Key Exchange (PGP, X.500, S/MIME) Peer-to-peer Group key management Readings: Bishop, Chapter 10, Key Management Needham and Schroeder (you may need to use the VPN for access) Rafaeli and Hutchison (you may need to use the VPN for access)	PPT, PDF @ Slide 86	Authentication
Lecture 4,5 September 16,23 2022	Authentication and Identity Management Password-based authentication Unix vs Windows Kerberos X.500 Hardware authentication Biometrics (plus more material to be added) Readings Bishop, Chapter 12, Authentication Lamport Neuman, Ts'o (Kerberos) Neuman and Stubblebine (Timestamps vs. Nonces) Kormann and Rubin (Risks of Passport)	PPT, PDF @ Slide 121	Authorization Application Security
Lecture 6 September 30, 2022	Authorization and Policy Policy ACLs GAA-API Readings: Barkley: Comparing Simple Role Based Access Control Models and Access Control Lists) Ryutov,Neuman,Kim,Zhou: Integrated Access Control and Intrusion Detection for Web Servers Readings: Bishop, Chapter 2, Access Control Matrix Readings: Bishop, Chapter 4, Security Policies Readings: Bishop, Chapter 5, Confidentiality Policies		Packet Sniffing
Mid-term October 7 2022	Mid-Term Exam (9:00 AM - 10:40 AM)	Also Lecture on untrusted computing.	Packet Sniffing
Lecture 8 October 21 2022	Viruses Worms Spyware Denial of service attacks Transmission vectors, e.g. spam Readings Moore, Paxon, Savage, Shannon, Stanford & Weaver: Inside the Slammer Worm Thompson, Ken: Reflections on Trusting Trust - ACM Turing Award Lecture 1984 Readings: Bishop, Chapter 22, Malicious Logic		Intrusion Detection
Lecture 9 October 28 2022	Countermeasures Firewalls Virus checkers Patch and configuration management Readings Bishop, Chapters 26 and 27, Network and System Security		ARP Spoofing
Lecture 11 November 4 2022 (will extend into lecture 12)	Intrusion detection and response Commercial Itrusion Detection Systems Research Itrusion Detection Systems Response systems Readings Bishop, Chapter 25, Intrusion Detection Taimur Aslam, Ivan Krsul, and Eugene H. Spafford, A Taxonomy of Security Faults, Proceedings of the National Computer Security Conference, Coast TR 96-05, 1996. C. Ko, G. Fink, K. Levitt, Automated Detection of Vulnerabilities in Privileged Programs by Execution Monitoring, Proc. of the 10th Annual Computer Security Applications Conference, December 1994, pp 134-144. Debra Anderson, Thane Frivold, and Alfonso Valdes, Next Generation Intrusion Detection Expert System (NIDES) a Summary, SRI Computer Science Laboratory Technical Report SRI-CSL-95-07, May 1995. S Singh, C Estan, G Varghese, S Savage, The EarlyBird System for Real-time Detection of Unknown Worms , ACM Workshop on Hot Topics in Networks, 2003.	. .	Tunnels and VPNs
Lecture 12 November 11 2022	The Human Element Social Engineering Phishing Character sets Complexity of proper security deployment Configuration issues Passwords Readings Phinding Phish: Evaluating Anti-Phishing Tools, Zhang, Egelman, Cranor and Hong, 2007 Internet Society Symposium on Network and Distributed Systems Security.	--	Filesystem Labeling
Lecture 13 November 18 2022	Trusted Computing The Public Perception of Trusted Computing The Hardware Basis for Trusted Computing The Software and OS Basis for Trusted Computing Virtualization Negotiating Trust and Obligation Case Studies Readings Glance at the web site for the Trusted Computing Group Vivek Haldar, Deepak Chandra and Michael Franz, Semantic Remote Attestation -- A Virtual Machine directed approach to Trusted Computing In proceedigs of the 3rd Virtual Machine Research and Technology Symposium. Arun Viswanathan and B.C. Neuman, A Survey of Isolation Techniques - DRAFT		Forensics
Lecture 14 December 2 2022	Privacy, Plus CyberPysical Systems, Cloud Computing and other topics. Read or listen to this Podcast on NPR, to understand why privac is important. Your Digital Trail: Data Fuels Political and Legal Agendas - By Daniel Zwerdling, October 3, 2013. All things considered. Threat Propagation in Cyber Physical Systems - Neuman, Tan 2011. Security risks in Cloud Computing from InfoWorld July 2, 2008.		none
Final Exam Monday December 12, 2022	Final Exam (11:00 AM - 1:00 PM)	N/A	None