ECS 153. Computer Security
| Winter 2012 | CRN: 54725 |
|---|
| Lecture: | MWF 1000-1050, 1130 Bainer. |
|---|
| Section: | F 1210-1300, 55 Roessler | Section Notes |
|---|
| Instructor: |
Hao Chen.
Office
hours: F 1200-1400, 2211 Watershed. |
|---|
| TA: |
Clint Gibler. Office hours: W 1200-1300, 55 Kemper.
|
|---|
| Communication: |
If you have a non-personal question, send it to the discussion forum at SmartSite.
If you have a personal question, send an email to ecs153ATcancer.cs.ucdavis.edu
whose subject line starts with ecs153.
|
|---|
Goals
This course introduces principles, mechanisms, and implementations
of computer security. You will learn how hackers attack systems,
how to defend against the attacks, and how to design systems to
withstand the attacks.
Topics
- Security principles
- Security Mechanisms
- Cryptography: symmetric key, public key, PKI, key management
- Authentication: password, challenge/response, cryptographic protocols
- Access control: access control list, capabilities, theories
- Network security: security mechanisms on the Internet, firewall,
intrusion detection
- Confinement: isolation, covert channels
- Security policies
- Practical security challenges
- Software vulnerabilities and secure programming.
- Malware: worms, viruses, spyware.
- Security usability
- Other topics as time permits and according to student interest.
Prerequisites
Requirements and grading
- Reading: we will use materials from the following textbook as
well as selected papers. You must read the assigned reading before
each class.
Textbook: M. Bishop,
Computer Security: Art and
Science,
Addison-Wesley, Boston, MA. ©2003. ISBN 0-201-44099-7
- Homework (Gradebot): The zeroth homework tests if you understand and agree to the rules of engagement. If you fail to turn it in on time, you automatically fail this class.
- Exam: The midterm exam is open print-materials. You may bring any printed books or notes. However, you shall not use any electronic device (including but not limited to computers, PDAs, cell phones) or share materials during the exams. There is no final exam.
- Project.
- Participation: You shall read the forum and your email at least once in any 12 hour period (including weekends and holidays), as I may post important announcements about this class.
- Grading (subject to change): homework: 30%;
exam: 30%; project: 30%; classroom participation: 10%; Responsibility credit (explained below): 10%.
I expect you to take responsibility for your achievements and mistakes. Therefore, do not make unreasonable demands, a.k.a. whining. If you do, you will not only get no favorable treatment but also lose this credit completely. Here are some examples of whine:
- Demand exceptions or favors at the expense of fairness to the rest of the class.
- Refuse to take responsibility for your mistake (e.g., failure to read specifications or follow instructions) but blame it on others (your classmates, the instructor, or the TA).
- Demand the rule for an assignment be changed to overlook your mistake after the assignment has been graded.
However, you are encouraged to ask questions and to provide feedback on my teaching, e.g.:
- Ask me to clarify specifications or policies.
- Identify mistakes in my lectures, specifications, code examples, or grading.
- Suggest how my teaching can be improved.
Schedule
| Week | Date | Topic | Reading |
Note
|
| 1 | January 09 |
Introduction |
|
|
| January 11 |
Design principles |
§1.1-1.3; §13; |
|
| January 13 |
Buffer overflow |
Smashing The Stack For Fun And Profit. Aleph One. |
|
| 2 | January 16 |
MLKs Day |
|
| January 18 |
Buffer overflow (cont.) |
|
|
| January 20 |
Buffer Overflows:
Attacks and Defenses for the Vulnerability of the Decade. Cowan et al. |
|
| 3 | January 23 |
Symmetric key cryptography |
§9.1, §9.2.1, §9.2.2.2, §9.2.3 |
|
| January 25 |
Block ciphers |
Notes |
|
| January 27 |
Public key cryptography |
§9.3 |
|
| 4 | January 30 |
Notes |
|
| February 01 |
|
| February 03 |
|
| 5 | February 06 |
Digital signatures |
§10.6 |
|
| February 08 |
Public key infrastructure; Message Authentication |
§10.4.2, §9.4 |
|
| February 10 |
Midterm |
|
| 6 | February 13 |
Diffie-Hellman; Authentication; Kerberos |
§9.3.1, §12.1-3, §10.2.2 |
| February 15 |
Access control |
§2.1 |
|
| February 17 |
Midterm (cont.) |
|
| 7 | February 20 |
Presidents Day |
|
| February 22 |
Access control |
§2.4; §4.4; §15.1-15.2 |
|
| February 24 |
|
| 8 | February 27 |
Operating system security |
No reading. |
|
| February 29 |
|
| March 02 |
Sandbox |
A secure environment for untrusted helper applications:confining the
wily hacker. |
|
| 9 | March 05 |
|
| March 07 |
Android security |
Security and Permissions.
Android security. |
|
| March 09 |
|
| 10 | March 12 |
Cross-site Scripting |
Cross site scripting explained, Klein. |
|
| March 14 |
Cross-site Request Forgery |
Cross-Site Request Forgeries: Exploitation and Prevention, Zeller, Felten.
Robust Defenses for Cross-Site Request Forgery, Barth, Jackson, Mitchell. (Optional)
|
|
| March 16 |
|
|
|
| 11 | March 19 |
|
|
|
Policies
- Late work: We accept late work only:
- in exceptional
circumstances, such as your injury by fatal automobile accidents, plane crashes, lightning strikes, roadside IEDs, snipers, or dinner with Dr. Hannibal Lector, and
- when you ask and receive our permission before the deadline.
- Practice exams: We train future computer scientists and engineers,
not professional exam takers. Therefore, we give no practice exam, and we don't "prepare" for exams.
- Regrade request: If you believe that your homework or exam has been graded incorrectly, you may request regrade only within one week of the returned work.
- Integrity: All students shall understand University policies on academic honesty.
Cheating on assignments or exams will be subject to cruel and unusual
punishments.
Warning
From time to time, we may discuss vulnerabilities in
widely-deployed computer systems. This is not intended as an
invitation to go exploit those vulnerabilities. It is important that
we be able to discuss real-world experience candidly; students are
expected to behave responsibly.
The campus's policy (and my policy) on this should be clear: you
may not break into machines that are not your own; you may not attempt
to attack or subvert system security. Breaking into other people's
systems is inappropriate, and the existence of a security hole is no
excuse.
Feedback
I always welcome any feedback on what I could be doing better.
You are also welcome to send me feedback anonymously.
Hao Chen <ecs153ATcancer.cs.ucdavis.edu>
Last modified February 7, 2012.
