ECS 235A. Computer Security

Description

This class introduces modern topics in computer systems security, and prepares students to do research on these topics. It plans to cover the following topics:

• Principles of security.
• Access control: ACL, capabilities, mandatory and discretionary access control.
• OS security: OS protection mechanisms, virtual machines, sandboxing.
• Software security: software vulnerabilities, static and runtime analysis, Java security.
• Network security: firewalls, network intrusion detection
• Cryptography protocol design.
• Malware: Internet worms, botnets, analysis.
• Applications: e-voting, usable security.

Requirements and Grading

• Reviews: Write a brief review of each paper that we will discuss in each class. List the paper's most significant contributions and weaknesses, and suggest how the paper could be improved. Your review is due by 2100 on the day before the lecture. Here are instructions on how to submit your reviews.
• Project: You will do a team project.
• Scribe: You will scribe for one class. Send me your scribe in text, LaTeX, or Microsoft Word format within two days of the class.
• Exam: None.
• Grading: project: 60%; scribe, paper reviews, and class participation: 40%

Lectures

Note: reading is subject to change.

Warning

From time to time, we may discuss vulnerabilities in widely-deployed computer systems. This is not intended as an invitation to go exploit those vulnerabilities. It is important that we be able to discuss real-world experience candidly; students are expected to behave responsibly.

The campus's policy (and my policy) on this should be clear: you may not break into machines that are not your own; you may not attempt to attack or subvert system security. Breaking into other people's systems is inappropriate, and the existence of a security hole is no excuse.

Feedback

I always welcome any feedback on what I could be doing better. You are also welcome to send me feedback anonymously.