Welcome to CS 526 (Information Security)!

Instructor: Christina Garman (clg@purdue.edu)

TA: Pedro Moreno Sanchez (pmorenos@purdue.edu)

Course catalog: Basic notions of confidentiality, integrity, availability; authentication models; protection models; security kernels; secure programming; audit; intrusion detection and response; operational security issues; physical security issues; personnel security; policy formation and enforcement; access controls; information flow; legal and social issues; identification and authentication in local and distributed systems; classification and trust modeling; and risk assessment.

You should hopefully come out of this course with a broad understanding of information security, focusing on software security, network security, cryptography, mobile platform security, and privacy technologies, as well as how these security issues can impact real world systems.

Time: Tu/Th 10:30am-11:45am
Location: Lawson Computer Science Bldg, B134
Syllabus

Prerequisites:

• CS 503 - Operating Systems: I will assume that you have had this course, and you will be responsible for knowing the material even if you have not.

• Programming experience: Some of the assignments will require programming knowledge, so you should be comfortable programming.

My office hours will be held on Thursdays directly after class (12pm-1:30pm) in Lawson 3154G. Pedro's office hours will be Wednesdays from 10am-11am in Haas G50.

I will be available by appointment as well.

The exact mix of projects, homeworks, etc. is yet to be determined. However, expect there to be approximately three large projects with a few small assignments mixed in and two exams (a midterm and a final), with the approximate weights as follow. Part of your grade will include a participation component, so I do expect you to attend class. If you cannot make class for any reason (such as job interviews, etc.), please let me know as you will not be penalized for this.

• Projects: 50%

• Assignments: 15%

• Exam 1: 15%

• Exam 2: 15%

• Class participation: 5%

Assignments are due at the beginning of class at 10:30am on the stated due date. Late assignments will be penalized 5 percentage points per day. There is no collaboration allowed on exams. You must do only your own work. There are no textbooks, notes, or computers allowed during exams.

Final grades will be assigned on a curve at the end of the course.

This schedule is subject to change.

Date	Topics	Readings
1/9/18	Introduction, Threat Modeling	Reflections on Trusting Trust The Security Mindset How to Think Like a Security Professional
1/11/18	Software Security	Smashing the Stack for Fun and Profit
1/16/18	Software Security	Basic Integer Overflows Exploiting Format String Vulnerabilities Optional: Memory Safety Attacks and Defenses	Project 1 Assigned
1/18/18	Malware	Optional: How to 0wn the Internet in Your Spare Time Optional: A Report on the Internet Worm
1/23/18	OS Security	Optional: Android System and Kernel Security Optional: iOS Security Guide
1/25/18	OS Security, Access Control	Access Control: Principles and Practice
1/30/18	Intro to Networking, TCP/IP	Brief History of the Internet Optional: A Look Back at "Security Problems in the TCP/IP Protocol Suite"
2/1/18	Network Security (TCP/IP)	SYN Flood Attack	Project 1 Due
2/6/18	Network Security (DoS, Firewalls, DNS)	An Illustrated Guide to the Kaminsky DNS Vulnerability	Project 2 Assigned
2/8/18	Network Security Wrap-Up (DNS), Web Security (SQL Injections)	Web Security: Are You Part of the Problem? SQL Injection
2/13/18	Web Security (CSRF, XSS)	Cross-Site Request Forgery Optional: Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet Optional: XSS Filter Evasion Cheat Sheet
2/15/18	Passwords and Authentication	User Authentication Notes
2/20/18	Catch-Up
2/22/18	Basics of Cryptography		Project 2 Due
2/27/18	Basics of Cryptography
3/1/18	MIDTERM		MIDTERM
3/6/18	Symmetric Cryptography	Symmetric Key Cryptography Notes
3/8/18	Symmetric Cryptography
3/13/18	SPRING BREAK
3/15/18	SPRING BREAK
3/20/18	Public Key Cryptography	Public Key Cryptography Notes	Project 3 Assigned
3/22/18	Public Key Cryptography
3/27/18	PKI, SSL/TLS	Optional: Lessons Learned in Implementing and Deploying Crypto Software
3/29/18	SSL/TLS and Attacks [Protocols]
4/3/18	Privacy and Anonymity (Tor, PGP)	Tor: The Second-Generation Onion Router
4/5/18	Bitcoin, Blockchains	Bitcoin: A Peer-to-Peer Electronic Cash System
4/10/18	Zerocoin, Zerocash, Zcash		Project 3 Due
4/12/18	Ethics, Policy, and Law	Vulnerability Disclosure Cheat Sheet Optional: Coders' Rights Project Vulnerability Reporting FAQ	Project 4 Assigned
4/17/18	Side-Channels, Covert Channels	Optional: Lest We Remember: Cold Boot Attacks on Encryption Keys
4/19/18	Censorship Resistance
4/24/18	Mobile Security, IoT Security, Secure Messaging
4/26/18	Catch-Up, Review, Last Minute Questions		Project 4 Due
5/3/18	FINAL EXAM	1-3pm in Lawson B151	FINAL EXAM

All projects will be submitted on Blackboard unless otherwise noted.

• Project 1: Due Thursday February 1st, 2018 at 10:30am (Extended to Sunday February 4th, 2018 at 11:59pm)

• Project 2: Due Thursday February 22nd, 2018 at 10:30am

• Project 3: Due Tuesday April 10th, 2018 at 11:59pm (Extended to Friday April 13th, 2018 at 11:59pm)

• Optional -- Project 4: Due Friday April 27th, 2018 at 11:59pm

All assignments will be submitted on Blackboard unless otherwise noted.

• Assignment 0: Due Thursday May 3rd, 2018 at 11:59pm

• Assignment 1: Due Tuesday January 16th, 2018 at 10:30am

There will be readings listed for each day of class pertaining to the material we will cover, and I will expect that you have at least tried to read them (though it is okay if you do not understand everything right away!).

No textbook is required, but if you would like additional resources the following may be useful:

• Security Engineering by Ross Anderson

• Computer Security: Principles and Practice, Prentice Hall, 2007. By William Stallings and Lawrie Brown.

The Department of Computer Science expects and enforces the highest standards of academic integrity and ethics. The Department takes severe action against academic dishonesty, which may include failing grades on an assignment or in a course, up to a recommendation for dismissal from the University.

Academic dishonesty is defined as any action or practice that provides the potential for an unfair advantage to one individual or one group. Academic dishonesty includes misrepresenting facts, fabricating or doctoring data or results, representing another's work or knowledge as one's own, disrupting or destroying the work of others, or abetting anyone who engages in such practices.

Academic dishonesty is not absolute because the expectations for collaboration vary. In some courses, for example, students are assigned to work on team projects. In others, students are given permission to collaborate on homework projects or to have written materials present during an examination. Unless otherwise specified, however, the CS Department requires all work to be the result of individual effort, performed without the help of other individuals or outside sources. If a question arises about the type of external materials that may be used or the amount of collaboration that is permitted for a given task, each individual involved is responsible for verifying the rules with the appropriate authority before engaging in collaborative activities, using external materials, or accepting help from others.

A student accused of academic dishonesty must be afforded due process as defined by Purdue University procedures. The Dean of Students Office may be notified concerning an academic dishonesty incident as provided by Purdue University procedures.

Last modified Tue 17 April 2018.