CS 526 Lectures, Handouts & Homeworks

(Fall 2013)

	Tuesday	Thursday
Week 1 (Aug 19 -- Aug 23)	Overview of the course (PPT) Readings Information Security on Wikipedia	Cryptography: Classical Ciphers (PPT) Readings Cryptography on wikipedia
Week 2 (Aug 26 -- Aug 30)	Cryography: One-Time Pad, stream ciphers, etc. (PPT) A note on perfect secrecy. Readings (on wikipedia) One-Time Pad Information Theoretic Security Stream cipher Pseudorandom number generator	Cryography: Block cipher, etc. (PPT) Readings (on wikipedia) Block Cipher Data Encryption Standard Advanced Encryption Standard Semantic Security Block cipher modes of operation
Week 3 (Sept 2 -- Sept 6)	Cryptographic hash functions and message authentication code. (PPT) Readings (on wikipedia) Cryptographic hash function Message Authentication Code	Public key cryptography. (PPT) Readings Public key cryptography RSA Diffie-Hellman ElGamal New Directions in Cryptography
Week 4 (Sept 9 -- Sept 13)	User authentication. (PPT) Readings Password Password strength Password cracking Password salts Trusted Path One-time Password	No new slides. Continue with previous topic.
Week 5 (Sept 16 -- Sept 20)	Web Security (1). (PPT) Readings HTTP Cookie Same Origin Policy Cross Site Scripting Cross Site Request Forgery	Web Security (2). (PPT) Slides on SQL injection from Prof. V. N. Venkatakrishnan at UIC Slides on Side Channel attacks Optional Readings Bandhakavi et al.: CANDID : Preventing SQL Injection Attacks Using Dynamic Candidate Evaluations Chen et al.: Side-Channel Leaks in Web Applications: a Reality Today, a Challenge Tomorrow
Week 6 (Sept 23 -- Sept 27)	OS Security Basics & Unix Access control. (PPT) Readings CPU modes System call Filesystem permissions UNIX File and Directory Permissions and Modes Unix file permissions	No new slides. Continue with previous topic. Quiz 2
Week 7 (Sept 30 -- Oct 4)	Secure communication. (PPT) Secure communication. Readings Needham-Schroeder protocol (only the symmetric key part) Public Key Certificate Transport Layer Security HTTP Secure	Software Vulnerabilities (PPT) Readings Privilege escalation Directory traversal Time-of-check-to-time-of-use Stack buffer overflow Buffer overflow protection Format string attack Integer overflow Smashing The Stack For Fun And Profit by Aleph One
Week 8 (Oct 7 -- Oct 11)	No class. (October break)	No new slides.
Week 9 (Oct 14 -- Oct 18)	Mid term exam. Covering topics 1-11.	Overview of Malware (PPT) Readings Malware Computer virus Computer worm Botnet Spyware Rootkit
Week 10 (Oct 21 -- Oct 25)	No new slides. Continue with previous topic.	Malware Defense (PPT) Slides on "The Base Rate Fallacy and its Implications for the Difficulty of Intrusion Detection"
Week 11 (Oct 28 -- Nov 1)	Market Failure of Secure Software(PPT) Discretionary Access Control(PPT) Readings Discretionary Access Control The Confused Deputy Problem	Continue with previous topic. Presentation on Project 2
Week 12 (Nov 4 -- Nov 8)	Topic 18: Network Security (PPT) Optional Readings Steve Bellovin: A Look Back at "Security Problems in the TCP/IP Protocol Suite"	Topic 19: DNS Security (PPT) Optional Readings Steve Friedl: An Illustrated Guide to the Kaminsky DNS Vulnerability Dan Kaminsky: Presentation at BlackHat 2009
Week 13 (Nov 11 -- Nov 15)	Quiz 3. Covering Topics 12-16. The Bell LaPadula Model(PPT) Readings The Bell LaPadula Model Looking Back at the Bell-La Padula Model	Non-interference and non-deducability(PPT) Optional Readings Goguen and Meseguer. "Security Policies and Security Models".
Week 14 (Nov 18 -- Nov 22)	Integrity Protection Models(PPT) Optional Readings A Comparison of Commercial and Military Computer Security Policies Biba: Integrity Considerations for Secure Computer Systems	Trusted Operating Systems and Assurance(PPT)
Week 15 (Nov 25 -- Nov 29)	Quiz 4 (Covering topics 17-21) Role Based Access Control (PPT) Readings Role Based Access Control Models	No class. (Thanksgiving.)
Week 16 (Dec 2 -- Dec 6)	Continue with previous topic Videos HP Protect 2013: Software Security Keynote with Gary McGraw Patrice Godefroid - Automated Whitebox Fuzz Testing with SAGE Jacob West: Static source code analysis