Computer and Network Security

CMSC 414, Section 0101

Spring 2003

Instructor Bob Fourney (
TA Shang Chieh Wu ( Effective 2/17: Office hours: M 11:00- 12:00 AVW 1151 (TA room) and by appointment
Class Time Section 0101 MW 4:00-5:15
Class Location CSI 2107
Office hours My scheduled office hours (in AVW 1430) will be:

MW 3:30-3:45,
MW 5:15-6:00, and
Frdy 2:00-4:00

These seem to be good times for commuter students who are taking a 4:00-5:15 class. These hours may be adjusted if they are not convenient for a majority of the students. Additionally, I spend most of my time on campus in the Security Lab (AV Williams 1430). If I'm in, I can usually make time to talk to students. If you are coming from off campus, please contact me by phone or email to make an appointment and ensure that I will be avilable. Phone number: (301)-405-6750.
Please do not disturb me between the hours of 9:00-12:00 on Mondays and Wednesdays

Text Computer Security: Art and Science by Matthew A. Bishop, published by Addison Wesley Longman, Inc.

This book is now available (albeit in limited quantities) at the bookstores. Depending on how long it will take them to get additional copies, you might want to look at Amazon, the publisher ( Addison Wesley), or other off-campus sources.

The text will also be supplemented with additional articles and papers, most of which will soon be linked below. The remainder will be linked from this page and/or handed out in class as they are assigned.

Class news group csd.cmsc414
Computer Accounts You have been issued an acouunt on the CSIC Linux Lab machines. These accounts are not on the detective cluster, and they are not administered by the OIT. Check out the above link for basic information. If you have further questions, consult the Linux lab news group: csd.csiclab, the TA, or myself.

Breaking News:

If you are one of the students who received additional points for problem 3 on the midterm (or any other problem), please bring your midterm exam to the final exam in order to ensure that you receive the credit you deserve.

0. A list of topics to concentrate on for the final exam and a way to estimate your project grade.

1. Here are a couple of the scenarios you might be asked to work with in your PKI project.

2. Some of you emailed to say you lost your copy of Homework 5. Also note that, as per class discussion on Wednesday, I will count the best 4 of the 5 homeworks. If you're happy with your homework grade, you may skip this one and concentrate on your project. As you work on the project, keep Homework 5 in mind, you may find that you've completed most of the requirements (especially if your Homework 4 was implemented correctly) simply by working on your project.

3. Documentation and technical info on the CSIC Linux Lab, as well as administrative info (such as hours of operation).

A grade of C or better in CMSC 311 and CMSC 330 and permission of the department. 

The material covered in this course is not very difficult, BUT there is a great deal of material and it covers a wide range of topics within the area of computer science. You do not want to fall behind in this class, and if you are unable to quickly grasp these varied concepts you will have difficulty. This is a Computer Science course, and the homeworks and project will involve programming. If you are not comfortable with programming, you will have difficulty in this class. If you fail to complete the final project you will fail this class

Course Description
This class serves as an introduction to information systems security and covers security issues at an undergraduate level

In the past, information systems security has been of legitimate concern only to the military, members of various financial communities, and a very small set of commercial systems . With the recent explosive growth and merging of telecommunications and computing, security has become an integral element of any reliable and robust information systems environment. Unfortunately, most current commercial products ignore security in favor of a user friendly environment and performance. The side-effects of this decision are now well documented in the press. It therefore stands to reason that future computer science graduates will require a working knowledge of the basic security issues discussed in this class. 

Course Work
There will be several homework assignments, each of which will require both written and programming exercises, as well as both a midterm and a final examination. A programming term project will also be required.

Unless otherwise specified, all work that you submit in this course must be your own; unauthorized collaboration is considered academic dishonesty. Please save us both a lot of trouble by realizing that I will pursue any such transgressions to the fullest extent possible.

Details for the submission of each assignment will be included in the assignment or provided via this webpage. All assignments MUST be turned in prior to the beginning of class on the date due. This may require handing in written results in the classroom prior to the start of class, or submitting them electronically as per the directions included with the assignment. As a rule, late assigments are not generally accepted (e.g., attempting to hand in an assigment after the start of class on the due date will result in a grade of 0 for that assignment).

Late assignments will only be accepted under exceptional circumstances AND with prior arrangement. A penalty may apply.

Grading Policy
 Final grades will be determined via the following breakdown:

Homework 15%
Midterm 25%
Project 20%
Final 30%
Class Participation 10%

Programming assignments and the course project will be graded on both correctness and documentation. A project that fails on the provided test cases (and those used in grading) will obviously not receive a favorable grade. A project that passes all tests, but does not contain reasonable documentation will also not receive a favorable grade. Security is a subset of reliability- good design and documentation increases the reliability of your code and thus the security.

Your class participation grade will be determined by your on time attendance to class, your participation in classroom discussions, and your scores on pop quizzes. Pop quizzes, when given, will cover material previously covered in class, previous reading assignments, and simple questions on the current days reading assignment.

Please read Making the Grade by Kurt Wiesenfeld and keep his views (which I share) in mind when deciding how much effort to invest in your coursework.

Schedule of Upcoming Classes
No. Date Topic and Reading Assignment
1 Jan 29
Introduction and Motivation 

Chapter 1

Reflections on trusting trust, Thompson. 
Risk Management is Where the Money Is, Daniel Geer. 

Homework 1 handed out in class and the point breakdown.

2 Feb 3 Foundations: Basic Encryption and Decryption

Chapter 9 through section 9.2.2

The example on breaking Vigenere Ciphers (via Kasiski's method) discussed in class.

More information on Vigenere and index of coincidence.

Vigenere encoder/decoder

3 Feb 5

Foundations: Symmetric Encryption

Sections 9.2.3 and 9.2.4

4 Feb 10

Foundations: Asymmetric Encryption and Cryptographic Hashes

Sections 9.3 and 9.4

Why Cryptosystems Fail, Ross Anderson. 

Remedial information on modular arithmetic. You are not responsible for ring or group theory, but should be able to add, subtract, multiply, and raise numbers to an exponent (mod whatever), as well as explain when and why you may not be able to find multiplicative inverses.

Homework 1 Due prior to class

Homework 2 handed out in class

Homework 2 FAQ, and format requirements.

Homework 2 Submit Instructions

Sun's Sockets tutorial

5 Feb 12 Foundations: Access Control

Chapter 2

6 Feb 17 Class Cancelled due to snow. Homework 2 now due 2/19 at 4:00 pm
7 Feb 19 Class Cancelled due to snow. Homework 2 is still due at 4:00 pm today
If you have your documentation in electronic form, send it along with the source code. If not, bring it to my mailbox or my office next time you are on campus.
8 Feb 24 Security Policies

Chapter 4

Chapter 5 through
and 5.3 to 5.3.1 Homework 3 to be handed out in class

Homework 3 format requirements.

9 Feb 26 Integrity

Chapter 6 through 6.3
Key Management

Chapter 10

10 Mar 3 Authentication

Chapter 12

Look at: Ten Windows Password Myths by Mark Burnett. (You won't be tested on anything specific to Windows, but this reading provides some different examples of some of the issues we discuss in Chapter 12)

11 Mar 5 Design Principles

Chapter 13

12 Mar 10 Cipher Techniques and Network Security Protocols

Chapter 11 (We will not go into great detail on Section 11.4.1 (Privacy Enhanced Mail) but will instead concentrate on the other two examples in 11.4)

Kerberos: An Authentication Service for Computer Networks

Homework 4 to be handed out in class.

and format

13 Mar 12 Representing Identity (Chapter 14)
14 Mar 17 Some catch up and and some review. There will be new material discussed today, and it will be on the exam. Chapter 15 will not be covered until after this exam, and will therefore not be on the exam.
-- Mar 17 Evening review session for Midterm Exam

5:30 pm in CSIC 2107

15 Mar 19 Midterm Exam. Closed book, no notes, etc
-- Mar 24 No Class -- Spring Break
-- Mar 26 No Class -- Spring Break
16 Mar 31 Access Control, chapter 15
17 Apr 2 Confinement problem

Chapter 17
18 Apr 7 Malicious Logic

Chapter 22

19 Apr 9 Mobile Code and Java Security
Chapters 2 and 3 of Securing Java
by Gary McGraw and Ed Felten,
published by John Wiley & Sons, Inc.

(you may also want to look at Chapter 1, which mainly provides background and motivation which you should have already soaked up by this point in the course.)

20 Apr 14 Detailed project discussion.

Last day to drop with a W

21 Apr 16 Mobile Code and Java Security, Continued: Malicious and Attack Applets
Chapter 4 and 5 through section 5.4 of Securing Java
by Gary McGraw and Ed Felten,
published by John Wiley & Sons, Inc.
22 Apr 21 Vulnerability Analysis

Chapter 23

23 Apr 23 Auditing

Chapter 24

24 Apr 28 Intrusion Detection

Chapter 25

25 Apr 30

Buffer Overflows:

Smashing the Stack for Fun and Profit by Aleph One.

26 May 5 Catch up on previous topics, intro to wireless, and discuss your progress on your project. In fact today's quiz will deal with YOUR project.

Background Info on Wireless Security:

Bernard Aboba's Wireless Page

27 May 7 Wireless network insecurity

UC Berkeley Analysis of WEP
Your 802.11 Network has no clothes

28 May 12

Incident handling and forensics

Dan Farmer and Wietse Venema's Forensic links

Project Due before class today

29 May 14 In class review
--- May 20 Evening Review: 5-7 pm CSIC 2107
Final Exam May 22 1:30-3:30 pm in CSIC 2107 (Section 0101)