Computer and Network Security

Fall 2001


Professor Bill Arbaugh (waa@cs.umd.edu)
TA Evren Sirin (evren@cs.umd.edu): Office hours: Tu 10:00 - 11:00; Th 3:30 - 4:30 AVW 1152 (TA room) and by appointment
Time TuTh: 11:00 - 12:15
Place CLB 0102
Office hours TuTh: 1:00 - 2:00 and by appointment (AVW 4137)
Text Preprints from Computer Security: Art and Science by Matthew A. Bishop to be published by Addison Wesley Longman, Inc.

The preprints will be available in the book store by Tuesday, September 4th.

The text will also be supplemented with additional papers which you can find links to on this page.


 
 
Prerequisites
A grade of C or better in CMSC 311 and CMSC 330. 

NOTE: This course will cover a wide range of topics within computer science. If you are unable to quickly grasp these issues, you will have difficulty in the class. Review the course material here to ensure you're comfortable with the level. Also, all of the homework will include programming projects in java. If you are not comfortable programming, you will have great difficulty in this class.

Course Description
Until recently, information systems security has only been a focus of the military, and the financial communities. With the recent explosive growth and merging of telecommunications and computing, security has become an integral element of any reliable and robust information systems environment. Unfortunately, most current commercial products ignore security in favor of a user friendly environment and performance. The side-effects of this decision are now well documented in the press.

This class will cover information systems security at the under graduate level. 

Course Work
There will be several homework assignments (written and programming) as well as mid-term, and final examinations. A systems oriented term project will also be required.

NOTE: All work that you submit in this course must be your own; unauthorized group efforts are considered academic dishonesty. See the Undergraduate Catalog for definitions and sanctions.

All written and programming assignments will be submitted to a cvs repository under your home directory on classwork.missl.cs.umd.edu.

All programming assignments MUST be turned in electronically here prior to the beginning of class on the date due. Details for the submission of each assignment will be included in the assignment.

Late assignments will only be accepted under exceptional circumstances AND with prior arrangement. A penalty may apply.

Grading Policy
 Final grades will be determined using the following distribution:

 

Homework 15%
Midterm 20%
Project 30%
Final 25%
Class Participation 10%

Programming assignments and the course project will be graded on correctness as well as documentation. A project that fails on the provided test cases (and those used in grading) will not receive a favorable grade. A project that passes all tests, but does not contain reasonable documentation will also not receive a favorable grade. Security is a subset of reliability- good design and documentation increases the reliability of your code and thus the security.

Your class participation grade will be determined by your on time attendance to class, your participation in classroom discussions, and your scores on pop quizzes. Pop quizzes, when given, will cover material previously covered in class, previous reading assignments, and simple questions on the days reading assignment.
 
Schedule of Classes
No. Date Topic and Reading Assignment
1 Aug 30
Introduction and Motivation 

Chapter 1 

2 Sep 4 Foundations: Basic Encryption and Decryption

Chapter 9 up to section 9.2.2

More information on Vigenere and index of coincidence.
 

3 Sep 6

Foundations: Symmetric Encryption

Sections 9.2.2 and 9.2.3

Handout on AES

Slides
 

4 Sep 11

Foundations: Asymmetric Encryption and Cryptographic Hashes

Sections 9.3 and 9.4

Why Cryptosystems Fail, Ross Anderson. 

Slides
 

5 Sep 13
Foundations: Access Control

Chapter 2

6 Sep 18
Key Management

Chapter 10

Homework #1 due.

Homework #2 handed out in class. 
 

7 Sep 20
8 Sep 25

All classes cancelled due to Tornado
 

9
Sep 27

Cipher Techniques and Network Security

Chapter 11 (Focus on SSL and IPsec)

 

10 Oct 2
11 Oct 4

Policy: Security Policies

Chapter 4

12 Oct 9
Policy: Confidentiality

Chapter 5 through 5.2.2

 

13 Oct 11

Policy: Integrity

Chapter 6 through 6.3

Homework #3 due.

 

14 Oct 16 Review for Midterm
15 Oct 18
Midterm
16 Oct 23
Java Security

Chapter 2 and Chapter 3 of Securing Java, Gary McGraw and Ed Felton.

17 Oct 25
Java Security

Chapter 4 of Securing Java, Gary McGraw and Ed Felton.

18 Oct 30 Vulnerability Analysis

Chapter 19

Attack Trees, Bruce Schneier

19 Nov 1 Project Discussion
20 Nov 6

Authentication

Chapter 12

Design Principles

Chapter 13

21 Nov 8 Identity

Chapter 14

Access Control Mechanisms

Chapter 15

22 Nov 13 Confinement Problem

Chapter 17

Example source code for file existence channel

Malicious Logic

Chapter 18

23 Nov 15 Auditing

Chapter 20

24 Nov 20 Intrusion Detection

Chapter 21

25 Nov 27 Project day - no class
26 Nov 29 Project day - no class
27 Dec 4 Catch up on Chapter 17 and 18
28 Dec 6 Buffer Overflows

Smashing the Stack for Fun and Profit, Aleph One

Incident handling and forensics: What to do when things go bad!

Dan Farmer and Wietse Venema's Forensic links

29 Dec 11 Course Review
FINAL Dec 14 8:00am - 10:00am CLB 0102