News

• [Dec 3] Vern Paxon's security course page has good slides on practically every topic, including sql and web security:
  • http://www.icir.org/vern/cs161-sp13/slides/2.26.WebAttacks2.pdf
  • http://www.icir.org/vern/cs161-sp13/slides/2.28.WebAttacks3.pdf
  and others:
  • http://www.icir.org/vern/cs161-sp13/slides/2.14.NetControl.pdf
  • http://www.icir.org/vern/cs161-sp13/slides/2.7.NetAttacks.pdf
  • http://www.icir.org/vern/cs161-sp13/slides/2.12.NetAttacks2.pdf
  • http://www.icir.org/vern/cs161-sp13/slides/2.21.DoS-WebAttacks.pdf
• [Sep 28] Old 414 exams and hws
• [Sep 9] Schedule
• We will be using this Piazza account: https://piazza.com/umd/fall2014/cmsc4140101

Overview

This course is an introduction to the broad field of computer and network security. We cover the following areas:
• Cryptography: secret key, hash functions, public key.
• Authentication protcocols (e.g., Needham-Schroeder, Diffie-Helman),
• Some topics in software security (e.g., OS mechanisms, buffer overflow).
• Some topics in network security (e.g., virtual private networks, SSL, IPsec, Web security).

Coursework

• 2 midterms total: approx 30%.
• Final: approx 20%.
• Projects total: approx 50%.
  Note: you will fail if you do not achieve a passing grade (what I consider a good-faith attempt) on the projects.
"Approx" means +/− 10% (e.g., projects can become 40% and the quizzes can become 40%).

Projects

We will have programming projects in the following areas:
• Crypto: secret-key crypto; hash functions; public-key crypto and PKI.
• Buffer overflow attacks.
• Web attacks: cross-site scripting and forgery, SQL injection.
The projects will be based on the projects described in SEED. They are done on a Linux VM. Please download the following:
• VM (approx 2GB).
• User manual; has login info for the VM.
• Virtualization software (emulating the hardware on which to run the VM). There are several good options. VirtualBox is one.

Notes/text:

• The crypto and authentication parts are covered by the following text: Network Security: Private Communication in a Public World by Kaufman, Perlman, and Speciner. The second edition (cheaper) is fine. The first edition (dirt cheap) is probably sufficient too.
• Slides.
  • crypto-slides_may2013.pdf
  • authentication-slides_may2013.pdf
  • standards-slides_may2013.pdf
  • web-slides_may2013.pdf
• Material from the web.

Regrade requests

Any regrade request (for exams and projects) must be submitted within a week of the grade being posted.

Academic Integrity

All projects are to be done individually. You may consult outside references. You can discuss code in general terms. Do not see anyone else's code or writeup. Do not show your code or writeup to anyone else, or leave it in an unsecure place (e.g., your unsecured laptop). We will check for similarities.

Academic dishonesty.