CSE 409/509 Fall 2010. System Security

• The final exam is in the same location as the class. Light Engineering 102.
• Notes for all lectures are now uploaded. Good luck on your finals!
• Project options are now posted.
• 10/27. Solutions to the Midterm Problems are now available.
• 10/12. You can look at old midterms and finals to get an idea of what my tests look like: Midterm, Spring 2009, Final, Spring 2009, Midterm, Spring 2007, Final, Spring 2009.
• 9/2. Our new mail system does not support my rob+509r@cs.sunysb.edu address, so just mail reviews to rob@cs.sunysb.edu, but please include "509r" in the subject line. Thanks, and sorry for the technical difficulties.
• 8/31, 2:53pm. The class has moved to a larger room: Light Engineering Lab 102. I have also asked to have the enrollment cap for 509 raised to 92 students. Everyone should be able to sign up now.

Overview

Topics

• Security basics: security goals, threat models, trust, policies, mechanism, security through obscurity
• Isolation: virtual machines, memory protection, user-ids, file permissions, kernel services
• Access control: authentication vs. authorization, access control matrices, access control lists, capabilities, Unix setuid programs
• Shared code: shared libraries, local RPC, mobile code, sandboxing
• Principles of secure system design: least privilege, failsafe defaults, economony of mechanism, least shared mechanism, complete mediation, accountability, psychological acceptability
• Software security: trusted computing base, security kernels, reference monitors, software vulnerabilities, static analysis, dynamic monitoring
• Cryptography: symmetric encryption, message authentication codes, asymmetric encryption, signatures
• Network security: TCP/IP attacks, infrastructure attacks, Denial of Service attacks, firewalls, proxies, VPNs
• Privacy and anonymity: onion routing, anonymous remailers, application-level anonymizers (e.g. web anonymizers), traffic analysis
• Physical security: storage security, memory-corruption attacks, side-channel attacks
• Cutting edge problems: trusted computing, remote attestation, CAPTCHAs, spam
• Policy issues: human factors, incentives

Requirements and Grading

• Paper reviews (10%). We will discuss 1-2 readings each week. You must read the papers before coming to class and write a short (1-2 paragraph) review (not a summary!) of each paper. Your review must give at least two criticisms of each paper. You are responsible for checking the class website to find the readings for the next class. Please email reviews as plaintext (not an attachment!) to rob+509r AT cs DOT sunysb DOT edu. (Note: Only send reviews to this address! All other correspondence should leave out the "+509r"!)
• Homeworks (15%). I will assign 4-6 homeworks throughout the semester.
• Class project (25%). You will work in groups of 2-3 on a class project in computer security.
• Class participation (5%). I strongly encourage discussion and debate in class. Please don't hesitate to ask questions if you don't understand or disagree with anything covered in this course.
• Midterm exam (20%).
• Final exam (25%). The final is cumulative, so it will have questions covering topics from the entire semester.

409 vs. 509. Students in 409 and 509 will follow the same course outline, but will be given different homeworks, exams, and projects.

Note: All review readings in bold have been graded. If you have not received a grade, but did turn in a review - send an email to "rnithyanand" at "cs" dot "stonybrook" dot "edu"

Class Notes

References

• Computer Security: Art and Science, Matt Bishop.
• Security Engineering, Ross Anderson.

Reading Assignments

Note: If you have a physical, psychological, medical or learning disability that may impact on your ability to carry out assigned course work, please contact the staff in the Disabled Student Services office (DSS), Room 133, Humanities, 632-6748v/TDD. DSS will review your concerns and determine with you what accommodations are necessary and appropriate. All information and documentation of disability are confidential.

Note: Each student must pursue his or her academic goals honestly and be personally accountable for all submitted work. Representing another person's work as your own is always wrong. Any suspected instance of academic dishonesty will be reported to the Academic Judiciary. For more comprehensive information on academic integrity, including categories of academic dishonesty, please refer to the academic judiciary website at http://www.stonybrook.edu/uaa/academicjudiciary/.