January 29, 2009, 5:15 PM
There are lots of readings on today’s topic, “Confinement.” There will be at least one quiz question on each of the non-optional readings. They are all interesting, though, so enjoy it.
January 14, 2009, 10:04 PM
Due Date: Friday, January 16, 5PM
- Browse the CSC290B blog, find this assignment, and post a comment that includes:
- your name
- what RSS reader you plan to use
- a list of the programming languages with which you are at least somewhat familiar
- a list of the most advanced courses you have taken in programming languages, operating systems, and networks
- any other possibly-relevant background you may have
- Visit Marty Guenther in room 735 to establish or renew your CSUG account. Login to your CSUG account and send an email to csc290b@cs.rochester.edu stating where you would like private emails sent (i.e. to your CSUG account or some other email account).
- Check the Lectures & Readings link for the first reading assignment. The first textbook chapter is available online, but you’ll need to find a paper copy of the text for subsequent chapters.
January 14, 2009, 9:24 PM
Tentative Syllabus
If there is some topic of keen interest to you, speak up soon!
- Overview
- Robust Programming, Secure Coding, Vulnerabilities
- Design Principles
- OS Protection, ACLs, Capabilities, Confinement
- Classical Cryptography
- Public-key Cryptography
- Identity & Authentication
- Firewalls, SSL, IPSec
- Incident Handling
- Forensics
- Access Control Models
- Models of Confidentiality & Integrity
Communication
- Read the blog http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/
- Use a RSS reader such as Google Reader or Bloglines or any other RSS reader
- Subscribe to both articles and comments:
- http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/feed/
- http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/comments/feed/
- Ask public questions (useful to entire class) by posting comments to the blog.
- Ask private questions by email to CSC290B@cs.rochester.edu which will reach both the instructor and the TA.
Grading
- 10% Quizes - frequent, short, based on required readings, some pre-lecture, some post-lecture
- 5% Class participation-based discretionary adjustment
- 5% Involuntary Servitude - you can volunteer or be volunteered - occasional, quick followup post-lecture investigations, resulting in slides and brief presentations, or blog articles; expect to do 2 or 3 during the semester
- 30% Programming Assignments - not equally weighted
- 10% Project - written report [topics to be determined], possibly some modest implementation component
- 20% Midterm exam
- 20% Final exam
Programming
- You will be required to write some modest programs with a variety of languages (e.g. C/C++, Java, scripting languages such as Perl, Python, or PHP, special-purpose languages such as SQL), runtime libraries (e.g. OpenSSL), and programming environments (e.g. Linux, Apache CGI, etc). You must be comfortable with programming even with unfamiliar tools and finding what you need to get the assignments done.
- Some assignments will include evaluating each other’s code and assessing it for security vulnerabilities. Clear write-ups documenting security problems (or suspected weaknesses) with course infrastructure (e.g. this website, or assignment turn-in procedures) would be welcome and worth bonus points toward grades. Actually exploiting weaknesses would not be welcome. Deliberate disruptions of course or department systems would be grounds for academic disciplinary action.
- Assignments will be individual and code should not be shared or viewed without prior arrangement with the instructor.
- The US Department of Defense Cyber Crime Center sponsors an annual competition in digital forensics, the DC3 Challenge. Registration is in February, the exercises are announced in March, and solutions are not due until November. In March I may decide to assign one or more of these challenge problems as programming assignments. Perhaps members of the class will become interested enough to form teams and compete for the whole year. See the DC3 challenge web site for a description of prior-year challenge problems and contestant solutions.