What to expect

Tentative Syllabus

If there is some topic of keen interest to you, speak up soon!

  • Overview
  • Robust Programming, Secure Coding, Vulnerabilities
  • Design Principles
  • OS Protection, ACLs, Capabilities, Confinement
  • Classical Cryptography
  • Public-key Cryptography
  • Identity & Authentication
  • Firewalls, SSL, IPSec
  • Incident Handling
  • Forensics
  • Access Control Models
  • Models of Confidentiality & Integrity

Communication

  • Read the blog http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/
    • Use a RSS reader such as Google Reader or Bloglines or any other RSS reader
    • Subscribe to both articles and comments:
      • http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/feed/
      • http://www.cs.rochester.edu/~bukys/csc290b-spring-2008-2009/blog/comments/feed/
  • Ask public questions (useful to entire class) by posting comments to the blog.
  • Ask private questions by email to CSC290B@cs.rochester.edu which will reach both the instructor and the TA.

Grading

  • 10% Quizes - frequent, short, based on required readings, some pre-lecture, some post-lecture
  • 5% Class participation-based discretionary adjustment
  • 5% Involuntary Servitude - you can volunteer or be volunteered - occasional, quick followup post-lecture investigations, resulting in slides and brief presentations, or blog articles; expect to do 2 or 3 during the semester
  • 30% Programming Assignments - not equally weighted
  • 10% Project - written report [topics to be determined], possibly some modest implementation component
  • 20% Midterm exam
  • 20% Final exam

Programming

  • You will be required to write some modest programs with a variety of languages (e.g. C/C++, Java, scripting languages such as Perl, Python, or PHP, special-purpose languages such as SQL), runtime libraries (e.g. OpenSSL), and programming environments (e.g. Linux, Apache CGI, etc).  You must be comfortable with programming even with unfamiliar tools and finding what you need to get the assignments done.
  • Some assignments will include evaluating each other’s code and assessing it for security vulnerabilities. Clear write-ups documenting security problems (or suspected weaknesses) with course infrastructure (e.g. this website, or assignment turn-in procedures) would be welcome and worth bonus points toward grades. Actually exploiting weaknesses would not be welcome. Deliberate disruptions of course or department systems would be grounds for academic disciplinary action.
  • Assignments will be individual and code should not be shared or viewed without prior arrangement with the instructor.
  • The US Department of Defense Cyber Crime Center sponsors an annual competition in digital forensics, the DC3 Challenge. Registration is in February, the exercises are announced in March, and solutions are not due until November. In March I may decide to assign one or more of these challenge problems as programming assignments. Perhaps members of the class will become interested enough to form teams and compete for the whole year. See the DC3 challenge web site for a description of prior-year challenge problems and contestant solutions.

Leave a comment