Printer-friendly version

CSci 5271: Introduction to Computer & Network Security

• Use a computer system in a secure manner.
• Recognize common vulnerabilities in protocols, designs, and programs.
• Eliminate or minimize the impact of these vulnerabilities.
• Apply the principal security standards in use today to design and build secure applications.
• Apply principles, concepts, and tools from security to your own research.

• By far the best book on computer security is Ross Anderson's "Security Engineering", 2007, John Wiley and Sons. This book contains many examples of how adversaries think and is very well-written.  The book is also available online; if you find yourself referencing the book heavily, you should consider buying a copy (it will be only a little more expensive than printing the whole thing, and will look much nicer).
  
  
• The "required" textbook for past editions of this course was Dieter Gollmann's "Computer Security, 2nd edition", 2006, John Wiley and Sons. This book is not perfect but has the advantage of being (relatively) inexpensive, while covering most topics at about the right depth for an introduction.  You can read a little about almost every lecture topic in this book.
  
  "Software Security" References:
  

• A widely-respected source on many of the "software security" problems and solution techniques we will discuss in the first six weeks of class is Viega & McGraw's "Building Secure Software: How to Avoid Security Problems the Right Way," 2001, Addison-Wesley.  In general, students that have less background in C programming will find this book very useful for the first four weeks of class, while students comfortable with C, assembly, and debuggers may not find it very useful.
  
  
• A useful online source on software security is David Wheeler's "Secure Programming for Linux and Unix." (2003)
  
  "Network Security" References:
  

• One of the best references at combining some practical and theoretical issues of network security is Cheswick, Bellovin, and Rubin's "Firewalls and Internet Security, 2nd edition," Addison-Wesley, 2003.  This book covers several of the concepts we'll be discussing in the second "half" of the course - weeks 7-12.  Students with no coursework or experience in networking may want to purchase this book.
  
  
• A somewhat dated but still useful first edition of this book is available online.  If you plan to work in network security, do the authors a favor and buy the updated edition; it's better anyways.  (For example, you might notice that the first edition mentions a new invention called the "world wide web")
  
  Cryptography References:
  
  
• A very good reference on designing cryptographic software for common tasks is Schneier and Ferguson's "Practical Cryptography," John Wiley and Sons. 
  
  
• Students interested in learning more about cryptography are encouraged to take CSci 5471.  Professor Kim uses Manezes, Van Oorschot, and Vanstone's "Handbook of Applied Cryptography", which is also available online here, as the textbook.  Another good introductory reference to the applied theory of cryptography is this set of lecture notes by Goldwasser and Bellare.
  

• Exercises: After every lecture, we will post, on the class web page, an exercise that will ask you to apply the concepts covered in class.  Every Tuesday by the end of lecture, you should turn in one exercise, written up in electronic form, to be graded.  This does not mean you should only solve one exercise!  Exam questions will be of similar difficulty and content to the exercises, so it is to your advantage to think about solutions to all exercises.
  
  Students may work in pairs on the exercises, but be warned: you are responsible for the choice of your partner.  This means that if your partner "was supposed to turn in the assignment" and didn't, or "didn't finish part c" of an exercise, you will not receive any special consideration in grading.
  
  Late submissions:  exercises turned in by 4pm on Wednesday are worth 50%, and after that they are worth 0.
  
  
• Homeworks: There will be one programming homework for each of the two "units" in the class:  software security and network security.  Homeworks and due dates will be posted to the class web site.  Students may work in pairs on the homeworks as well, with the same caveat about your choice of partner; however, working alone on the homeworks is highly discouraged.  In order to succeed on these homeworks you will need some understanding of C programming and UNIX shell programming.
  
  Late submissions: homeworks are worth 50% up to 24 hours after the submission deadline and 0 points after that. 
  
  
• Exams: An open-book, open-notes midterm exam, on Tuesday, October 7, and an open-book, open-notes final exam on Tuesday, December 16. Both exams will include multiple choice and short answer questions.  Please notice that the exam dates are fixed and there will be no makeup exams.
  
  
• Course Project. Course projects should attempt to perform original work related to computer security. Projects will be done in groups, and will be graded based on a presentation (15%), first draft (15%) and final paper (70%), along with mandatory progress meetings with the instructor.  More information on projects will be posted on the course website.