01:198:442:01: Introduction to Computer Security

Announcements

• (12/19/2008) Grades have been posted and this course has concluded. If you have not already, please return the OpenMoko phones. Archived announcements are still available here for your enjoyment and edification. It was fun interacting with you all over this semester. Have a good break!

General information

• Course number: 01:198:442:01, Index: 14120.
• Instructor: Vinod Ganapathy (contact information).
• Class hours: Monday and Wednesday, 5:00pm-6:20pm.
• Class location: ARC-105.
• Recitations: Wednesday, 6:55pm-7:50pm.
• Recitation location: ARC-205.
• Instructor's office hours: Mondays, 6:30pm-7:30pm.

• Teaching assistant: Chih-Cheng Chang. [ Recitation webpage ]
• Teaching assistant's office hours: Thursday 3:00pm-4:00pm.

• Required textbook: Computer Security, Principles and Practice, by William Stallings and Lawrie Brown, Pearson Education, Prentice Hall, 2008. ISBN-13: 978-0-13-600424-0; ISBN-10: 0-13-600424-5.
• Additional references:
  • Security Engineering (free online copy), by Ross Anderson.
  • Introduction to Computer Security, by Matt Bishop, Addison-Wesley, October 2004. ISBN 0-321-24744-2

• Prerequisites:
  • 01:198:205 or 14:332:202, Discrete Mathematics (required)
  • 01:198:416, Operating Systems (required)
  • 01:198:352, Internet Technology is strongly recommended (though not required).
  Note that these pre-requisites can be waived upon consent by the instructor.

Course overview

This course will be an undergraduate-level introduction to computer security and is targetted towards seniors, advanced juniors and first year graduate students. We will cover both classic topics, such as applied cryptography, authentication, authorization and basic security principles, as well as recent topics such as Web security and virtual machines for security. For several topics in the course (especially recent topics), we will occasionally read, in addition to our textbook, research papers describing the state of the art.

Syllabus

• Overview: Confidentiality, Integrity, Availability. Security policy and mechanism. Basic principles of secure system design.
• Cryptography: Basic crypto primitives, Secret key crypto, Public key crypto, Digital signatures, Message authentication, Secret sharing, Oblivious transfer, Bit commitment schemes.
• System security: Authentication, Access Control, Discussion of popular systems and security protocols.
• Network security: Network protocols and attacks, Intrusions and Intrusion Detection, Firewalls, Viruses, Worms, Web security.
• Software security: Memory errors and exploits, Isolation, Language-based analysis techniques, Secure coding practices.
• Advanced topics: (time permitting) Virtual machines, Information flow, Privacy, Anonymity.

Schedule

Links to class handouts and research papers referenced on the schedule below are accessible from machines on the rutgers.edu domain.

Homeworks

• Homework 0: Topic: Modular arithmetic self assessment.
• Homework 1: Topic: Cryptography and security protocols.
• Homework 2: Topic: Exploiting buffer overflows.
• Homework 3: Topic: Network security.

Project

Grading

• Homeworks (30%). There will be three homeworks during the course of the semester.
• Mid-term (20%). The mid-term will be held in mid-October and will be based upon topics covered until then.
• Final exam (30%). The final exam will be held during the last week of the semester and will be based upon topics covered during the entire semester.
• Project (20%). The course project will be a significant exercise involving the implementation of concepts covered in class.

You are allowed to discuss the problems in homework assignments with your colleagues, provided that you acknowledge them in your writeup. The writeups must however be your own. For the project, you will work in teams, and can speak with members of other teams. However, each team must write its own code. Any violation of these rules will be dealt with severely. Here is a link to the Rutgers University Academic Integrity Policy.

Resources

Organizations

• CERT -- Carnegie Mellon Computer Emergency Response Team
• US-CERT -- US Computer Emergency Readiness Team
• MITRE Common Vulnerabilities and Exposures
• SecuriTeam
• SANS Institute

Tips to read an academic paper

• How to read a paper, by Professor S. Keshav, Univerity of Waterloo.

Tips for good technical writing

• Writing a technical paper, by Professor Michael Ernst, MIT.
• Tips for writing technical papers, by Professor Jennifer Widom, Stanford University.
• Writing suggestions, by Professor Barton Miller, University of Wisconsin.
• Three sins of authors in Computer Science and Math, by Professor Jonathan Shewchuk, UC Berkeley.
• How to write a dissertation, by Professor Douglas Comer, Purdue University (most of the content on this page applies to all forms of technical writing).
• On writing, by Professor Terence Tao, UCLA (though the advice is geared towards mathematicians, most of the tips apply to other academic prose as well).
• The elements of style by William Strunk Jr. and E. B. White (follow the "External links" at the bottom of this page for online copies of this book).