Entropy and the underlying characteristics of text. Encryption-basic techniques based on confusion and diffusion and modern day encryption. Access, information flow and inference control. Program threats and intrusion detection. Network and Internet security. Firewalls, trusted systems, network authentication.
Peter A. H. Peterson
Email: pahp@d.umn.edu
Ph: 218.726.7988
Office: Heller Hall 329
Office Hours: Monday/Wednesday 1-2 PM and Thursday 5-6 PM (for other times, see my homepage)
Ankit Gupta
Email: gupta299@d.umn.edu
Office Hours: Tuesday 4-5 HH 316, Wednesday & Thursday 3-4 MWAH 187
| Day | Time | Location | |
| Lecture | MWF | 12:00-12:50 | Chem 251 |
| Lab | Th | 6:00-7:50 | MWAH 187 |
We will use CS 4821 Spring 2016 Moodle Site for grading, submissions and other class-related activities.
We will use CS 4821 Section 002 S 16 UMNDL for discussion and announcements.
Readings and homework assignments for the semester are listed on a separate page.
Please note:
SIC is an excellent overview of Computer Security topics and issues and will be the primary "text" for the course. Please note: Make sure you get the brand new 5th edition. The 4th edition is tremendously out of date. 24DS is an exploration of 24 different common types of mistakes that often lead to security vulnerabilities. Readings will be assigned from both books throughout the semester.
Crypto-Gram is a monthly email newsletter that summarizes some of the best information on noted security expert Bruce Schneier's blog. This is an excellent source of information for what's happening in the security world, from both technological and political angles. We will discuss topics raised in new issues in class as time permits.
Subscribe at https://lists.schneier.com/cgi-bin/mailman/listinfo/crypto-gram
You will be subscribed to the Information Security News list. This is a list for security news items and commentary that might relate to the class or to current events. This list will persist after the course is over. You should stay subscribed during the semester if you want to get important updates about Computer Security, but may unsubscribe after the class is over, if you wish.
Other readings (paper handouts or online resources) may be assigned and used during class. We will send an email to the class when this occurs.
Moodle will be used to manage multiple aspects of the course, including homework submission, grading, announcements, discussions, etc.
Grading is broken down as follows:
Extra Credit (>=10%) -- There will be extra credit opportunities throughout the semester (providing at least 10% extra points) composed of a mix of moderately difficult questions/projects and much more difficult "challenge problems" to encourage you to dig deeper. Extra credit points will be added to your earned percentage of required deliverables. For example, if you have an 89% based on all required tasks and you also earned 3% of extra credit, your final grade percentage would be 92%.
Final grades will be assigned as follows:
We will make every effort to post grades to Moodle in a timely fashion.
This course will include a written final, the time and location of which are:
The Midterm and Final will be composed of "choice questions", simple and open-ended short answer questions, questions about papers or other materials, etc. and will be of the general character of the homework questions. The final will be cumulative but will skew towards the material presented in the latter half of class.
Computer Security happens in the real world, using real systems, facing real adversaries. While theory and intellectual knowledge (i.e., "book larnin'") are essential, being able to use that knowledge effectively in the real world is just as (if not more) important.
As a result, in addition to reading and written work, this Computer Security class includes a significant amount of hands-on coding, debugging, experimentation, etc., in live, realistic, networked environments. Required projects will involve programming and debugging in C, Perl, PHP, Bash, MySQL and perhaps other languages. You do not need to be a coding wizard to succeed and no specific expertise with these languages is expected. However, basic programming literacy and proficiency in at least one language such as Python, Java or C/C++/C# and the understanding that all computer languages are fundamentally similar is critical. Likewise, a previous networking class and experience working at the Linux/Unix command-line will be helpful but is not strictly necessary.
However, in all three areas -- programming new languages, networking and the Linux/Unix command-line, the critical prerequisite is a willingness to learn, experiment, push yourself and do things.
A number of projects will take place on the DETER testbed, a large public testbed used for cyber-security research and education .
You do not need to purchase any hardware or software for this class. However, you do need to bring a refundable deposit of $35 to Clare Ford in the CS Department office (320 HH). In exchange, you'll get a key to a locker in MWAH 187 containing a hard drive you will use throughout the semester. We will install Linux on it during our first lab session. Get your deposit back by returning the hard drive and key at the end of class.
You will also have 24/7 access to MWAH 187 via your proxy key fob, ensuring that you will have a supported and fully customizable environment for homework projects throughout the semester. If you have a proxy key, you should already have access to MWAH 187. If you don't have a key, see Clare in HH 320. (There is no charge for the proxy key.)
Linux, in MWAH 187 and on the DETER testbed, are the only supported work environments for this class. That said, you may be able to complete certain projects on other lab machines at UMD or on a personal computer. (It should be easy if you are running Linux.) However, these other methods are strictly unsupported due to the potential complexity of debugging issues with non-standard environments.
More importantly, while you may be able to program or create written materials on other computers, performing certain sensitive activities (like network eavesdropping or exploiting vulnerabilities) are strictly forbidden on machines other than in MWAH 187 or your own computer. (See Security Code of Conduct, below.)
If you have any questions about whether it is acceptable to use some machine for a particular purpose, ask the instructor.
Class will include discussion and quizzes in addition to lectures on assigned reading. Students are expected to attend all scheduled class meetings. It is the responsibility of students to plan their schedules to avoid excessive conflict with course requirements. However, there are legitimate and verifiable circumstances that lead to excused student absence from the classroom. These are subpoenas, jury duty, military duty, religious observances, illness, bereavement for immediate family, and NCAA varsity intercollegiate athletics. For complete information, please see: http://www.d.umn.edu/vcaa/ExcusedAbsence.html
If you miss class for whatever reason, it is your responsibility to obtain the information covered in class from a classmate, instructor or TA.
Late work will not be accepted (excepting certain extra credit problems) because we will do a "post-mortem" on the projects in class and interactively discuss the answers. However, most projects consist of multiple components and partial credit is given! Therefore, turn in your work, even if it is not completely finished.
Exams and quizzes will not be given early, and make up quizzes will not be given (see "Late Work," above). Make up exams will be provided only in extreme emergencies (and with the instructors consent).
I will not give incompletes except for very extreme circumstances (e.g., a major health crisis accompanied by a doctor's note). The last day to turn in extra credit tasks is the last day of Finals Week.
Academic dishonesty tarnishes UMD's reputation and discredits the accomplishments of students. Academic dishonesty is regarded as a serious offense by all members of the academic community. UMD's Student Academic Integrity Policy can be found at: http://www.d.umn.edu/vcaa/StudentAcademicIntegrity.html
UMD is committed to providing a positive, safe, and inclusive place for all who study and work here. Instructors and students have mutual responsibility to insure that the environment in all of these settings supports teaching and learning, is respectful of the rights and freedoms of all members, and promotes a civil and open exchange of ideas. To reference the full policy please see: http://www.d.umn.edu/vcaa/TeachingLearning.html
Appropriate classroom conduct promotes an environment of academic achievement and integrity. Disruptive classroom behavior that substantially or repeatedly interrupts either the instructor's ability to teach, or student learning, is prohibited. Disruptive behavior includes inappropriate use of technology in the classroom. Examples include ringing cell phones, text-messaging, watching videos, playing computer games, email, or surfing the Internet on your computer instead of note-taking or other instructor-sanctioned activities.
Students are expected adhere to Board of Regents Policy: http://www.d.umn.edu/vcaa/documents/Student_Conduct_Code.pdf
We cover sensitive security topics in this class (e.g., software exploits, network vulnerabilities, etc.) because it is impossible to write secure code or be well-informed about security issues without understanding vulnerabilities and how you can defend against them.
However, because this knowledge can be used for destructive purposes, you will be required to sign a statement indicating that you will only perform sensitive security-related course tasks in approved ways and acknowledging that you understand that using computer systems in unauthorized ways can have serious academic and legal consequences.
Solo (non-group) project assignments must be your own work. You may discuss general, high-level, or conceptual issues with other students, but should not share actual code or answers with others. Cheating is considered to be sharing code either by copying, retyping, looking at, or supplying a copy of a file, and applies to information from both current and previous versions of this class (i.e., looking at answers from a previous semester is considered cheating). For group projects, these rules apply between groups instead of individuals.
Sometimes, students feel compelled to cheat on homework because they are afraid of admitting that they do not understand the material or do not know how to complete some task or overcome some technical hurdle. Nobody understands everything -- you should never be afraid of asking questions you have made a reasonable effort to answer. If you are struggling with any material in the class, please come talk to the TA or the instructor early enough to get the help you need -- that is the reason we are here.
While getting answers from current or previous students is considerd cheating, in this class it is acceptable to find and use existing code snippets, libraries, tutorials, HOWTO's, Stack Exchange information and other similar resources, provided that the information used is from a legitimate source (i.e., not a cheating website) and you cite the resource used.
Please note that this policy may not apply to other classes at UMD (or elsewhere). It makes sense in this course because, rather than demonstrating your understanding by designing and programming discrete, standalone solutions, most projects involve solving large, system-level problems using a synthesis of many smaller solutions (some original and some found elsewhere). In many cases, we have intentionally left critical information out of course materials explicitly so that you will need to go online to find resources with the answers.
That said, it is up to you to ensure that any source you use is sufficiently attributed; this should -- at the very least -- include a comment(in your source code or writeup) identifying:
In the case of libraries or programs provided by us for the class (e.g., tcpdump or ettercap) or widely available pre-packaged applications (such as tools available in the standard Ubuntu distribution), it is sufficient to refer to the software by name. For example, "I installed the chaosreader package from the Ubuntu repository and used it to extract data from the network trace" or "I got this command line from the tcpdump manpage."
Finally, it is also your responsibility to understand any material you use -- its purpose or functionality may be included in later assignments or tests.
If you have any questions about this policy or how to make proper attribution, please contact your instructor/TA.
Taking notes is a means of recording information but more importantly of personally absorbing and integrating the educational experience. However, broadly disseminating class notes beyond the classroom community or accepting compensation for taking and distributing classroom notes undermines instructor interests in their intellectual work product while not substantially furthering instructor and student interests in effective learning.
In particular:
Students may not distribute, via the Internet or other means, lecture notes or instructor-provided materials, except to other members of the same class or with the express written consent of the instructor.
This includes the solutions to homework, quizzes, exams and course projects.
For additional information, please see: http://www.d.umn.edu/vcaa/ClassNotesAppropriateUseof.html
As instructor I shall make every attempt to treat all students equally, without regard to race, religion, color, sex, handicap, age, veteran status, or sexual orientation. Furthermore, I will not tolerate behavior that excludes or marginalizes anyone. I strongly encourage you to talk to me if you have any concerns regarding equal opportunity in the classroom. To inquire further about the University's policy on equal opportunity, contact the Office of Equal Opportunity (6827), 269-273 DAdB.
It is my policy, and the policy and practice of the University of Minnesota Duluth to create inclusive learning environments for all students, including students with disabilities. If there are aspects of this course that result in barriers to your inclusion or your ability to meet course requirements -- such as time limited exams, inaccessible web content, or the use of non-captioned videos -- please notify the instructor as soon as possible. You are also encouraged to contact the Office of Disability Resources to discuss and arrange reasonable accommodations.
Please call 218-726-6130 or visit the DR website at http://www.d.umn.edu/access for more information.
As a student you may experience a range of issues that can cause barriers to learning, such as strained relationships, increased anxiety, alcohol/drug problems, feeling down, difficulty concentrating and/or lack of motivation. These mental health concerns or stressful events may lead to diminished academic performance or reduce a student's ability to participate in daily activities. University of Minnesota services are available to assist you with addressing these and other concerns you may be experiencing. You can learn more about the broad range of confidential mental health services available on campus via the UMD Health Service Counseling website at http://www.d.umn.edu/hlthserv/counseling/
If you think these services might help you, I urge you to take advantage of them as soon as possible.
Some policy text used or adapted from the following sources (with permission):
University of Minnesota Campuses