Introduction to Computer Security, Network Security, and Applied Cryptography

Course Overview

Course Description

Security is now a core requirement when creating systems and software. This course will introduce students to the fundamentals of computer security and applied cryptography. Topics include software vulnerability analysis, defense, and exploitation, reverse engineering, networking and wireless security, and applied cryptography. Students will also learn the fundamental methodology for how to design and analyze security critical systems.

Course Design

This course covers three basic areas in computer security:

Software security.

In this portion of the course we will investigate common types of vulnerabilities ranging from buffer overflows to injection attacks. Students will become adept at reverse engineering, identifying flaws, and exploitation. The goal is for students to be able to i) recognize vulnerabilities, ii) understand the fundamental characteristics of the vulnerabilities, and iii) understand current defenses.

Network security.

Applied Cryptography.

Grading and Policies

Grading

I will guarantee at least the following grades:

• 89.5 – 100: A
• 79.5 – 89.4: B
• 69.5 – 79.4: C
• 59.5 – 69.4: D
• < 59.5: F

I may lower the points necessary to achieve a grade, but I will not raise them.

Breakdown

I will use the following breakdown:

• 35% Homework
• 30% Exam 1
• 30% Exam 2
• 5% Participation and CTF

Although there are three exams, I will drop the lowest exam grade.

Late Days

Late days interfere with the ability of course staff to quickly turn around assignment grades and solutions. The problem is we cannot give out solutions or graded assignments until everyone has turned in their work. Therefore, we only offer late days in emergency or exceptional circumstances, such as hospitalization. We do not offer late days for personal scheduling issues such as interviews, class load, etc.

Policies

The course staff will treat all students ethically and fairly. We, in turn, expect the same from all students.

Any lapse in ethical behavior will immediately result in −1,000,000 points, as well as be immediately reported to the appropriate university disciplinary unit. Really. Even if you just have to pass the class, even if you didn’t know it was cheating or plagiarism, and even if it will never happen again. Prof. Brumley is very, very tough and intolerant of cheating, plagiarism, or unethical behavior.

This course will follow CMU’s policy on cheating and plagiarism. Note that the policy gives several examples of what constitutes cheating and plagiarism. If you have any questions, you should contact the instructor. We have one additional rule: don’t be a nuisance. Even if something is legal, that doesn’t mean it is necessarily ok.

Please ask the course staff if you have any questions regarding whether a particular behavior is OK or not. In particular:

• Don’t break laws or cause a nuisance. This course discusses security-related topics. As such, you will be exposed to ideas and techniques that could be used to break the law. This knowledge does not mean it is OK to break the law or cause a nuisance. Examples of prohibited activities include scanning networks, launching exploits, “testing” the security of a system without explicit permission from all necessary parties, and so on.

• Collaboration. Students are encouraged to talk to each other, to the course staff, or to anyone else about any of the assignments. Assistance should be limited to discussion of the problem and sketching general approaches to a solution. Each student must turn in his or her own solution.

Schedule

The schedule below is subject to changes. Please check back regularly.

Homework

Homework 1

• Handout
• recoverpw.tar.gz

Homework 2

• Handout

Homework 3

• Handout

PPP: The CMU Hacking Team

Do you want to become a skilled hacker? There is no substitute for practice. Luckily, CMU has one of the best competitive hacking teams in the world: PPP. I am the faculty advisor for PPP, the CMU hacking team. Please visit their website for information. I recommend signing up for their mailing list, and regularly attending meetings.