Courses/Computer Science/CPSC 525.W2016/Lecture Notes

Jump to: navigation, search


Course Outline


There's a typo in my email address, it should be or

Principles of Security (January)

Introduction (01/11)

About the instructor and the course.

What do students expect to learn in the class?

Introductory quiz about student's background and experiences.

Slides: [1]

Security Mindset and Terms (01/13)

(Gollman Ch. 3)

Confidentiality, integrity, and availability

A definition of security

Dilemmas in security

How to keep a systems secure

Complexity and how it kills security

Slides: [2]

Principles of Computer Security (01/15)

Define the term "hacker"

What are exploits and vulnerabilities?

What is access control?

What are the best practices for secure passwords?

What's the purpose of cryptography?

What are rootkits?

How does censorship influence security?

What is penetration testing? Is it ethical?

What is the Common Vulnerability Scoring System?

Famous people in security

Famous security conferences

Slides: [3]

Ethics & Security Practices (01/18)

Video Presentation:

Reading Material:

Slides: [4]

The History of Attacks (01/20)

Some of the terms discussed:










Video Material:

Reading material:

Slides: [5]

The History of Attacks pt. 2 (01/22)

Phishing, spam, spear-phishing, context-aware attacks, inference attacks

Exercise on Inference Attacks

Reading material:

Slides: [6]

Intrusion Detection (01/25)


Intrusion Detection Model

Audit Records



Statistical metrics and models

Anomaly records

Reading material:

Slides: [7]

Overview of C and its security issues (01/27)

Advantages of C

Disadvantages of C

Preprocessor coding practices

Declarations and initializations coding practices

Expressions coding practices

Integers coding practices

Common attacks in C

A basic notion of GDB as a debugger

Reading material:

Slides: [8]

More about C and its security vulnerabilities (01/29)

Buffer Overflow live demonstration

Attack a program that calls strcpy()

Use GDB to smash the stack

Use exploits to: (1) execute exit(1), (2) execute mkdir in current directory, (3) execute /bin/bash, (4) cat /etc/passwd

Reading Material:

Slides: [9]

Security Models and Access Control (February)

Dynamic Instrumentation of Programs and Code Injection (02/01)



Intel's Pin


Control Hijacking Attacks

Control Hijacking Defenses

XSS Attacks

SQL Injection

Aspect Oriented Programming

Just-in-time compilation

Reading material:

Slides: [10]

More about ELF, DWARF, and code injection (02/03)

ELF Header

DWARF format

XSS attacks

SQL Injection attacks

ELF injection

Reading material:

Slides: [11]

Vulnerability Assessment (02/05)



Vulnerability Discovery

Slides: [12]

Identity-Based Access Control (02/08)

(Gollman Ch. 5)

Authentication and authorization

Access Control Matrix

Access Control Lists

Multics and Unix access operations

Subjects and Principals

Mandatory and Discretionary Access Control (02/10)

Types of MAC policies

Adding privileges in DAC

The Confused-Deputy Attack

DAC in Unix


Role-Based Access Control (02/12)

  • Transactions/Procedures
  • Users and sessions
  • Roles and permissions
  • User to role assignment relation
  • Permission to role assignment relation
  • The three rules of RBAC
  • Constraints, role hierarchy and consolidated model

Reading Material:

READING WEEK (15/02 - 19/02)

  • BLP Paper

Security attributes in Access Control Models (02/22)

Security attributes

Partial ordering


Hasse diagrams

Multi-level security

Introduction to BLP

Bell-LaPadula Model (02/24)

READ: Original paper

State machine models

The Bell-LaPadula model

Security properties

Basic security theorem


Debate: Against or in Favor of BLP?

Reading Material:

  • Gollman's book Chapter 11

The Biba Model (02/26)

BLP Basic Security Theorem

The Biba Model definition

The Biba Model properties

Access control exercises

Reading material:

  • Gollman's book Chapter 11

Security Models (02/22)

The BIBA Model

Chinese Wall Model

The Clark-Wilson Model

Other Security Models (02/24)

The Harrison-Ruzzo-Ullman (Ch. 12.4)

Using HRU as a programming language (Ch. 12.4)

Information-flow models (entropy, lattices)

Execution monitors (if time permits)

Key Establishment (02/26)

(Gollman Chapter 15.3)

The Diffie-Hellman Protocol

Needham-Schroeder Protocol

Password-Based Protocol

Guest Lecture #1 (Jonathan Gallagher) (02/29)

Hoare logic as the type system for an imperative language. This will be done in several stages.

  • Without loops (finite branching programs).
  • With loops.
  • With procedure calls but no recursion.
  • With procedure calls and recursion.
  • There will be no functions -- all messages will be passed via global variables, and the language will be assumed to be sequential.

Communications Security (March)

Guest Lecture #2 (Jonathan Gallagher) (03/02)

Formal verification of software

Midterm Examination (03/04)

Introduction to Frama-C (03/07)

Slides: [13]

Reading Material:

Database Security (03/09)

Slides: [14]

Reading Material:

  • Chapter 9 -Dieter Gollman's Computer Security

Midterm handout and solutions (03/11)

Slides: [15]

SQL Injection (03/14)

Slides: [16]

DoS and DDoS (03/16)

Slides: [17]

Reading Material:

Infosec Job Position Requirements and Analysis (03/18)

Password Authentication (03/21)

G Tech Password Case Study -

Slides: [18]

Multiple Ownership in Access Control (Guest Lecture by Dr. Pooya Mehregan) (03/23)


Specifically, we propose an extension of Relationship-Based Access Control (ReBAC) to support multiple ownership, in which a policy negotiation protocol is in place for co-owners to come up with and give consent to an access control policy in a structured manner. During negotiation, the quality of draft policy is assessed by a set of novel and formally defined availability criteria: policy satisfiability, feasibility and resiliency, which all belong to the second level of the polynomial hierarchy. Despite computational complexities, we propose efficient decision procedures that are based on modern Boolean Satisfiability (SAT) solvers and Answer Set Programming (ASP). The empirical data shows that these algorithms are competitive for mid-sized organizations (100,000 users).

Slides: [19]

No classes (Good Friday) (03/25)

Digital Identity Exercise (03/28)

Exercises 5.3 and 6 from SISMAT.

Security Evaluation (03/30)

Slides: [20]

A Word on Privacy

Social Engineering Attacks (04/01)

Spam, phishing, spear-phishing and inference attacks.

Automatic social engineering, digital identities.

Slides: [21]

Discussion: Usable Studies, Ethics, and the Future of Security (04/04)

Manoel Costa (Guest Lecture) IBM Security Engineer (04/06)

Manoel Costa is a technology enthusiast with over fourteen years of experience in the IT industry. He has several well-recognized certifications like: CEH, GCIH, G27000, GCCC, GICSP, CRISC, CISA and CISSP. He has been working mainly as an IT Consultant and Systems Engineer, specializing in IT security. His experience includes working with clients between 300-7000+ seats. He has expertise with pre-sales, leading small teams and projects; and delivery of many different complex projects.

Final Term Review (04/08)

Final Term (04/11)