Computer Science 530 - Syllabus and Reading List -- Fall 2019

This is our expected Syllabus and reading list. Most topics will take several lectures to cover. In addition to the primary discussion for each lecture, 5-10 minutes of each lecture will be set aside for discussion of current events in the computer security arena. Specific coverage within each leacture will be updated from year to year to keep the course material up to date with current practice.

Dates may change depending on progress throug the semester. Reading assignments are designated as such. Links from system names in the syllabus are for general information only.

Readings are on topics related to the lecture, but lectures are not from the book. Students are expected to have completed the assigned readings prior to lecture so that they have backround appropriate for class discussion.

p

Date	Topic/Readings	Slides	Lab Info
Lecture 1 August 30 2019	The Security Problem A working definition of security Evaluating security Systems security vs network security vs data security Societal aspects of security, ethical and legal foundations Readings: Bishop, Chapter 1, An Overview of Computer Security	PPT, PDF	Lab Introduction.
Lecture 2 September 6 2019	Cryptography - An Overview Secret key cryptography Public key cryptography Hashes and message digests Steganography Readings: Bishop, Chapter 9, Basic Cryprography Bishop, Chapter 11 (only through section through 11.2), Cipher Techniques Garfinkel (Is Encryption Doomed)	-	Cryptography
Lecture 3 September 13 2019	Key management Diffie-Hellman Key Exchange Ties to Authentication Protocols Public-key Key Exchange (PGP, X.500, S/MIME) Peer-to-peer Group key management Readings: Bishop, Chapter 10, Key Management Needham and Schroeder (you may need to use the VPN for access) Rafaeli and Hutchison (you may need to use the VPN for access)	PDF at Slide 61	Authentication
Lecture 4,5 September 20,27 2019	Authentication and Identity Management Password-based authentication Unix vs Windows Kerberos X.500 Hardware authentication Biometrics (plus more material to be added) Readings Bishop, Chapter 12, Authentication Lamport Neuman, Ts'o (Kerberos) Neuman and Stubblebine (Timestamps vs. Nonces) Kormann and Rubin (Risks of Passport)	PDF at Slide 104 PDF at Slide 138	Authorization Application Security
Lecture 6 October 4, 2019	Authorization and Policy Policy ACLs GAA-API Readings: Barkley: Comparing Simple Role Based Access Control Models and Access Control Lists) Ryutov,Neuman,Kim,Zhou: Integrated Access Control and Intrusion Detection for Web Servers Readings: Bishop, Chapter 2, Access Control Matrix Readings: Bishop, Chapter 4, Security Policies Readings: Bishop, Chapter 5, Confidentiality Policies		Packet Sniffing
Mid-term October 11 2019	Mid-Term Exam (9:00 AM - 10:40 AM)	Followed by start of lecture on untrusted computing
TG October 18th 2019	USC Fall Recess, No Lecture, Note this is a scheduled USC recess this year.	N/A	None
Lecture 8 October 25 2019	Viruses Worms Spyware Denial of service attacks Transmission vectors, e.g. spam Readings Moore, Paxon, Savage, Shannon, Stanford & Weaver: Inside the Slammer Worm Thompson, Ken: Reflections on Trusting Trust - ACM Turing Award Lecture 1984 Readings: Bishop, Chapter 22, Malicious Logic		.
Lecture 9 Novemner 1 2019	Countermeasures Firewalls Virus checkers Patch and configuration management Readings Bishop, Chapters 26 and 27, Network and System Security		Intrusion Detection
Lecture 10 November 8 2019 (will extend into lecture 11)	Intrusion detection and response Commercial Itrusion Detection Systems Research Itrusion Detection Systems Response systems Readings Bishop, Chapter 25, Intrusion Detection Taimur Aslam, Ivan Krsul, and Eugene H. Spafford, A Taxonomy of Security Faults, Proceedings of the National Computer Security Conference, Coast TR 96-05, 1996. C. Ko, G. Fink, K. Levitt, Automated Detection of Vulnerabilities in Privileged Programs by Execution Monitoring, Proc. of the 10th Annual Computer Security Applications Conference, December 1994, pp 134-144. Debra Anderson, Thane Frivold, and Alfonso Valdes, Next Generation Intrusion Detection Expert System (NIDES) a Summary, SRI Computer Science Laboratory Technical Report SRI-CSL-95-07, May 1995. S Singh, C Estan, G Varghese, S Savage, The EarlyBird System for Real-time Detection of Unknown Worms , ACM Workshop on Hot Topics in Networks, 2003.	. .	Arp Spoofing
Lecture 11 November 15th 2019	The Human Element Social Engineering Phishing Character sets Complexity of proper security deployment Configuration issues Passwords Readings Phinding Phish: Evaluating Anti-Phishing Tools, Zhang, Egelman, Cranor and Hong, 2007 Internet Society Symposium on Network and Distributed Systems Security.	--	Tunnels/VPNs
Lecture 12 November 22nd 2019	Trusted Computing The Public Perception of Trusted Computing The Hardware Basis for Trusted Computing The Software and OS Basis for Trusted Computing Virtualization Negotiating Trust and Obligation Case Studies Readings Glance at the web site for the Trusted Computing Group Vivek Haldar, Deepak Chandra and Michael Franz, Semantic Remote Attestation -- A Virtual Machine directed approach to Trusted Computing In proceedigs of the 3rd Virtual Machine Research and Technology Symposium. Arun Viswanathan and B.C. Neuman, A Survey of Isolation Techniques - DRAFT		Forensics
TG November 29th 2019	Thanksgiving Recess, No Lecture	N/A	None
Lecture 13 December 6th 2019	Privacy, Plus CyberPysical Systems, Cloud Computing and other topics. Read or listen to this Podcast on NPR, to understand why privac is important. Your Digital Trail: Data Fuels Political and Legal Agendas - By Daniel Zwerdling, October 3, 2013. All things considered. Threat Propagation in Cyber Physical Systems - Neuman, Tan 2011. Security risks in Cloud Computing from InfoWorld July 2, 2008.		none
Final Exam Monday December 16, 2019	Final Exam (11:00 AM - 1:00 PM)	N/A	None