- Sep 02
- Introduction
- Text, Chapter 1
- Sep 04
- Access control
- Text, Chapter 2
- Sep 09
- Complex access control
- Text, Chapter 3
- Marking Classified National Security Information (optional)
- Report on the U.S. Intelligence Community's Prewar Intelligence Assessments on Iraq (the document from which the sample marked page was taken; very optional)
- Sep 11
- Privileges
- Text, Chapter 4
- What is a Capability, Anyway?
- Sep 16
- Introduction to cryptography
- Text, Chapter 7
- The Story of Alice and Bob
- New Directions in Cryptography, Whitfield Diffie and Martin E. Hellman, IEEE Transactions on Information Theory, vol IT-22, number 6, pp. 644--654, November 1976.
- British invention of non-secret encryption (recommended)
- A method for obtaining digital signatures and public-key cryptosystems, R. L. Rivest, A. Shamir, L. Adleman, Communications of the ACM, Volume 21 Issue 2, February 1978. (recommended)
- Sep 18
- Authentication
- Text, Chapter 9
- Password security: a case history, Robert Morris and Ken Thompson, Communications of the ACM, Volume 22, Issue 11 (November 1979), Pages: 594 - 597.
- Dr. Fun
- Dilbert
- Dilbert
- Dilbert
- Dilbert
- User Friendly
- Sep 23
- Biometrics; authentication as a systems problem
- Chapter 5 of Who Goes There? Authentication Through the Lens of Privacy.
- Sep 25
- Case Study: Access control
- Sep 30
- Secure Programming I
- Text, Chapter 6
- The emperor's old clothes, Charles Antony Richard Hoare, February 1981, Communications of the ACM, Volume 24 Issue 2
- Smashing The Stack For Fun And Profit, Aleph One, Phrack 49, Volume Seven, Issue Forty-Nine, File 14 of 16
- Static Analysis for Security, Gary McGraw, IEEE Security & Privacy (Nov/Dec 2004).
- Oct 02
- Secure Programming II
- Preparation of Internationalized Strings ("stringprep"), Paul Hoffman, RFC 3454, December 2002.
- Checking for Race Conditions in File Accesses, Matt Bishop and Michael Dilger, Computing Systems 9 (2) pp. 131-152 (Spring 1996).
- setuid - checklist for security of setuid programs
- Writing Safe SetUID Programs, Matt Bishop
- Using Attack Surface Area And Relative Attack Surface Quotient To Identify Attackability, Ernst & Young LLP.
- Oct 07
- Protecting the Client
- Text, Chapter 13
- Fare Collection Vulnerability Assessment Report, Zack Anderson, Russell Ryan, Alessandro Chiesa, August 8, 2008.
- Anatomy of a Subway Hack, Zack Anderson, Russell Ryan, Alessandro Chiesa, (censored) DEFCON presentation, August 2008.
- Dutch Public Transit Card Broken, Andy Tanenbaum.
- Microsoft Updating Without Permission: When No Doesn't Mean No!, Lauren Weinstein's Blog, September 13, 2007.
- Reading Between the Lines: Lessons from the SDMI Challenge, Scott A. Craver, Min Wu, Bede Liu, Adam Stubblefield, Ben Swartzlander, Dan W. Wallach, Drew Dean, and Edward W. Felten. Proc. of 10th USENIX Security Symposium, August 2001.
- Viewpoint: the ACM declaration in Felten v. RIAA, Simons, B. 2001. Commun. ACM 44, 10 (Oct. 2001), 23-26.
- Java Card Security: How Smart Cards and Java Mix, From Securing Java: Getting Down to Business with Mobile Code, Gary McGraw and Ed Felten, John Wiley & Sons, 1999.
- MYK-78 CLIPPER CHIP: ENCRYPTION/DECRYPTION ON A CHIP (recommended)
- Using Memory Errors to Attack a Virtual Machine, A. Appel and S. Govindavajhala. In IEEE Symposium on Security and Privacy, 2003 ( "Oakland Security Conference"). (recommended)
- Overview of Differential Power Analysis, An engineering overview of Differential Power Analysis by Paul Kocher, Joshua Jaffe, and Benjamin Jun. (recommended)
- Information Hiding: A Survey, Fabien A. P. Petitcolas, Ross J. Anderson and Markus G. Kuhn, Proceedings of the IEEE, special issue on protection of multimedia content, 87(7):1062{1078, July 1999. (recommended)
- The Risk of ePassports and RFID, THC Blog, Sep 29, 2008. (recommended)
- Oct 09
- Security and Usability
- A. Adams and M. A. Sasse, 1999. "Users are not the enemy: why users compromise security mechanisms and how to take remedial measures". Communications of the ACM 42(12), 40-46.
- Alma Whitten and J.D. Tygar, "Why Johnny Can't Encrypt: A Usability Case Study of PGP 5.0". Proceedings of the 8th USENIX Security Symposium, August 1999.
- Lorrie Faith Cranor, "A Framework for Reasoning About the Human in the Loop". Usability Psychology and Security Workshop, 2008.
- Oct 14
- Cryptographic Engineering
Cryptographic Engineering
- The Strange Story of Dual_EC_DRBG, Schneier on Security (blog), Nov. 15, 2007.
- Randomness Requirements for Security, RFC 4086, D. Eastlake, 3rd, J.Schiller, S. Crocker. June 2005.
- Oct 16
- Keys and Passwords
- Oct 21
- Midterm
- Oct 23
- Architecture
- Security Tips, Apache 2.2 (recommended)
- suEXEC Support, Apache 2.2 (recommended)
- Oct 28
- Confinement
- A domain and type enforcement UNIX prototype, Lee Badger, Daniel F. Sterne, David L. Sherman, and Kenneth M. Walker. USENIX Computing Systems, 9(1):47--83, Winter 1996. (recommended)
- A Secure Environment for Untrusted Helper Applications, Ian Goldberg, David Wagner, Randi Thomas and Eric A. Brewer, Proc. Usenix Security Symposium, 1996. (recommended)
- Oct 30
- Viruses and Trojan Horses
- Recreating the Trojan Horse?
- Computer Viruses - Theory and Experiments, F. Cohen. DOD/NBS 7th Conference on Computer Security, originally appearing in IFIP-sec 84, also appearing as invited paper in IFIP-TC11, ``Computers and Security'', V6#1 (Jan. 1987), pp 22-35
- Reflections on trusting trust, Ken Thompson, CACM 27:8, August 1984.
- Viral Attacks On UNIX System Security, Tom Duff, August 1987.
- The worm programs -- early experience with a distributed computation, John Shoch and Jon Hupp, Communications of the ACM 25:3 (March 1982).
- With Microscope and Tweezers: An Analysis of the Internet Virus of November 1988
- Come Sunday, it will be 20 years ago that day a worm came out to play
- Tool turns unsuspecting surfers into hacking help, CNET, March 20, 2007.
- JavaScript opens doors to browser-based attacks, CNET, July 28, 2006.
- Oldest known depiction of the Trojan Horse, from the "Vase of Mykonos", almost 2700 years old
Readings mentioned in class: - Nov 06
- Program Structure I
- The 4.3BSD FTP daemon source.
- Nov 11
- Program Structure II
- Steven M. Bellovin, "Virtual Machines, Virtual Security", Communications of the ACM, Vol. 49, No. 10, October 2006, Inside Risks.
- Nov 13
- Security Analysis I
- Silver Needle in the Skype, P. Biondi and F. Desclaux, BlackHat Europe, 2-3 March 2006.
- Nov 18
- Permissive Action Links
- Chapter 11 of Ross Anderson's Security Engineering, first edition, Wiley, 2001.
- Permissive Action Links
- Nov 20
- Physical and Procedural Security
- M. Blaze. "Cryptology and Physical Security: Rights Amplification in Master-Keyed Mechanical Locks." March 2003. IEEE Security and Privacy. March/April 2003.
- M. Blaze. "Safecracking for the Computer Scientist." U. Penn CIS Department Technical Report. 7 December 2004 (revised 20 December 2004).
- Physical Security Standards for Sensitive Compartmented Information Facilities. DCID 6/9, 18 November 2002.
- The Art of Deception, Kevin Mitnick and William Simon, Wiley, 2002. (recommended) (Available as an EBook from the CU library)
- US Navy Malware Infection Risked Submarine Prang
- Disgruntled Techie Attempts Californian Power Blackout"
- Chocolate the Key to Uncovering PC Passwords
- Nov 25
- Security Analysis II
- ITS4: A Static Vulnerability Scanner for C and C++ Code, John Viega, J.T. Bloch, Tadayoshi Kohno, and Gary McGraw, Annual Computer Security Applications Conference, 2000.
- Checking for Race Conditions in File Accesses, M. Bishop and M. Dilger, Computing Systems 9:2, pp. 131-152 (Spring 1996)
- CGI/Perl Taint Mode FAQ
- Perl Advisor: Taint so Easy, Is It?, Randal L. Schwartz, Unix Review, August 2000.
- Static analysis and computer security: New techniques for software assurance. David Wagner. Ph.D. dissertation, Dec. 2000, University of California at Berkeley. (recommended)
- Using CQUAL for Static Analysis of Authorization Hook Placement, Xiaolan Zhang & Antony Edwards & Trent Jaeger, Proc. Usenix Security, 2002. (recommended)
- Dec 02
- Logging
- Stalking the wily hacker, Communications of the ACM 31:5, May 1988.
- Shadow Hawk Busted Again, Phrack 16, File 11 (Nov 1987) (recommended)
- Chicago Phone Freak Gets Prison Term, Risks Digest 8:29, 22 February 1989 (recommended)
- Dec 04
- System Structure
- Final, 1:10-4:00 (tentative)
Dec 18
