CMPSC 443:  Introduction to Computer Security (tentative)

Instructor Information

 

Name

Sencun Zhu 

Email

szhu(AT)cse.psu.edu

Telephone

814-865-0995

Office

IST 338F

Office Hours

T, 1:30-3:00pm

 

 

TA Information

Name

Sergei Miadzvezhanka

Email

swm5344 at psu.edu

Office Hours/locations

M: 2-3pm, W: 1-2pm. Room IST 360E.

Class Meeting Times/Location  

T, TH,  4:15A - 5:30PM / Willard 165

Course Webpage

http://www.cse.psu.edu/~szhu/teach/cmpsc443/

Credits:         

3

Prerequisite:   

CMPSC 473, CMPEN 362

Course materials:   

Textbook:

-- William Stallings,  Lawrie Brown, Computer Security: Principles and Practice, Prentice Hall,

References:

-- William Stallings, Cryptography and Network Security, 4/E, Prentice Hall, ISBN-10:0131873164
-- Slides and papers (TBA)

 

Overview

CMPSC 443 focuses on computer security. Students will learn fundamentals of computer security, formal models of security, aspects of information systems security such as access control, hacks/attacks, systems and programs security, intrusion detection, cryptography, networks and distributed systems security, worms, and viruses, and other Internet secure applications. Students will develop the skills necessary to formulate and address the security needs of enterprise and personal environments. 

A detailed list of a lecture by lecture contents, assignments, and due dates (subject to change as semester evolves) is available on the course schedule.

 

Course Objective

Upon completion of the course, the students will be able to:
  • Develop an understanding of information systems security practiced in computer operating systems, distributed systems, networks and representative applications. 
  • Gain familiarity with prevalent network and distributed system attacks, defenses against them, and forensics to investigate the aftermath. 
  • Develop a basic understanding of cryptography, how it has evolved, and some key encryption techniques used today. 
  • Develop an understanding of security policies (such as authentication, integrity and confidentiality) as well as protocols to implement such policies in the form of message exchanges. 

Grading (subject to change)

The course will be graded on exams, a course project, and class participation in the following proportions:
  • 25% Mid-term exam (closed book)
  • 25% Final exam  (closed book)
  • 20% Five hands-on labs
  • 10% One  term project
  • 3%   Other assignments (homework 6)
  • 15% Five homework assignments (3% each)
  • 5%   Class Participation
  • Grading Policy: A: 92 above,  A-: 88-92,   B+: 84-87,   B: 80-83,  B-: 75-79, C+: 70-74, C: 65-69  D: 60-64  F: below 60

Exams and Assignments
  • Homework: Homework should be submitted in hard copy only.
  • Exams: There will be NO make-up examinations unless an official excuse (document) is submitted and pre-approved by the instructor. The exams are NOT accumulative.
  • Projects: Each project includes a report. The submission of each report has a due day (see the course calendar). Email submissions will NOT be accepted. They will be discarded when received. 
  • Late Policy: Starting right after the required submission date of any homework or project report, 10% of the grade will be deducted per day up to four days. NO points will be given to submissions more than four days late. A documented chronic condition which could affect this policy must be immediately brought to the attention of the instructor. 
  • Attendance: Attendance of students to all classes is required. 5% of the total grade will be based on attendance and the level of participation. 
  • Readings: Some sections in the textbook and additional papers will be assigned as reading materials. Students are expected to read the materials that will be discussed in the class before the class meeting.

Ethics Statement

This course includes topics involving personal and public privacy and security. We will cover technologies whose abuse may infringe on the rights of others. Especially, the hands-on labs may contain practical techniques for launching security attacks, although we will practice them in our isolated lab. Note that our purpose is to know the attacks and defend against them. Any abuse of such technology is at your own risk and responsibility. As an instructor, I rely on the ethical use of these technologies. Unethical use may include circumvention of existing security or privacy measurements for any purpose, or the dissemination, promotion, or exploitation of vulnerabilities of these services. Exceptions to these guidelines may occur in the process of reporting vulnerabilities through public and authoritative channels. Any activity outside the letter or spirit of these guidelines will be reported to the proper authorities and may result in dismissal from the class.

When in doubt, please contact the instructor for advice. Do not undertake any action which could be perceived as technology misuse anywhere and/or under any circumstances unless you have received explicit permission from Professor Sencun Zhu.

 

Acknowledgement

 

This course includes materials borrowed from Professor Patrick McDaniel (CSE/PSU), Alexandra Boldyreva (CS/GIT), Peng Ning (CS/NCSU). Many thanks.