Overview
|
Course Summary
In this course, we will investigate programming techniques to improve how programs defend themselves against attacks. The course aims to teach students about the types of flaws programmers may create, techniques to detect such flaws in programs, and defensive programming techniques to avoid such flaws and prevent exploitation. In addition, programmers often need to implement and maintain security mechanisms into their programs, so this course will teach students about common security mechanisms and methods for implementing such mechanisms.
Topics will include basic programming security principles, program flaws, dynamic testing methods, static testing methods, programming of security mechanisms, and special topics.
A detailed list of a lecture by lecture contents, assignments, and due dates (subject to change as semester evolves) is available on the course schedule.
Grading
The course will be graded on programming projects, exams, occasional quizzes, and class participation in the following proportions:
| 30% | Programming Projects |
| 25% | Midterm Exam |
| 35% | Final Exam |
| 10% | Class Participation |
Projects
During this course, students will implement a few programming projects in the C programming language. It is assumed that students are proficient in C programming. The projects will explore methods for adding security features to programs and testing/improving program security. These projects aim to give you a familiarity with techniques for building programs that can defend themselves from attacks.
Grades will be based on the factors specific to each project.
Exams
This course will have midterm and final exams. The midterm will cover core background in program security, and will be given in class. The final exam will be comprehensive.
Class Participation
Class participation focuses on the readings assigned for the class. During the lecture, we will discuss the readings, and students are required to participate in discussions during each lecture. It is strongly suggested that students do the reading prior to that class. Ultimately, the students' ability to exhibit comprehension of readings is essential to a good grade. Occasionally, there may be a quiz given related to the readings.
Lateness Policy
All milestones are assesed a 20% per-day late penalty, up to a maximum of 4 days. Unless the problem is apocalyptic, don't give me excuses. Students with legitmate reasons who contact the professor before the deadline may apply for an extension.
Course Outline
A rough outline of the class is as follows:
|
Academic Integrity Policy
Students are required to follow the university guidelines on academic conduct at all times. See the EECS Academic Integrity Standards. Students failing to meet these standards will be penalized severely, e.g., a "0" on the cited project plus an additional penalty from the total project points. The instructor carefully monitors for instances of offenses such as plagiarism and illegal collaboration, so it is very important that students use their best possible judgement in meeting this policy. The instructor will not entertain any discussion on the discovery of an offense, and will assign the 'F' grade and refer the student to the appropriate University bodies for possible further action.
Note that students are explicitly forbidden to copy anything off the Internet (e.g., source code, text) for the purposes of completing an assignment. Also, students are forbidden from discussing or collaborating on any assignment except were explicitly allowed in writing by the instructor.
Ethics Statement
This course considers topics involving personal and public privacy and security. As part of this investigation we will cover technologies whose abuse may infringe on the rights of others. As an instructor, I rely on the ethical use of these technologies. Unethical use may include circumvention of existing security or privacy measurements for any purpose, or the dissemination, promotion, or exploitation of vulnerabilities of these services. Exceptions to these guidelines may occur in the process of reporting vulnerabilities through public and authoritative channels. Any activity outside the letter or spirit of these guidelines will be reported to the proper authorities and may result in dismissal from the class.
When in doubt, please contact the instructor for advice. Do not undertake any action which could be perceived as technology misuse anywhere and/or under any circumstances unless you have received explicit permission from Professor Jaeger.
