CIS 551 / TCOM 401 - Computer and Network Security
Spring 2009


Topics     Reading     Projects     Grading     Lectures     Policies

Time: Tues. & Thurs. 1:30 - 3:00
Room: Towne 313

Instructor:

    Steve Zdancewic
      e-mail: cis551 (AT) seas.upenn.edu
      office hours: Tues. 9:30-10:30 (and by appointment) Levine 511

Teaching Assistant:

  Jianzhou Zhao
      e-mail: cis551 (AT) seas.upenn.edu
      office hours: Weds. 3:30 - 5:00
      Location: the student lounge close to Levine 565

Course contact information:

  Class mailing list: CIS551-401-09A (AT) lists.upenn.edu (open to all members of the class)

Topics:

  • System Security: hacker behavior, intrusion & anomaly detection, hacker and admin tools
  • Networks & Infrastructure: TCP/IP, Denial of Service, IPSEC, TLS/SSL
  • Basic Cryptography: Shared key crypto (AES/DES), Public Key Crypto (RSA), hashes
  • Crypto software: Open SSL library, applications (authentication, digital signatures)
  • Trust & Configuration management
  • Malicious code: buffer overflows, viruses, worms, protection mechanisms
  • Covert Channels

Reading

The following books contain useful course material, and much of the lecture content is derived from them (and other sources). Copies of these books are on reserve in the Penn Engineering Library.

  • Security in Computing (3rd edition) by Pfleeger and Pfleeger
  • Computer Networks: A Systems Approach (3rd edition) by Larry L. Peterson and Bruce S. Davie
  • Applied Cryptography (2nd edition) by Bruce Schneier

In addition, the following papers and web sites provide supplementary material. Reading selections from these sources will be announced in class.

Projects

Project 1: Buffer Overflows Due: 6 Feb. 2009 at 11:59 p.m.

Project 2: Network Intrusion Detection Due: 6 Mar. 2009 at 11:59 p.m.

Project 3: Cryptography Due: 6 Apr. 2009 at 11:59 p.m. (Monday)
Project 4: Secure Distributed Banking Due: 28 Apr. 2009 at 11:59 p.m.

Grading Criteria

  • 16%   Midterm I - tentative date Feb. 17th
  • 16%   Midterm II - tentative date Apr. 2nd
  • 25%   Final exam - date to be determined by registrar
  • 40%   Course projects (group projects)
  • 03%   Course participation

Lecture Slides and Notes

Schedule

Date
Topic
Notes
1/15
Introduction & Overview

1/20*
Buffer Overflows

1/22
Designing Secure Software

1/27
Viruses and Worms I

1/29
Viruses and Worms: Containment / Networks

2/3
CRC / Ethernet

2/5
802.11 / IP

2/10
TCP / Firewalls

2/12
Firewalls / Content Filtering / Intrusion Detection

2/17
MIDTERM I

2/19
Access Control

2/24
Unix Access Control / Capabilities / Multilevel Security

2/26
Information Flow / Covert Channels

3/3
Stack Inspection

3/5
Introduction to Cryptography

3/10
SPRING BREAK

3/12
SPRING BREAK

3/17
Shared Key Crypto: DES and AES

3/19
Diffie Hellman & Public Key Crypto: RSA

3/24
RSA part II, Dolev-Yao models

3/26
Authentication and Signatures

3/31
Key Distribution / Kerberos / X.509

4/2
MIDTERM II

4/7
Class Cancelled

4/9
Conficker Revisisted / SSH

4/14
Passwords / Authentication / Anonymity

4/16
Onion Routing / Secure Voting

4/21
Analysis of an Electronic Voting System

4/23
Web Security Part I

4/28
Web Security Part II / Course Wrapup

5/8
FINAL EXAM: 9:00 - 11:00am Moore 216

*indicates dates when Prof. Zdancewic will be away.

Course Policies

  • Individual homework assignments will be available on the web pages. They are to be completed independently and turned in at the beginning of class on the due date.
  • Late homework will not be accepted without prior permission of the instructor unless there are emergency circumstances.
  • Teams for group projects will consist of two or three students. Students are not permitted to work individually on the team projects.

Regrade Policy

Regrade requests should be sent to the TA. Only reasonable requests will be considered. The entire homework or exam will be regraded. Note that this means that the score on a regraded homework might decrease.

Academic Integrity

This course will abide by the University's Code of Academic Integrity. In particular, for individual projects and group projects, the following guidelines should be followed:
  • For individual projects, you must type in and edit your own code, documentation, and any other materials submitted for grading.
    • Copying someone else's file is not allowed.
    • Allowing someone else to copy a file of yours, either explicitly or implicitly by leaving your code unprotected, is not allowed.
    • Editing each other's files is not allowed
  • Regarding the ethics of what you may or may not discuss with others:
    • "High level" discussions are fine.
      For example, discussions about the problem statement.
    • "Low level" discussions are fine.
      For example, discussions about C syntax or using gdb, understanding compiler error messages, understanding the mechanics of the tools and libraries used for the projects.
    • "Mid level" discussions require discretion. In this CIS course, discussions at this level must be limited.  Unless explicitly stated otherwise, you may not collaborate significantly with classmates (except group project members) at this level.  If you have minor discussions with others at this level or get help from outside resources (tutors, web sites, etc), you must cite at the top of the submitted projects the names of the people or websites who helped you and how they did. For example:
            /**
             * Chris Brown
             * Project 1
             * 5/6/2008
             * I received tips from Jo Johnson on the i/o and example.com/mem.htm on memory
             */
              
  • If there is any doubt about the use of external sources or collabortation, please ask for clarification by the course staff.