Course Description
This course introduces the principles and practical considerations of computer and network security.
It covers the following:
- Basic concepts: threat models, security principles
- Software Attacks: buffer and integer overflow, format string vulnerabilities, stack smashing, reverse engineering with Ghidra and IDA
- Software Defenses: stack canaries, DEP, ASLR, shadow stack, fat pointers,
isolation, fuzz testing
- Applied cryptography: symmetric and asymmetric encryption, MACs, PRGs, PRFs,
PRPs, digital signatures, hash functions
- Basics of networks and the Web: TCP/IP, BGP, DNS, HTTP, cookies
- Network and Web attacks: BGP Hijacking, DNS forgery, SQL injection, CSRF, XSS
- Network security: firewalls, packet filtering, certificates, TLS 1.3
- Broader issues: surveillance, censorship, anonymity, legal issues, ethics
Prerequisites
- CIS 1600: Mathematical Foundations of Computer Science
- CIS 2400: Introduction to Computer Systems
Even though NETS students are not required to take CIS 2400, it is a prerequisite for this course.
Course Staff
Name |
Office hours (location) |
Sydnie-Shea Cohen |
TBD |
Joseph Katz |
TBD |
Neha Peddinti |
TBD |
Cameron Shaw |
TBD |
Praneel Varshney |
TBD |
Textbook
There is no required textbook for this course. The following books (available for free) are
good extra sources:
Assignments, quizzes, and exams
There will be 5 projects to be completed individually.
- Project 1: Pwnnsylvania platform, x86_64 assembly, pwntools
- Project 2: Fuzzing, advanced debugging with gdb, reverse engineering with Ghidra/IDA
- Project 3: Buffer overflows, integer overflows, format string exploits
- Project 4: Hash collisions, RSA signatures, length extension attacks
- Project 5: SQL injection, CSRF, XSS
There are two non-cumulative exams.
There will be 1 short ungraded quizz each week to be completed online through Canvas.
These are optional but highly encouraged. The purpose of these quizzes
is to keep you on track throughout the semester and make sure that you are understanding the material.
Late submissions
You can submit a project late by 2 days at the cost of a 10% late penalty.
You can submit a project late by more than 2 days at the cost of a 50% late penalty until
the last day of classes.
If you have an extenuating circumstance, you must contact the course staff before the assignment is due.
In person project audits
After each project, a random selection of students will be asked to come in person and
solve a variant of one of the challenges for which they submitted a solution in the project.
If the student is unable to complete the challenge in person, the student will receive no
credit for that particular challenge and will be asked to complete a different challenge
from the project (if they submitted other answers). Failure to complete 3 challenges will
result in a 0 for the entire project.
Grading
- Projects: 50%
- Exam 1: 25%
- Exam 2: 25%
Academic Honesty
We encourage you to discuss the problems and your general approach with other students in the class.
However, the answers you turn in must be your own original work, and you must adhere to Penn’s
Code of
Academic Integrity.
For more information, see the Office of Student Conduct.
Students with disabilities
The University of Pennsylvania provides reasonable accommodations to students with disabilities who have
self-identified and received approval from the Office
of Student Disabilities Services (SDS).
If SDS has approved your request for accommodations, please discuss with me
the necessary arrangements for your accommodations. SDS services are free and confidential.