Computer Security -- EDA263

Spring semester, study period 3, 2012

(Course code DIT641 for Göteborg University)

News:

• [2013-02-06]  The re-exam given Thursday 2013-01-17 is now corrected and reported. The exam review will take place 
                         Tue 2013-02-19, at 0845-0915 in Erland Jonsson's office (room 5121, CSE building, west wing, floor 5).

• [2012-12-08]  The course page for the course 2012/2013 is now up. The student portal does not properly link to it,
                         but you can find it here.

• [2012-10-22]  The second EDA263 re-exam will be given Thursday 2013-01-17, at 14.00 – 18.00, in the V-house.
                          It is not possible to register for this re-exam. You can just show up there. 

• [2012-09-14]  The exam given 2012-08-29 has now been corrected and the results will be mailed
                         out starting from today (for GU). The exam review will take place Thu 2012-09-20
                         at 0930-1030 in room 5128 (5th floor) at the department.

• [2012-04-04]  The exam review will take place Wed 2012-04-18 at 1230-1330 in room 5128 (5th floor)
                         at the department.
  
  
• [2012-03-27]  The exam given 2012-03-08 has now been corrected and the results will be mailed
                         out shortly. The review occasion will be scheduled for week 16 (starting April, 16th).
                         Exact date and time to be announced next week.
  
  
• [2012-02-22]  A newly developed "Laboration 4" on SQL Injection and Cross-site scripting
                        (not part of the course) will be tested in the beginning of study period 4. We
                        seek a limited number of volunteers for testing the lab. If you are interested
                        please send an email to Pierre Kleberger (email: pierre.kleberger).
                        The registration is now closed.
  
  
• [2012-02-17] There will be an extra lab on Tuesday, Feb21, 13--17. 
  
  
• [2012-02-16] Sign up for possible capture the flag team from Chalmers can be found here.
  
  
• [2012-02-03] The mid-course meeting took place Thu 2012-02-09, 1500-1600 in
                        room 5128 at the CSE department. The notes can be found here.
  
  
• [2012-01-23] Regarding "one-student lab groups": Please find a partner, so that
                        there will be two students in each lab group!
  
  
• [2011-12-12] The course will start Mon 2012-01-16, at 1315-1500 in room HC4
  

• [2011-12-08] Page under construction

Course Description

Examiner: Professor Erland Jonsson, phone: 031-772 1698, email: erland.jonsson

The Computer Security course gives a broad overiew of the security area. The approach is largely technical, but the course will also address the important societal implications of security (or rather lack of security). Roughly, security deals with how to protect your system against intentional intrusions and attacks. The purpose of intrusions can be made to change or delete resourses (data, programs, hardware, etc), to get unauthorized access to confidential information or unauthorized use of the system's services. The course covers threats and vulnerabilities as well as rules, methods and mechanisms for protection. During a few lectures, a holistic security approach is taken and organizational, business-related, social, human, legal and ethical aspects are treated.

The Computer security course is the first within our Security specialization.

Recommended text book
Stallings & Brown: Computer Security,
Pearson 2008, ISBN: 978-0-13-513711-6

Course Memo

Reading Instructions

Lab Information

Course Material

The following course material is electronically available.
Please note that the lecture slides alone do not give a full coverage of the course contents.
All lectures are given in HC4.

Lectures and slides

• Lecture 1 (Mon 2012-01-16, 1315-1500 in HC4)
  Course Introduction, Vulnerabilities,threats, and protection mechanisms,
  DL 1:Targeted Trojan Email Attacks
  
  
• Lecture 2 (Thu 2012-01-19, 1000-1145 in HC4)
  UNIX security, Introduction to Malware
  
  
• Lecture 3 (Fri 2012-01-20, 1515-1700 in HC4)
  Authentication and Access control, Passwords
  DL2: Testing biometric methods
  DL3: Bank card skimming
  DL4: Password trading
  DL12: Password guessing
  
  
• Lecture 4 (Mon 2012-01-23, 1315-1500 in HC4):
  Malware II, Loveletter virus, buffer overflows intro, buffer flow detailed
  
  
• Lecture 5 (Thu 2012-01-26, 1000-1145 in HC4)
  Malware defences, Firewalls and NW security
  link and end-to-end encryption
  DL7: Attacking Malicious Code
  Operating Systems security
  
  
• Lecture 6 (Fri 2012-01-27, 1515-1700 in HC4)
  Network attacks+network authentication - Kerberos, DOS attacks
  
  
• Lecture 7 (Mon 2012-01-30, 1315-1500 in HC4)
  Intrusion detection systems (rev 2), Intrusion tolerance
  
  
• Lecture 8 (Thu 2012-02-02, 1000-1145 in HC4)
  An introduction to cryptology
  
  
• Lecture 9 (Mon 2012-02-06, 1315-1500 in HC4): 
  Security Policies and Models
  
  
• Lecture 10 (Thu 2012-02-09, 1000-1145 in HC4):
  Security and Dependability modelling,
  Security and Dependability metrics
  DL8: A Framework for Security Metrics
  
  
• Lecture 11 (Mon 2012-02-13, 1315-1500 in HC4): 
  Risk Analysis (fullpage), Human and Organisational factors (fullpage)
  Key Escrow
  DL13: Key Escrow systems taxonomy, DL9: The Risks of Key Recovery
  

• Lecture 12 (Thu 2012-02-16, 1000-1145 in HC4):
  Database security, Defensive Programming
  
  
• Lecture 13 (Mon 2012-02-20, 1315-1500 in HC4):
  Common Criteria, Computer Forensics
  DL11: Common Criteria - Introduction and General Model (partly)
  DL14: Spam Economics
  

• Lecture 14 (Thu 2012-02-23, 1000-1145 in HC4):
  Guest lecture by Åke Ljungqvist - IBAS:
  Hard Disk Data Recovery and Erasure, (fullpage)
  DL5: Data remanence
  
  
• Lecture 15 (Mon 2012-02-27, 1315-1500 in HC4):
  Honeypots, Side-channel attacks (fullpage), Ethical issues, Examination
  DL15: Introduction to Side-channel attacks
  

Course Evaluation

• Information about the Course Evaluation Procedure
  is found on the Course evaluation page
  

• The course representatives are:
  
  - Guillermo Barredo Garcia, barredo@student
  - Sonny Karlsson, ksonny@student
  - Marcus Laurila, marlau@student
  

Examination dates 2012/2013

Thu 2012-03-08 pm, Wed 2012-08-29 pm and 2013-01-17 pm. 

Previous examinations

Extra reading (for curious students)

• 13-year old boot-sector virus attacks modern PCs running Vista
• DOS attack against twitter (NY Times)
• An article about how buffer overflows work in detail with code examples:
  Smashing the stack for fun and profit, Phrack Magazine vol. 7, issue 49
• Stuxnet - malware for nuclear power plants. Analysis by Symantec
• The original description of the Biba Model
• Why cryptosystems fail
• Integer Overflows
• Description of OWASP Top Ten Critical Web Application Security Risks
• The Spam Value Chain
• Measuring Pay-per-Install:
  
• Global eavesdropping
• Honey Pots and Honey Nets - Security through Deception (SANS Institute)
• Bypassing the password (about using keystroke dynamics for authentication)
  

Miscellaneous

• [2012-02-22] Lediga befattningar inom Försvarets IT-försvarsförband. (In Swedish).