Time: MWF 11:00 - noon
Room: Towne 321

Instructor:

    Steve Zdancewic
    e-mail: stevez AT cis.upenn.edu
    office hours: Tues. 9:30-10:30 (and by appointment) Levine 511

Teaching Assistants

    Savi Basavaraj
    e-mail: savi AT seas.upenn.edu
    office hours: Fri. 4:30-5:30 Levine 310

Announcements:

• 06.09.2006 -- Class begins.

Description:

• Networks & Infrastructure: Ethernet, TCP/IP, Denial of Service, IPSEC, TLS/SSL
• Security Policies and Principles: confidentiality, integrity, availability, authentication, access control
• System Security: hacker behavior, intrusion & anomaly detection, hacker and admin tools
• Basic Cryptography: Shared key (AES/DES), Public key (RSA), hashes (sha1/MD5)
• Cryptographic protocols: authentication, digital signatures, key exchange
• Malicious code: buffer overflows, viruses, worms, protection mechanisms

Reading and Course Material

The following books contain useful course material, and much of the lecture content is derived from them (and other sources). Copies of these books are on reserve in the Penn Engineering Library.

• Security in Computing (3rd edition) by Pfleeger and Pfleeger
• Computer Networks: A Systems Approach (3rd edition) by Larry L. Peterson and Bruce S. Davie
• Applied Cryptography (2nd edition) by Bruce Schneier

• Security Engineering, Ross Anderson's textbook
• The Protection of Information in Computer Systems, Saltzer & Schroeder (1975)
• Smashing the Stack for Fun and Profit, Aleph One (1996)
• Cyclic Redundancy Check (CRC) on Wikipedia
• The Internet Worm Program: An Analysis, Gene Spafford (1988)
• Kerberos: An Authentication Service for Open Network Systems, Steiner, Neuman, Schiller (1988)
• Kerberos FAQ
• Introduction to the Internet Protocols, Charles L. Hedrick (Rutgers). This 1987 tutorial is surprisingly up to date, and is a very concise introduction to the basics of the Internet protocols.
• Open SSL web page. The OpenSSL library is installed on eniac-l.
• "A look Back at 'Security Problems in the TCP/IP Protocol Suite'". S. M. Bellovin. 20th Computer Security Applications Conference. December 2004.
• "Advanced 4.4BSD Interprocess Communication Tutorial." Lefler, et al.
• Why Cryptosystems Fail, Ross Anderson (1993)
• Inside the Slammer Worm, Moore et al. (2003).
• How to 0wn the Internet in Your Spare Time , Staniford, Paxson, and Weaver (2002).
• Top Speed of Internet Flash Worms, Staniford, Moore, Paxson, and Weaver (2004).
• Internet Quarantine: Requirements for Containing Self-propagating Code, Moore et al. (2003)
• Automated Worm Fingerprinting, Singh et al. (2004)
• Bro Intrusion Detection System
• Bro: A System for Detecting Network Intruders in Real-Time, Vern Paxson. (1998)
• NSA Central Security Service
• TCSEC
• CERT
• National Information Assurance Training and Information Center
• Web pages of previous versions of CSE 331: [2004] [2003] [2002]
• An example midterm 1 exam from Fall 2004. (Note that the material covered in that instance of the class was slightly different and presented in a different order.)
• An example midterm 2 exam from Fall 2003. (Note that the material covered in that instance of the class was slightly different and presented in a different order.)
• An example final from Fall 2003. (Note that the material covered in that instance of the class was slightly different and presented in a different order.)
• Class newsgroup: upenn.cis.cse331

Homework and Projects

• Project 1: Buffer Overflows -- Due: 25 Sept. 2006
  Avg. 82
  Std. Dev. 8

• Homework 1 -- Due: 29 Sept. 2006
  Solutions

• Project 2: Network Intrusion Detection System -- Due: 25 Oct. 2006

• Homework 2: Homework 2 -- Due: 3 Nov. 2006 *NEW DATE*
  Solutions
  

• Project 3: Cryptography -- Due: 20 Nov. 2006
  • CASCII.java
  • msg1.txt
  • msg2.txt
  • msg3.txt
  • msg4.txt

• Project 4: Secure Distributed Banking -- Due: 8 Dec. 2006 at midnight
  • Project4.tar.gz

• Homework 3: Homework 3 -- Due: 8 Dec. 2006 11:00 AM
  Solutions

Lecture Slides and Notes

Course Policies

Prerequisites

Grading Criteria

• 20%   Individual Homework
• 40%   Group projects
• 12%   Midterm I
• 12%   Midterm II
• 15%   Final exam
• 01%   Course participation

Grading Policies

• Individual homework assignments will be available on the web pages. They are to be completed independently and turned in at the beginning of class on the due date.
• Late homework will not be accepted without prior permission of the instructor unless there are emergency circumstances.
• Teams for group projects will consist of two or three students. Students are not permitted to work individually on the team projects.

Regrade Policy

Academic Integrity

• For individual projects, you must type in and edit your own code, documentation, and any other materials submitted for grading.
  • Copying someone else's file is not allowed.
  • Allowing someone else to copy a file of yours, either explicitly or implicitly by leaving your code unprotected, is not allowed.
  • Editing each other's files is not allowed
• Regarding the ethics of what you may or may not discuss with others:
  • "High level" discussions are fine.
    For example, discussions about the problem statement.
  • "Low level" discussions are fine.
    For example, discussions about C syntax or using gdb, understanding compiler error messages, understanding the mechanics of the tools and libraries used for the projects.
  • "Mid level" discussions require discretion. In this CIS course, discussions at this level must be limited.  Unless explicitly stated otherwise, you may not collaborate significantly with classmates (except group project members) at this level.  If you have minor discussions with others at this level or get help from outside resources (tutors, web sites, etc), you must cite at the top of the submitted projects the names of the people or websites who helped you and how they did. For example:

          /**
           * Chris Brown
           * Project 1
           * 5/6/2007
           * I received tips from Jo Johnson on the i/o and example.com/mem.htm on memory
           */
            

• If there is any doubt about the use of external sources or collaboration, please ask for clarification by the course staff.