CS 166 Syllabus

CS 166 Course Syllabus

Instructor information
1. Name: Mark Stamp
2. Office: MQH 216
3. Office hours: MW, 1:20--3:50pm
4. Phone: 408-924-5094
5. email: stamp@cs.sjsu.edu
6. Greensheet: http://www.cs.sjsu.edu/faculty/stamp/CS166/syllabus/syllabusFall06.html
7. Who am I?
Textbook: Information Security: Principles and Practice, Mark Stamp, (Wiley InterScience, 2005, ISBN 0-471-73848-4).
- We will cover the following material:
  - Introduction
    - Chapter 1
  - Crypto
    - Chapter 2: Crypto Basics
    - Chapter 3: Symmetric Key Crypto
    - Chapter 4: Public Key Crypto
    - Chapter 5: Hash Functions and Other Topics
  - Access Control
    - Chapter 7: Authentication
    - Chapter 8: Authorization
  - Protocols
    - Chapter 9: Simple Authentication Protocols
    - Chapter 10: Real-World Security Protocols
  - Software
    - Chapter 11: Software Flaws and Malware
    - Chapter 12: Insecurity in Software
    - Chapter 13: Operating Systems and Security
- Note: We omit most of Chapter 8 and parts of the last three chapters.
- Textbook errata can be found here.
- Other useful security books:
  - Network Security: Private Communication in a Public World, second edition, Charlie Kaufman, Radia Perlman and Mike Speciner, Prentice Hall, 2002, ISBN: 0-13-046019-2. This book has limited, but good, coverage of cryptography and excellent coverage of some security protocols.
  - Security Engineering: A Guide to Building Dependable Distributed Systems, Ross Anderson, John Wiley & Sons, Inc., 2001, ISBN: 0-471-38922-6; see Ross Anderson's Security Engineering website http://www.cl.cam.ac.uk/~rja14/book.html for lots of interesting security information, and errata for his book. This is an excellent book, primarily consisting of case studies illustrating security failures. The emphasis is on human factors, not technical issues.
  - Security in Computing, third edition, Charles P. Pfleeger and Shari Lawrence Pfleeger, Prentice Hall, 2003, ISBN: 0-13-035548-8. The strength of this book is its coverage of software security issues. In particular, operating systems and some aspects of secure software engineering are covered well. It also has some dated, but reasonably good information on viruses.
  - Applied Cryptography: Protocols, Algorithms and Source Code in C, Second Edition, Bruce Schneier, John Wiley & Sons, Inc., 1995 (2nd edition), ISBN: 0-471-11709-9. This is a standard reference for real-world cryptography.
  - Computer Security, Dieter Gollmann, John Wiley & Sons, Inc., 1999, ISBN: 0471978442. This book is not particularly easy to read. I recommend Chapter 8, How Things Go Wrong.
  - Computer Security: Art and Science, Matt Bishop, Addison Wesley, 2003, ISBN: 0-201-44099-7. This is a very long and extremely theoretical book.
  - Counter Hack Reloaded: A Step-by-Step Guide to Computer Attacks and Effective Defenses, 2nd editions, Ed Skoudis and Tom Liston Prentice Hall, 2005, ISBN: 0131481045. There are many books that claim to provide information on how hackers operate and how to foil attacks, etc., but this is by far the best.
Student Learning Objectives: After completing this course you should be knowledgeable concerning the major technical security challenges in each of the four crucial areas of cryptography, access control, protocols, and software.
PowerPoint slides for the course are available here (the slides are also available in pdf from here).
Grading:
1. Test 1, 100 points. Date: Monday, October 2.
2. Test 2, 100 points. Date: Monday, November 6.
3. Homework, quizzes, class participation, and other work as assigned, 100 points.
4. Final, 100 points. Date: Section 01, Monday, December 11, 9:45--noon, Section 02, Friday, December 15, 12:15--2:30pm. The official finals schedule is here: http://info.sjsu.edu/web-dbgen/narr/soc-fall/rec-231.html
5. Semester grade will be computed as a weighted average of the 4 major scores listed above.
6. No make-up tests or quizzes will be given and no late homework or project will be accepted.
7. Grading Scale:
  
  Percentage Grade
  92 and above A
  90 - 91 A-
  88 - 89 B+
  82 - 87 B
  80 - 81 B-
  78 - 79 C+
  72 - 77 C
  70 - 71 C-
  68 - 69 D+
  62 - 67 D
  60 - 61 D-
  59 and below F
Homework: Note that a subset of the assigned problems will be graded. Show your work and/or provide an explanation of your solution, as appropriate. Cite any sources that you used to solve a problem. Homework is due (in hardcopy) at the beginning of class on the due date.
- Due Friday, September 8:
  Chapter 2, problems 5,14,15, and decrypt the following message, which was encrypted using a simple substitution cipher:
```
TULQQXMZFPCMYDNPLVPNHQXMAMFFIPVCNWMKPLXMFPVKMKXWLCNMRRW
QXCPNMLUZZDNQWVBMPCXIPVDVQXMQDZDYQXMQWKMAGPYWVBMNMVQRWV
MKWVXWLXPWNTULQQXMZFPCMYDNPLVPNHWXPOMLPWKWQQRWCMQXPQPFD
VMLXDUFKMVCDUNPBMQXMCNMRTULQQXMZFPCMYDNPLVPNHWXPOMLPWKW
QQXNWCMRXPQWQMFFGDUQXNMMQWIMLWLQNUM
```
  Chapter 3, problems 2,6,16,18,27.
- Due Friday, September 22:
  Chapter 4, problems 5,6,7,9,14,20,24a
- Due Friday, September 29:
  Chapter 5, problems 1,8,14,19,22,25. The files you need for problem 19 can be found here.
- Due Friday, October 13:
  Chapter 7, problems 1,9,10,11,12,13,15.
- Due Friday, October 20:
  Chapter 8, problems 1,3,8,10,16 and the following problem: For password cracking, the most realistic situation is Case IV of Section 7.3.5. In this case, the amount of work that Trudy must do to determine a password depends on a) the size of the dictionary, b) the probability that a given password is in the dictionary, and c) the size of the password file. Suppose that Trudy's dictionary is of size 2ⁿ, the probability that a password is in the dictionary is p, and the password file is of size M. Show that if p is small and M is sufficiently large, then Trudy's expected work is about 2ⁿ/p. Hint: Use the result of Problem 21 in Chapter 7.
- Due Friday, October 27:
  Chapter 9, problems 3,5,6,8,10,20,27,28.
- Due Friday, November 3:
  Chapter 10, problems 6,9,14(parts a,b and c),15,17,24,27.
- Due Wednesday, November 22:
  Chapter 11, problems 5,10,13,18, and exploit the buffer overflow in the Windows executable located here (bypass the serial number check and discover the "magic words"). For the buffer overflow problem, you may want to make use of Ollydbg.
- Due Wednesday, December 6:
  Chapter 12, problems 3,5 (the zip file is here), 17,22
  Chapter 13, problems 3,12,14,15,20
Keys to success: Do the homework and attend class
Cheating will not be tolerated...
- ...but working together is encouraged
Student must be respectful of the teacher and other students; for example
- No talking
- Turn off cell phones
- Class begins on time
- Class is over when I say it's over
Disability information and policies can be found here
Valid picture ID required at all times
Note that the last day to drop is September 5 and the last day to add is September 12
Guest lecture
- Speaker: Wing Wong
- Title: Hunting for Metamorphic Engines
- Date: Monday, November 20
- Time: Regular class time
- Location: MH 225
- Powerpoint slides are located here (560 KB).
Other Required Stuff

Percentage	Grade
92 and above	A
90 - 91	A-
88 - 89	B+
82 - 87	B
80 - 81	B-
78 - 79	C+
72 - 77	C
70 - 71	C-
68 - 69	D+
62 - 67	D
60 - 61	D-
59 and below	F