• CS 166 — Information Security
• Department of Computer Science
• San Jose State University
• Spring 2013

• Name: Mark Stamp
• Office: MH 216
• Office hours: Tuesday/Thursday 10:15am-10:45am and 1:15pm-1:45pm
• Phone: 408-924-5094
• email: stamp@cs.sjsu.edu
  • Email is the best way to contact me
  • Please put "CS166" at the beginning of the subject line
• Greensheet: http://www.cs.sjsu.edu/faculty/stamp/CS166/syllabus/syllabusSpr13.html
• Who am I?

• PowerPoint slides, errata, lecture videos, and other resources are available here. Previous semester lecture videos are available on You Tube.

• Approximate schedule (3 hours equals 1 week of class time):
  • Introduction
    • Chapter 1 (1 hour)
  • Crypto
    • Chapter 2: Crypto Basics (3 hours)
    • Chapter 3: Symmetric Key Crypto (4 hours)
    • Chapter 4: Public Key Crypto (4 hours)
    • Chapter 5: Hash Functions and Other Topics (4 hours)
  • Access Control
    • Chapter 7: Authentication (4 hours)
    • Chapter 8: Authorization (2 hour)
  • Protocols
    • Chapter 9: Simple Authentication Protocols (4 hours)
    • Chapter 10: Real-World Security Protocols (5 hours)
  • Software
    • Chapter 11: Software Flaws and Malware (4 hours)
    • Chapter 12: Insecurity in Software (4 hours)
    • Chapter 13: Operating Systems and Security (4 hours)
  
  
• Note: Due to time constraints, we omit Chapter 6 and various parts of the last three chapters.
  
  
• Other useful resources:
  • Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, Michael Sikorski and Andrew Honig, No Starch Press, 2012. An excellent book for information on reverse engineering (whether for malware analysis or other purposes). Includes many hands-on exercises.
  • Software Reverse Engineering (SRE) website. This website, which was created by a former masters student, includes lots of good information and detailed exercises with solutions.
  • Network Security: Private Communication in a Public World, second edition, Charlie Kaufman, Radia Perlman, and Mike Speciner, Prentice Hall, 2002, ISBN: 0-13-046019-2. This book provides good coverage of cryptography and excellent coverage of several security protocols.
  • Security Engineering: A Guide to Building Dependable Distributed Systems, Ross Anderson, John Wiley & Sons, Inc., 2001, ISBN: 0-471-38922-6; see Ross Anderson's Security Engineering website http://www.cl.cam.ac.uk/~rja14/book.html, where you can obtain a free (and legal) copy of the 1st edition of the book. This is an excellent book for an overview of security in general, but it is not too focused or technically detailed.
  • Security in Computing, third edition, Charles P. Pfleeger and Shari Lawrence Pfleeger, Prentice Hall, 2003, ISBN: 0-13-035548-8. The strength of this book is its coverage of the security issues related to software. In particular, operating systems and some aspects of secure software engineering are covered well. This book also has some good, basic information on viruses.
  • Applied Cryptography: Protocols, Algorithms and Source Code in C, second edition, Bruce Schneier, John Wiley & Sons, Inc., 1995, ISBN: 0-471-11709-9. For better or for worse, in industry, this is the standard reference for all things cryptographic.
  • Counter Hack Reloaded: A Step-by-Step Guide to Computer Attacks and Effective Defenses, Ed Skoudis with Tom Liston, Prentice Hall, 2006, ISBN: 0-13-148104-5. There are many books that claim to provide information on how to foil hackers, but this is by far the best that I have seen. This is an updated version of the original Counter Hack, published in 2001.
  • Computer Viruses and Malware, John Aycock, Springer, 2006, ISBN: 0387302360. This book gives a good introduction to research topics related to malware. The book is well-written and surprisingly easy reading, given the technical nature of the material.

1. Test 1, 100 points. Date: Thursday, March 7. Practice test can be found at http://cs.sjsu.edu/~stamp/other/test1_review_Spr13.pdf.
2. Test 2, 100 points. Date: Thursday, April 18.
3. Homework, quizzes, class participation, and other work as assigned, 100 points.
4. Final, 100 points.
   • Section 01, Wednesday, May 15 from 7:15am-9:30am
   • Section 02, Thursday, May 16 from 9:45am-noon
   • The official finals schedule is here: http://info.sjsu.edu/static/schedules/final-exam-schedule-spring.html
5. Semester grade will be computed as a weighted average of the 4 major scores listed above.
6. No make-up tests or quizzes will be given and no late homework (or other work) will be accepted. Also, in-class work must be completed in the section that you are enrolled in.
7. Nominal Grading Scale:
   
   

   Percentage	Grade
   92 and above	A
   90 - 91	A-
   88 - 89	B+
   82 - 87	B
   80 - 81	B-
   78 - 79	C+
   72 - 77	C
   70 - 71	C-
   68 - 69	D+
   62 - 67	D
   60 - 61	D-
   59 and below	F

     CS166HMK assignmentnumber yourlastname last4digitofyourstudentnumber 

• Assignment 1: Due Thursday, January 31
  Chapter 1, problems 2, 9, 13, 15, 17. The problems for Chapter 1 can be found here.
  Also, read and briefly comment on each of these recent articles:
  • New York Times article on malware.
  • Passwords hacked.
  • Carrier pigeons?
  
  
  
• Assignment 2: Due Thursday, February 7
  Chapter 2, Problems 2, 6, 11, 12, 15, 22, 24, 26, 28. Write the program for problem 12 before you solve problem 11, and use your program to help you solve problem 11.
  
  
• Assignment 3: Due Thursday, February 14
  Chapter 3, Problems 3, 4, 6, 9, 11, 14, 25, 27, 30, 31, 37, 43. For problem 25, part b., you only need to provide 1 disadvantage.
  
  
• Assignment 4: Due Tuesday, February 26
  Chapter 4, Problems 1, 2, 6, 10, 15, 20, 25, 29, 30, 32, 37. See the textbook errata for some additional information on problem 32 (specifically, see item number 12).
  
  
• Assignment 5: Due Tuesday, March 5
  Chapter 5, Problems 3, 5, 12, 16, 17, 21, 22, 25, 26, 27, 28, 35, 38, 42, 48. For problem 25, generating the files is part of the assignment, so once you have the files, do not give them to anyone else, or post them online.
  
  
• Assignment 6: Due Tuesday, March 19
  Chapter 7, Problems 1, 6, 9, 10, 11, 13, 14, 25, 31, 37, 38, 40.
  
  
• Assignment 7: Due Thursday, April 4
  Chapter 8, Problems 2, 3, 6, 7, 8, 11, 13, 15, 19, 20, 24.
  
  
• Assignment 8: Due Tuesday, April 9
  Chapter 8, Problems 28, 29, 31, 33. Also, solve the following:
  1) Send a spoofed email to stamp@cs.sjsu.edu. Do not identify yourself in the spoofed email. In your submitted solution include the contents of the spoofed email and explain how you sent the email.
  2) What are the inherent security strengths and weaknesses of stateless protocols, as compared to stateful protocols? What are the inherent security strengths and weaknesses of stateful protocols, as compared to stateless protocols?
  3) Discuss in detail an attack involving IP fragmentation.
  4) Recall the ARP cache poisoning attack discussed in class. How can you prevent such an attack? Does your suggested prevention measure create any potential vulnerability? Why or why not?
  5) DNS is essentially a single point of failure for the Internet. Explain why this is the case.
  6) Outline a DoS attack that exploits the TCP 3-way handshake. Discuss possible defenses against such an attack and discuss possible countermeasures that Trudy could use to circumvent your suggested defenses.
  
  
• Assignment 9: Due Tuesday, April 16
  Chapter 9, Problems 4, 6, 16, 17, 18, 19, 20, 27, 30, 36.
  
  
• Assignment 10: Due Thursday, May 2
  Chapter 10, Problems 1, 6, 10, 11, 13.
  Chapter 12, Problems 1, 2, 3, 7, 12.
  
  
• Assignment 11: Due Monday, May 13
  Chapter 10, Problems 15, 18, 21, 25, 27, 35, 38, 40.
  Chapter 11, Problems 6, 11, 13, 15, 19, 42, 43.
  
  
• Assignment 12: Due Before end of finals
  You are required to attend at least one of the masters defenses listed here. These will all occur before the end of finals week, and the schedule should be finalized by the last week of class.
  
  

• No disruptive or annoying talking
• Turn off cell phones
• Class begins on time
• Class is not over until I say it's over
• Etc.

• Speaker: TBD
• Affiliation: TBD
• Title: TBD
• Date: TBD
• Abstract: TBD
  

• Academic integrity
  
  Your commitment as a student to learning is evidenced by your enrollment at San Jose State University. The University's Academic Integrity policy, located at http://www.sjsu.edu/senate/S07-2.htm, requires you to be honest in all your academic course work. Faculty members are required to report all infractions to the office of Student Conduct and Ethical Development. The Student Conduct and Ethical Development website is available at http://www.sa.sjsu.edu/judicial_affairs/index.html. Instances of academic dishonesty will not be tolerated. Cheating on exams or plagiarism (presenting the work of another as your own, or the use of another person's ideas without giving proper credit) will result in a failing grade and sanctions by the University. For this class, all assignments are to be completed by the individual student unless otherwise specified. If you would like to include your assignment or any material you have submitted, or plan to submit for another class, please note that SJSU's Academic Policy S07-2 requires approval of instructors.
  
  
• Campus Policy in Compliance with the American Disabilities Act
  
  If you need course adaptations or accommodations because of a disability, or if you need to make special arrangements in case the building must be evacuated, please make an appointment with me as soon as possible, or see me during office hours. Presidential Directive 97-03 requires that students with disabilities requesting accommodations must register with the Disability Resource Center (DRC) at http://www.drc.sjsu.edu/ to establish a record of their disability.