CS 265 Syllabus

San Jose State University
Department of Computer Science
CS 265, Cryptography and Computer Security, Spring 2016

Course and Contact information
- Instructor: Mark Stamp
- Office Location: MH 216
- Telephone: 408-924-5094
- Email: mark.stamp@sjsu.edu
- Office hours: Tuesday and Thursday, noon-1:00pm
- Class Days/Times: Tuesday and Thursday, 10:30-11:45am
- Classroom: MH 225
- Prerequisites: CS 149 or instructor consent.

Course Description
- We will cover selected security topics in each of the following areas: cryptography, access control, protocols, and software.
Learning Outcomes
- After completing this course you should be knowledgeable of the major technical security challenges in each of the following four areas: cryptography, access control, protocols, and software.
Required Texts/Readings
- Textbook: We will use a manuscript that will eventually become the 3rd edition of the textbook Information Security: Principles and Practice, Mark Stamp
- Other useful resources:
  - A Bug Hunter's Diary: A Guided Tour Through the Wilds of Software Security, Tobias Klein, No Starch Press, 2011. Lots of interesting real-world examples of vulnerable code.
  - Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, Michael Sikorski and Andrew Honig, No Starch Press, 2012. An excellent book for information on reverse engineering (whether for malware analysis or other purposes). Includes many hands-on exercises.
  - Software Reverse Engineering (SRE) website. This website, which was created by a former masters student, includes lots of good information and detailed exercises with solutions.
  - Network Security: Private Communication in a Public World, second edition, Charlie Kaufman, Radia Perlman, and Mike Speciner, Prentice Hall, 2002, ISBN: 0-13-046019-2. This book provides good coverage of cryptography and excellent coverage of several security protocols.
  - Security Engineering: A Guide to Building Dependable Distributed Systems, Ross Anderson, John Wiley & Sons, Inc., 2001, ISBN: 0-471-38922-6; see Ross Anderson's Security Engineering website http://www.cl.cam.ac.uk/~rja14/book.html, where you can obtain a free (and legal) copy of the 1st edition of the book. This is an excellent book for an overview of security in general, but it is not too focused or technically detailed.
  - Security in Computing, third edition, Charles P. Pfleeger and Shari Lawrence Pfleeger, Prentice Hall, 2003, ISBN: 0-13-035548-8. The strength of this book is its coverage of the security issues related to software. In particular, operating systems and some aspects of secure software engineering are covered well. This book also has some good, basic information on viruses.
  - Applied Cryptography: Protocols, Algorithms and Source Code in C, second edition, Bruce Schneier, John Wiley & Sons, Inc., 1995, ISBN: 0-471-11709-9. For better or for worse, in industry, this is the standard reference for all things cryptographic.
  - Counter Hack Reloaded: A Step-by-Step Guide to Computer Attacks and Effective Defenses, Ed Skoudis with Tom Liston, Prentice Hall, 2006, ISBN: 0-13-148104-5. There are many books that claim to provide information on how to foil hackers, but this is by far the best that I have seen. This is an updated version of the original Counter Hack, published in 2001.
  - Computer Viruses and Malware, John Aycock, Springer, 2006, ISBN: 0387302360. This book gives a good introduction to research topics related to malware. The book is well-written and surprisingly easy reading, given the technical nature of the material.
- Additional relevant material:
  - PowerPoint slides, errata, lecture videos, and other resources at http://www.cs.sjsu.edu/~stamp/infosec/
  - Previous semester lecture videos are available on You Tube at http://www.youtube.com/playlist?list=PLQEAKfSI2JLOzrgaQOgF6S3PqXs2zR614
  - Current semester lecture videos are available at http://www.cs.sjsu.edu/~stamp/infosec/lectures/CS265_Spr16/. If you are asked to login to access the videos, both the username and password are "infosec". Note: The instructor hereby gives students permission to record his lectures (audio and/or video). At least with respect to this class, your instructor has nothing to hide.
  - Class-related discussion will be posted on Piazza at https://piazza.com/class/idjegsissou2vy. You are strongly encouraged to participate by asking questions, as well as by responding to questions that other students ask. At the start of the semester, you should receive an email asking you to join this discussion group—if not, contact your instructor via email.
Course Requirements and Assignments
- SJSU classes are designed such that in order to be successful, it is expected that students will spend a minimum of forty-five hours for each unit of credit (normally three hours per unit per week), including preparing for class, participating in course activities, completing assignments, and so on. More details about student workload can be found in University Policy S12-3 at http://www.sjsu.edu/senate/docs/S12-3.pdf.
- Homework is due typewritten (include source code, but not executable files) by class starting time on the due date. Each assigned problem requires a solution and an explanation (or work) detailing how you arrived at your solution. Cite any outside sources used to solve a problem. When grading an assignment, I may ask for additional information. A subset of the assigned problems will typically be graded.
  
  Zip your homework into a file named hmk.zip. Email your work to cs265.sjsu.spr16@gmail.com. The subject line of your email must be of the form:
```
     CS265HMK assignmentnumber yourlastname last4digitofyourstudentnumber 
```
  That is, the subject line must consist of four identifiers. There is no space within an identifier and each identifier is separated by a space.
  - Assignment 1: Due Thursday, February 4
    Chapter 1, problems 1, 9, 11, 13, 15, 17. The problems for Chapter 1 are available at http://www.cs.sjsu.edu/~stamp/other/chap1/probs1.pdf.
    Read the first 10 pages of PoS RAM Scraper Malware at http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf. Then read a section on one of the "PoS RAM Scraper Families" and write a one-paragraph description. Finally, do the same for one of the "Next-Generation PoS RAM Scrapers".
  - Assignment 2: Due Thursday, February 11
    Chapter 2, problems 2, 5, 9, 12, 13, 15, 22, 24, 25, 26
  - Assignment 3: Due Thursday, February 18
    Chapter 3, problems 3, 4, 9, 11, 14, 25, 27, 30, 31, 37, 39a, 43. For problem 25b, you only need to give one disadvantage.
  - Assignment 4: Due Thursday, February 25
    Chapter 4, problems 1, 2, 6, 10, 14, 15, 20, 25, 29, 32, 41. For problem 29, your solution M must be non-trivial, i.e., M > 1.
  - Assignment 5: Due Thursday, March 3
    Chapter 5, problems 2, 5, 12, 16, 17, 21, 22, 25, 26, 35, 42, 43.
  - Assignment 6: Due Thursday, March 17
    Chapter 6, problems 9, 11, 13, 18, 24, 25, 26, 29, 32, 37, 38.
  - Assignment 7: Due Thursday, March 24
    Chapter 7, problems 2, 3, 7, 11, 14, 15, 19, 20, 24
  - Assignment 8: Due Thursday, April 7
    Chapter 8, problems 1, 2, 3, 4, 5, 8, 11a, 13, 15. For problem 1, send the spoofed email to mark.stamp@sjsu.edu.
  - Assignment 9: Due Thursday, April 14
    Chapter 9, problems 7, 8, 17, 18, 19, 20, 21, 25, 28, 33, 38, 42.
  - Assignment 10: Due Thursday, April 28
    Chapter 10, problems 1, 5, 10, 12, 13, 15, 18, 21, 24, 29, 32, 33.
  - Assignment 11: Due Thursday, May 5
    Chapter 10, problems 37, 38, 39, 40, 41, 42.
  - Assignment 12: Due Thursday, May 12
    Chapter 11, problems 6, 13, 15, 22, 27, 34, 36, 43.
    Chapter 12, problems 2, 4, 7.
  - Assignment 13: Due Varies
    Attend one (or more) of the master's defenses listed at http://cs.sjsu.edu/~stamp/defenses/spring16.html
- NOTE that University policy F69-24 at http://www.sjsu.edu/senate/docs/F69-24.pdf states that "Students should attend all meetings of their classes, not only because they are responsible for material discussed therein, but because active participation is frequently essential to insure maximum benefit for all members of the class. Attendance per se shall not be used as a criterion for grading."
Grading Policy
- Test 1, 100 points Date: Tuesday, March 8
- Test 2, 100 points Date: Tuesday, April 19
- Homework, quizzes, class participation and other work as assigned, 50 points.
- Cryptanalysis Project, 100 points. Your project topic is due Friday, February 5 and the completed project is due Friday, March 18. Note that a written report is required, but no oral report.
- SRE Project, 50 points. Your project topic is due Friday, April 1 and the completed project is due Tuesday, May 3. Presentations will be given beginning on the due date. Note that an oral report is required, but no written report.
- Final, 100 points
  - Date & time: Wednesday, May 18 from 9:45am-noon
  - The official finals schedule is here: http://info.sjsu.edu/static/catalog/final-exam-schedule-spring.html
- Semester grade will be computed as a weighted average of the major scores listed above.
- No make-up tests or quizzes will be given and no late homework or project (or other work) will be accepted. Also, in-class work must be completed in the section that you are enrolled in.
- Nominal Grading Scale:
  
  Percentage Grade
  92 and above A
  90 - 91 A-
  88 - 89 B+
  82 - 87 B
  80 - 81 B-
  78 - 79 C+
  72 - 77 C
  70 - 71 C-
  68 - 69 D+
  62 - 67 D
  60 - 61 D-
  59 and below F
- Note that "All students have the right, within a reasonable time, to know their academic scores, to review their grade-dependent work, and to be provided with explanations for the determination of their course grades." See University Policy F13-1 at http://www.sjsu.edu/senate/docs/F13-1.pdf for more details.
Classroom Protocol
- Keys to success at http://cs.sjsu.edu/~stamp/CS166/syllabus/success.html: Do the homework and attend class
- Wireless laptop is required. Your laptop must remain closed (preferably in your backpack and, in any case, not on your desk) until I inform you that it is needed for a particular activity
- Cheating will not be tolerated, but working together is encouraged
- Student must be respectful of the instructor and other students. For example,
  - No disruptive or annoying talking
  - Turn off cell phones
  - Class begins on time
  - Class is not over until I say it's over
- Valid picture ID required at all times
- The last day to drop is Tuesday, February 9, and the last day to add is Tuesday, February 16
University Policies
- General Expectations, Rights and Responsibilities of the Student:
  As members of the academic community, students accept both the rights and responsibilities incumbent upon all members of the institution. Students are encouraged to familiarize themselves with SJSU's policies and practices pertaining to the procedures to follow if and when questions or concerns about a class arises. See University Policy S90-5 at http://www.sjsu.edu/senate/docs/S90-5.pdf. More detailed information on a variety of related topics is available in the SJSU catalog, at http://info.sjsu.edu/web-dbgen/narr/catalog/rec-12234.12506.html. In general, it is recommended that students begin by seeking clarification or discussing concerns with their instructor. If such conversation is not possible, or if it does not serve to address the issue, it is recommended that the student contact the Department Chair as a next step.
- Dropping and Adding:
  Students are responsible for understanding the policies and procedures about add/drop, grade forgiveness, etc. Refer to the current semester's Catalog Policies section at http://info.sjsu.edu/static/catalog/policies.html. Add/drop deadlines can be found on the current academic year calendars document on the Academic Calendars webpage at http://www.sjsu.edu/provost/services/academic_calendars/. The Late Drop Policy is available at http://www.sjsu.edu/aars/policies/latedrops/policy/. Students should be aware of the current deadlines and penalties for dropping classes. Information about the latest changes and news is available at the Advising Hub at http://www.sjsu.edu/advising/.
- Consent for Recording of Class and Public Sharing of Instructor Material:
  University Policy S12-7, http://www.sjsu.edu/senate/docs/S12-7.pdf, requires students to obtain instructor's permission to record the course and the following items to be included in the syllabus:
  - "Common courtesy and professional behavior dictate that you notify someone when you are recording him/her. You must obtain the instructor's permission to make audio or video recordings in this class. Such permission allows the recordings to be used for your private, study purposes only. The recordings are the intellectual property of the instructor; you have not been given any rights to reproduce or distribute the material."
    - It is suggested that the greensheet include the instructor's process for granting permission, whether in writing or orally and whether for the whole semester or on a class by class basis.
    - In classes where active participation of students or guests may be on the recording, permission of those students or guests should be obtained as well.
  - "Course material developed by the instructor is the intellectual property of the instructor and cannot be shared publicly without his/her approval. You may not publicly share or upload instructor generated material for this course such as exam questions, lecture notes, or homework solutions without instructor consent."
- Academic integrity:
  Your commitment, as a student, to learning is evidenced by your enrollment at San Jose State University. The University Academic Integrity Policy S07-2 at http://www.sjsu.edu/senate/docs/S07-2.pdf requires you to be honest in all your academic course work. Faculty members are required to report all infractions to the office of Student Conduct and Ethical Development. The Student Conduct and Ethical Development website is available at http://www.sjsu.edu/studentconduct/.
- Campus Policy in Compliance with the American Disabilities Act:
  If you need course adaptations or accommodations because of a disability, or if you need to make special arrangements in case the building must be evacuated, please make an appointment with me as soon as possible, or see me during office hours. Presidential Directive 97-03 at http://www.sjsu.edu/president/docs/directives/PD_1997-03.pdf requires that students with disabilities requesting accommodations must register with the Accessible Education Center (AEC) at http://www.sjsu.edu/aec to establish a record of their disability.

Percentage	Grade
92 and above	A
90 - 91	A-
88 - 89	B+
82 - 87	B
80 - 81	B-
78 - 79	C+
72 - 77	C
70 - 71	C-
68 - 69	D+
62 - 67	D
60 - 61	D-
59 and below	F