Syllabus

CS 266 Course Syllabus

General information
- CS 266 --- Topics in Information Security
- Department of Computer Science
- San Jose State University
- Fall 2011
Instructor Information
- Name: Mark Stamp
- Office: MQH 216
- Office hours: Friday 10:00am--noon and 1:00pm--3:00pm
- Phone: 408-924-5094
- email: stamp@cs.sjsu.edu
  - Email is the best way to contact me
  - Please include "CS266" at the beginning of the subject line
- Greensheet: http://www.cs.sjsu.edu/faculty/stamp/CS266/syllabus/syllabusFall11.html
- Who am I?
Course Overview and Description: In this course, we will cover selected topics in information security.
Textbook: TBD.
PowerPoint slides and other resources are available here.
Approximate schedule:
- Introduction and background (2 weeks)
- Selected topics in security (10 week)
- Project presentations (4 weeks)
Useful resources:
- Information Security: Principles and Practice, 2nd edition, Mark Stamp, (Wiley, May 2011, ISBN-10: 0470626399, ISBN-13: 978-0470626399).
- Network Security: Private Communication in a Public World, second edition, Charlie Kaufman, Radia Perlman and Mike Speciner, Prentice Hall, 2002, ISBN: 0-13-046019-2. This book provides good coverage of cryptography and excellent coverage of several security protocols.
- Security Engineering: A Guide to Building Dependable Distributed Systems, Ross Anderson, John Wiley & Sons, Inc., 2001, ISBN: 0-471-38922-6; see Ross Anderson's Security Engineering website http://www.cl.cam.ac.uk/~rja14/book.html, where you can obtain a free (and legal) copy of the book. This is an excellent book for an overview of security in general, but it is not very focused or technically detailed.
- Security in Computing, third edition, Charles P. Pfleeger and Shari Lawrence Pfleeger, Prentice Hall, 2003, ISBN: 0-13-035548-8. The strength of this book is its coverage of the security issues related to software. In particular, operating systems and some aspects of secure software engineering are covered well. This book also has some good basic information on viruses.
- Applied Cryptography: Protocols, Algorithms and Source Code in C, second edition, Bruce Schneier, John Wiley & Sons, Inc., 1995, ISBN: 0-471-11709-9. For better or for worse this is the standard reference for cryptography, particularly in industry.
- Counter Hack Reloaded: A Step-by-Step Guide to Computer Attacks and Effective Defenses, Ed Skoudis with Tom Liston, Prentice Hall, 2006, ISBN: 0-13-148104-5. There are many books that claim to provide information on how to foil hackers, but this is by far the best that I have seen. This is an updated version of the original Counter Hack, published in 2001.
- Computer Viruses and Malware, John Aycock, Springer, 2006, ISBN: 0387302360. This book gives a good introduction to research topics related to malware. The book is well-written and surprisingly easy reading, given the technical nature of the material. However, it is somewhat uneven in its coverage, with many interesting topics only mentioned in passing, and some of the more lengthy discussions allocated to topics of marginal interest (at least to me).
- My recent masters projects can be found here
Student Learning Objectives: After completing this course you will be knowledgable regarding selected advanced topics in information security.
Grading:
1. Test 1, 100 points. Date: TBD.
2. Homework, quizzes, class participation and other work as assigned, 50 points. Note that a subset of the assigned problems will be graded.
3. Project 1, 100 points. For this project, you must read a research paper in the field of security and give a detailed presentation of the paper in class. You can work individually, or with a partner. A list of acceptable research papers is given here. You must submit your paper preference (via email) by September 7 and you must obtain my approval. Note that papers not on the list might also be acceptable. The paper presentations will be given on Wednesdays, beginning September 28. No written report is required.
4. Project 2, 100 points. You must give a brief oral presentation and defense of your proposed project topic. These presentations will be given on September 19 and 21. Your written project report is due Monday, November 21 and must be submitted in hardcopy.
5. Final, 100 points. Date: Thursday, December 15 from 12:15pm-2:30pm.
6. The official finals schedule is here: http://info.sjsu.edu/web-dbgen/narr/soc-fall/rec-343.html
7. Semester grade will be computed as a weighted average of the major scores listed above.
8. No make-up tests or quizzes will be given, no late homework or project (or other work) will be accepted.
9. Nominal Grading Scale:
  
  Percentage Grade
  92 and above A
  90 - 91 A-
  88 - 89 B+
  82 - 87 B
  80 - 81 B-
  78 - 79 C+
  72 - 77 C
  70 - 71 C-
  68 - 69 D+
  62 - 67 D
  60 - 61 D-
  59 and below F
Homework: Homework is due typewritten (including source code) by class starting time on the due date. Each assigned problem requires a solution and an explanation (or work) detailing how you arrived at your solution. Cite any outside sources used to solve a problem. When grading an assignment, I may ask for additional information. Note that a subset of the assigned problems will be graded.

Zip your homework into a file named hmk.zip. Email your work to stamp@cs.sjsu.edu. The subject line of your email must be of the form:
CS266HMK assignmentnumber yourlastname last4digitofyourstudentnumber
That is, the subject line must consist of four identifiers. There is no space within an identifier and each identifier is separated by a space.

Homework is due, in the form of a typewritten hardcopy, at the start of class on the due date. Late assignments will lose 10% of the maximum grade for each minute overdue, so that, for example, an assignment that is 5 minutes late cannot receive a grade higher than 50%. If an assignment is a group project, the late penalty applies if any member of the group is late.
- Assignment 1: Due Wednesday, September 14
  Read the paper, A Revealing Introduction to Hidden Markov Models, which can be found here, and solve problems 1 through 8, omitting problem 7, part c. The "Brown Corpus" and C source code for an HMM can be found here.
- Assignment 2: Due Monday, October 17
  Solve the following problems from the handout titled "World War II Ciphers" (use the source code for the Enigma and Sigaba ciphers found here): 10, 11, 12, 25, 26
- Assignment 3: Due Wednesday, November 23
  Solve the problems on the handout that was distributed in class on Wednesday, November 16.
- Assignment 4: Due TBD
- Assignment 5: Due TBD
- Assignment 6: Due TBD
- Assignment 7: Due TBD
- Assignment 8: Due TBD
- Assignment 9: Due TBD
- Assignment 10: Due TBD
Other Important Stuff:
- No extra credit is anticipated
- Keys to success: Do high quality work on the projects, do (and understand) the homework, attend class
- Wireless laptop is required. Your laptop must remain closed (preferably in your backpack and, in any case, not on your desk) until I inform you that it is needed for a particular activity
- Cheating will not be tolerated...
- ...but working together is encouraged
- Student must be respectful of the teacher and other students.
  - No disruptive or annoying talking
  - Turn off cell phones
  - Class begins on time
  - Class is not over until I say it's over
  - Etc.
- Disability information and policies can be found here
- Valid picture ID required at all times
- Guest lecture(s)
  - Speaker: D.J. Capelis, UC-Santa Cruz
  - Title: TBD
  - Date: Wednesday, September 14
  - Time: 3:00pm
  - Location: MH 223
  - Abstract:
  - Speaker: Cory Scott, Matasano Security
  - Title: The Current State of Vulnerability Research and the Market for Vulnerabilities
  - Date: Wednesday, October 12
  - Time: 3:00pm
  - Location: MH 223
  - Abstract: Software vulnerability research drives changes in information security and the software development ecosystem faster than any other single activity. We'll review the "How, where, why, and when" for vulnerability discovery and tell you why the standard debates regarding disclosure, open source, native vs. managed code, and operating system flavors don't matter.
  - Speaker: Clark Thomborson
  - Title: Security through Obscurity: A Necessary Evil?
  - Date: Wednesday, December 7
  - Time: 3:00pm
  - Location: MH 223
  - Powerpoint slides: Security Through Obscurity
  - Abstract:
    Most secure systems rely, ultimately, on confidentiality for their security. This reliance was first formalised by Auguste Kerckhoffs in 1883. Kerckhoffs' ideal system is able to transmit secret messages, even if its design is public knowledge. Messaging secrecy is maintained as long as the cryptographic key remains secret. For this reason, the ideal system performs its key-related computations inside a "black box" which is secure against adversarial observation. Furthermore, the cryptographic key must be cloaked from adversarial inspection while it is being generated, and while it is being loaded into the system. In this seminar, we discuss some methods for building "black boxes" in computer systems. Some of these methods do not directly support Kerckhoffs' ideal cryptography: they can preserve the secrecy of diffuse information, whereas Kerckhoffs' ideal keys are short enough to be remembered by human operators. We close this seminar with a brief exploration of the forms of security which can be assured by the integrity of a trusted subsystem, or by the availability of a trusted subsystem, rather than (as in Kerckhoff's ideal) by the confidentiality of a trusted subsystem.
  - Bio:
    Clark Thomborson is a Professor of Computer Science at the University of Auckland, New Zealand. In recent years he has been in active discussion with CIOs and CISOs in The Jericho Forum. His current research focus is the analysis and high-level design of trustworthy computer systems. He also maintains an active interest in the dark arts of software security: watermarking, obfuscation, and tamper-proofing. His prior areas of research include the development and use of analytic models of computer system performance, including area-time complexity for VLSI computations and memory efficiency for parallel computing systems. Under his birth name Clark Thompson, he was awarded a PhD in Computer Science from Carnegie-Mellon University and a BS (Honors) in Chemistry from Stanford.
Boring Stuff:

Percentage	Grade
92 and above	A
90 - 91	A-
88 - 89	B+
82 - 87	B
80 - 81	B-
78 - 79	C+
72 - 77	C
70 - 71	C-
68 - 69	D+
62 - 67	D
60 - 61	D-
59 and below	F