Lectures
(Note this is a rough schedule and things are subject to change.)
-
Security Principles: Introduction, Ethics, and Course Overview
(Instructor: Bryan & Vyas)
This lecture will give a high-level overview of the course, including topics covered, learning goals, and course mechanics. We will also discuss ethical challenges associated with computer security. Reading: -
Security Principles: Threat Models and Trusted Computing Bases
(Instructor: Bryan)
This lecture will present techniques to reason systematically about an attacker's capabilities and a system's security dependencies. Reading: -
: No Recitation
-
: No Class
University holiday: Labor day. Enjoy the day off! -
Security Principles: Designing Secure Systems
(Instructor: Vyas)
This lecture will focus on principles of secure system design, and the three “AU”’s: authentication, authorization, and audit. Reading: -
: No Recitation
-
Software Security: Execution Semantics and Buffer Overflows
(Instructor: Vyas)
This lecture will review the material up through Chapter 3 of CS:APP from 15-213. We will cover the parts of the compilation tool chain and operations at the assembly level, including control flow, the memory model, and stack frames. We will also present control-flow-hijacking attacks that gain control of the instruction pointer, with a focus on buffer overflows. Reading: -
Software Security: Control-Flow Attacks and Defenses
(Instructor: Vyas)
In this lecture we will present additional control-flow-hijacking attacks that gain control of the instruction pointer, e.g., format-string exploits, and integer overflows. We will then introduce control flow hijack defenses found in practice today, including canaries, DEP, and randomization (ASLR). We will also discuss methods for bypassing these defenses. Reading: Optional Reading: -
Software Security: Recitation: More Execution Semantics & Thinking Up Exploits - Part 1
(Instructor: Parno)
-
Software Security: Return Oriented Programming and Control-Flow Integrity
(Instructor: Vyas)
This lecture will review Return Oriented Programming attacks and Control-Flow Integrity defenses. Control Flow Integrity (CFI) is a security property that specifies real executions should follow the static CFG. We will explore CFI, focusing on what "the" CFG is. Reading: Optional Reading: -
Software Security: Achieving Memory Safety
(Instructor: Bryan)
This lecture will cover techniques to analyze code for memory vulnerabilities, retrofit memory safety on legacy code, and go beyond memory safety to verify strong properties about software. Reading: Optional Reading: -
Software Security: Recitation: Thinking Up Exploits - Part 2
(Instructor: Parno)
-
Systems Security: Isolation
(Instructor: Parno)
This lecture will cover various system mechanisms for achieving isolation: Sandboxing, Software Fault Isolation (SFI), program partitioning, and airgaps. Reading: Optional Reading: -
Systems Security: Modern OS Security and Authorization Logic
(Instructor: Bryan)
This lecture will focus on modern OS security, covering topics such as access control and capabilities, as well as a logical framework for reasoning about authorization. Reading: -
Software Security: Recitation: Provably Correct Software
(Instructor: Bryan)
-
Systems Security: Trusted Computing
(Instructor: Bryan)
This lecture will cover techniques for bootstrapping trust in systems. Reading: -
Review: Software & Systems Security
(Instructor: Vyas)
This class will be a review period. We will provide approximately a 30 minute review, and then will open up the class for questions. Please think ahead of class what would be good questions; we are happy to answer anything. If there are no questions, it will be a short class. -
Review: Recitation: HW1 Solutions Walkthrough and Q&A
(Instructor: TAs)
-
Exam: Software & Systems Security
We will have the first exam of the course. It will cover all information covered to date. This will be a closed book, closed notes, closed neighbor exam. -
Crypto: Introduction to Cryptography
(Instructor: Bryan)
In this lecture we will provide a high-level introduction to cryptography, including an overview of primitives and security models. We will touch on the rich power offered by modern cryptographic tools. Finally, we will discuss (in)secure sources of randomness, cover the principles of pseudorandom functions, permutations, and introduce the notion of adversarial games to prove security properties of cryptographic constructions. Note that the reading below covers topics from the entire Crypto unit, so feel free to do the relevant portions of the reading as we go along. Reading: Optional Reading: -
Crypto: Recitation: Proof by Reduction
(Instructor: Bryan)
We will review game-based definitions of security and practice determining whether a scheme is secure, either by demonstrating an adversary with non-trivial advantage or by proving that no such adversaries exist. -
Crypto: Secrecy and Symmetric Key Ciphers
(Instructor: Bryan)
We will cover the principle of secrecy (sometimes called privacy), stream ciphers, block ciphers, and block cipher modes. -
Crypto: Integrity, Hashes, and MACS
(Instructor: Bryan)
This lecture will look at the property of integrity, and the crypto primitives hashes and macs. We will also cover basics of authenticated encryption, which is a commonly used operation. -
: No Recitation
Mid-semester Break -- No recitation -
Crypto: Public Key Cryptography
(Instructor: Bryan)
In this lecture we will cover the fundamentals of public key cryptography, focusing on RSA and Diffie-Hellman as examples. Reading: -
Network Security: Introduction to Network Security
(Instructor: Vyas)
This lecture will give a broad overview of network security, including general principles, denial-of-service attacks, and intrusion detection (and prevention) systems. The latter will cover some basic detection theory, focusing on the base rate fallacy. Reading: Optional Reading: -
: No Recitation
President's Inauguration -- No recitation -
Review: Crypto
(Instructor: Bryan)
This will be a review session for all lectures on cryptography. Please think ahead of time what questions you may have. -
Exam: Crypto
We will have the second exam of the course. It will cover all information covered to date. This will be a closed book, closed note, closed neighbor exam. -
: No recitation
-
Network Security: Protocol Design and Analysis
(Instructor: Bryan)
This lecture will cover design principles for secure protocols, common failures and defenses, and tools for analyzing protocol security. TLS will be used as a detailed case study. Reading: Optional Reading: -
Web Security: Attacks
(Instructor: Vyas)
This lecture will cover web security, including vulnerabilities such as injection attacks, XSS, and CSRF. Optional Reading: -
Web Security: Recitation: Web Hacking
(Instructor: Vyas)
-
Web Security: Defenses
(Instructor: Vyas)
This lecture will cover web security with a focus on principles, such as authentication vs. authorization, and best practices for establishing security on the web. Optional Reading: -
Human Factors: Making Security Usable
(Instructor: Bryan)
The most secure system in the world can be subverted if users can't employ it correctly (or if they themselves are subverted!). This lecture will cover usable design, with case studies drawn from security warnings, authentication, and phishing. We will also cover attacks and defenses based on social engineering. Reading: Optional Reading: -
Web Security: Recitation: Extra Office Hour for HW 3
(Instructor: TAs)
-
Human Factors: Law and Public Policy
(Instructor: Vyas)
This lecture will cover legal frameworks and policies that govern security and privacy in practice. Reading: -
: Thanksgiving
Thanksgiving! Enjoy the break! -
: Recitation: Thanksgiving
Thanksgiving! Enjoy the break! -
Human Factors: Privacy
(Instructor: Bryan)
This lecture will cover various mathematical definitions of privacy as well as practical tools used to provide privacy today. Reading: Optional Reading: -
Human Factors: Economics
(Instructor: Bryan)
Many attackers are economically rational. Can we leverage this observation when designing our defenses? Many users are economically rational. What impact does that have on how we design our defenses? Reading: Optional Reading: -
Research: Recitation: State-of-the-Art Security Research
(Instructor: Bryan and Vyas)
-
Review: Network, Web, and Human Factors
(Instructor: Vyas)
We will have about a 30 minute review of all material in the third part of this class. The rest of the time will be devoted to questions and answers, so make sure you bring good questions. -
Exam: Network, Web, and Human Factors
This will be our third and final exam. Like previous exams it will be closed book, closed note, closed neighbor. The exam will focus on the last third of the course, but any material over the entire semester is game.