Difference between revisions of "MSc: Security of systems and networks"

From IU
Jump to navigation Jump to search
Line 121: Line 121:
 
! Section !! Section Title !! Teaching Hours
  
! Section !! Section Title !! Teaching Hours
 
|-
  
|-
−
| 1 || Classical and modern cryptography || 8
 +
| 1 || Cryptography || 40%
 
|-
  
|-
−
| 2 || Authentication and Kerberos || 8
 +
| 2 || Access Control || 25%
 
|-
  
|-
−
| 3 || SSL, TLS, and IPSec || 10
 +
| 3 || Protocols || 25%
 
|-
  
|-
  +
| 4 || Security Vulnerabilities of Software || 10
−
| 4 || Covert channels and pattern matching-based network security (IDS/IPS) || 6
  
 
|-
  
|-
−
| 5 || Quantum cryptography || 2
 +
| 5 || Labs|| 56h
−
|-
  
−
| 6 || Labs|| 56
  
 
|}
  
|}
   
 
=== Section 1 title: ===
  
=== Section 1 title: ===
   
  +
Cryptography
−
Classical and modern cryptography
  
   
 
=== Topics covered in this section: ===
  
=== Topics covered in this section: ===
   
 
 
  +
* Basics of Crypto
−
* Enigma
  
  +
* Symmetric Key Crypto
−
* Different substitution and transposition ciphers
  
  +
* Public Key Crypto
−
* Stream and block ciphers
  
  +
* Hash Functions
−
* Data Encryption Standard (DES)
  
−
* Advanced Encryption Standard (AES)
  
−
* Diffie-Hellman key exchange
  
−
* Crypto math
  
−
* RSA
  
−
* Elliptic curve cryptography
  
   
 
=== What forms of evaluation were used to test students’ performance in this section? ===
  
=== What forms of evaluation were used to test students’ performance in this section? ===
Line 202: Line 195:
 
=== Section 2 title: ===
  
=== Section 2 title: ===
   
  +
Access Control
⚫
Authentication
  
   
 
=== Topics covered in this section: ===
  
=== Topics covered in this section: ===
   
  ⚫
* Authentication
−
* Kerberos
  
  +
* Authorization
−
* Passwords
  
−
* Biometrics
  
−
* Authentication and key agreement protocols
  
−
* Rainbow tables
  
−
* Protocol development
  
   
 
=== What forms of evaluation were used to test students’ performance in this section? ===
  
=== What forms of evaluation were used to test students’ performance in this section? ===
Line 259: Line 248:
 
=== Section 3 title: ===
  
=== Section 3 title: ===
   
  +
Protocols
−
SSL, TLS, and IPSec
  
   
 
=== Topics covered in this section: ===
  
=== Topics covered in this section: ===
   
  +
* Simple Authentication Protocols
−
* SSL, TLS
  
  +
* Real-World Security Protocols
−
* IPSec
  
   
 
=== What forms of evaluation were used to test students’ performance in this section? ===
  
=== What forms of evaluation were used to test students’ performance in this section? ===
Line 310: Line 299:
 
=== Section 4 title: ===
  
=== Section 4 title: ===
   
  +
Software
−
Covert channels and pattern-matching based networks security
  
   
 
=== Topics covered in this section: ===
  
=== Topics covered in this section: ===
   
  +
* Software Flaws and Malware
−
* Secure UEFI booting
  
  +
* Insecurity in Software
−
* Pattern matching-based network security with focus on IDS and IPS
  
  +
* Operating Systems and Security
−
* Covering different existing tools such as Yara, Snort, Suricata, and Bro for rules definition and deployment
  
−
* Covert channels and their role in different layers
  
−
* Existing techniques in implementing covert channels
  
   
 
=== What forms of evaluation were used to test students’ performance in this section? ===
  
=== What forms of evaluation were used to test students’ performance in this section? ===

Revision as of 13:19, 22 July 2022

Security of systems and networks

  • Course name: Security of systems and networks (SSN)
  • Course number: SNE-08


Course characteristics

Key concepts of the class

  • Network security
  • Applied cryptography
  • Security protocols
  • Internet security

What is the purpose of this course?

This course will cover the fundamentals of security, security protocols, and their applications in real-world. The topics covered in this course include applied cryptography, authentication, passwords, practical security, social aspects of security, SSL/TLS, email security, PKI, and IPSec. Furthermore, this course will strengthen the security knowledge of the students and guide them in the right direction for their upcoming research projects and advanced courses. The course is divided into two parts. The first part will cover the theory and handson practice of the concepts taught at class. And the second part of the course will focus on the course projects. The student will work on a security project by using the concepts taught in the class.


Prerequisites

  • No specific prerequisites are mandated.

Recommendations for students on how to succeed in the course

References:

  • Read the book
  • Follows the lectures

Course Objectives Based on Bloom’s Taxonomy

What should a student remember at the end of the course?

By the end of the course, the students should be able to:

  • Identify different Internet applications and understand their working principles from the protocols point of view
  • Demonstrate the acquired knowledge and skills in classical internet applications including DNS, Email, and Directory services.
  • Able to write regular expressions and context-free grammar that are essential in Internet applications and information exchange through the networks
  • Able to partition disks and remember the booting principles as well as secure booting

What should a student be able to understand at the end of the course?

By the end of the course, the students should be able to:

  • Demonstrate the acquired knowledge and skills in applied cryptography (symmetric and asymmetric cryptography),
  • Operate classical enigma machine, encode and decode messages with it
  • Demonstrate the working knowledge of famous cryptographic algorithms and discuss their shortcomings
  • Demonstrate and operate the already implemented security protocols over internet,
  • Reason about the problems in the security of networked systems and current internet and their existing solutions,
  • Solve mathematical problems (especially in number theory),
  • And Demonstrate the knowledge and discuss basic quantum cryptography concepts.

What should a student be able to apply at the end of the course?

By the end of the course, the students should be able to apply:

  • Crypt-analyze ciphertext and decrypt through frequency analysis and other important techniques
  • Design security protocols
  • Find security flaws in security protocols
  • Get hands-on experience of the existing enterprise cryptographic algorithms and use them in projects,
  • Demonstrate the skill of finding out security issues in networked systems and internet technologies,

Course evaluation

The acquired knowledge will be evaluated via labs, a project, and the exam, with points as in the following table:

Type of Evaluation Points
Labs/seminar classes 35
Project 35
Exam 30



Grades range

The grades will be given according to the following table:

Grade Range of points
A. Excellent 90-100
B. Good 75-89
C. Satisfactory 60-74
D. Poor 0-59

Resources and reference material

  • Lecture slides
  • Book
  • Links to the online material will be provided (if any)

Course Sections

The main sections of the course and approximate hour distribution between them is as follows:

Section Section Title Teaching Hours
1 Cryptography 40%
2 Access Control 25%
3 Protocols 25%
4 Security Vulnerabilities of Software 10
5 Labs 56h

Section 1 title:

Cryptography

Topics covered in this section:

  • Basics of Crypto
  • Symmetric Key Crypto
  • Public Key Crypto
  • Hash Functions

What forms of evaluation were used to test students’ performance in this section?

Form Yes/No
Development of individual parts of software product code No
Homework and group projects Yes
Midterm evaluation No
Testing (written or computer based) Yes
Reports Yes
Essays No
Oral polls No
Discussions Yes


Typical questions for ongoing performance evaluation within this section

  1. How do different protocols work?
  2. What are the differences in stream and block ciphers from performance

standpoint?

  1. How to measure the security of cryptographic algorithms?
  2. How to encrypt and decrypt with different asymmetric crypto algorithms?
  3. How to embedd backdoors in crypto algorithms?
  5. How to realize key exchange through diffie-hellman using traditional techniques and elliptic curve techniques?
  6. How to make security algorithms efficient?

Typical questions for seminar classes (labs) within this section

  1. Make enigma machine with pringle box
  2. Assess the security of different setups of RSA
  3. Implement man in the middle attack
  4. Implement addition over elliptic curves
  5. Solve crypto math problems

Test questions for final assessment in this section

  1. Same as above

Section 2 title:

Access Control

Topics covered in this section:

  • Authentication
  • Authorization

What forms of evaluation were used to test students’ performance in this section?

Form Yes/No
Development of individual parts of software product code No
Homework and group projects Yes
Midterm evaluation No
Testing (written or computer based) Yes
Reports Yes
Essays No
Oral polls No
Discussions Yes


Typical questions for ongoing performance evaluation within this section

  1. What are pros and cons of using symmetric and asymmetric cryptographic

mechanisms for authentication?

  1. What is man in the middle attack?
  2. Develop home-grown authentication mechanisms?
  3. How Kerberos reduces the communication overhead?
  4. Where is shibboleth used?

Typical questions for seminar classes (labs) within this section

  1. Implement different variants of authentication protocols
  2. Find out security flaws in authentication protocols
  3. Identify shortcomings of different protocols

Test questions for final assessment in this section

  1. Same as above

Section 3 title:

Protocols

Topics covered in this section:

  • Simple Authentication Protocols
  • Real-World Security Protocols

What forms of evaluation were used to test students’ performance in this section?

Form Yes/No
Development of individual parts of software product code No
Homework and group projects Yes
Midterm evaluation No
Testing (written or computer based) Yes
Reports Yes
Essays No
Oral polls No
Discussions Yes


Typical questions for ongoing performance evaluation within this section

  1. How does SSL and TLS work?
  2. HOw does SSL and TLS combine symmetric and asymmetric cryptography?
  3. Why IPSec is so over-engineered? and what are the security flaws?
  4. What are different components of IPSec

Typical questions for seminar classes (labs) within this section

  1. Implement IPSec
  2. Assess the security of SSL and TLS handshakes

Test questions for final assessment in this section

  1. Same as above

Section 4 title:

Software

Topics covered in this section:

  • Software Flaws and Malware
  • Insecurity in Software
  • Operating Systems and Security

What forms of evaluation were used to test students’ performance in this section?

Form Yes/No
Development of individual parts of software product code No
Homework and group projects Yes
Midterm evaluation No
Testing (written or computer based) Yes
Reports Yes
Essays No
Oral polls No
Discussions Yes

Typical questions for ongoing performance evaluation within this section

  1. How does IDS and IPS work in a network setup, which configuration is used and which layers do they work?
  2. How does the rule set work in different tools such as Suricata, Snort, Bro, and Yara?
  3. How to create a covert channel and different layers of network protocol

stack?

  1. Which layer is ideal for creating a covert channel?
  2. What are the current state of the art regarding covert channel in different layers?

Typical questions for seminar classes (labs) within this section

  1. TO BE ADDED

Test questions for final assessment in this section

  1. As above
Retrieved from "https://eduwiki.innopolis.university/index.php?title=MSc:_Security_of_systems_and_networks&oldid=7329"