Difference between revisions of "BSc: Fundamentals of Computer Security"

From IU
Jump to navigation Jump to search
(Created page with "= Fundamentals of Computer Security = * <span>'''Course name:'''</span> Fundamentals of Computer Security * <span>'''Course number:'''</span> XYZ * <span>'''Knowledge area:''...")
 
 
(21 intermediate revisions by 3 users not shown)
Line 1: Line 1:
−
= Fundamentals of Computer Security =
  
   
−
* <span>'''Course name:'''</span> Fundamentals of Computer Security
 +
= Fundamentals of Information Security =
−
* <span>'''Course number:'''</span> XYZ
 +
* '''Course name''': Fundamentals of Information Security
−
* <span>'''Knowledge area:'''</span> xxx
 +
* '''Code discipline''': XYZ
  +
* '''Subject area''': xxx
   
−
== Course characteristics ==
 +
== Short Description ==
  +
This course covers the following concepts: User authentication and authorization; Database and data center security; Reverse engineering and malicious software; Buffer overflow and software security; OS security; Symmetric encryption; Public-key cryptography.
   
  +
== Prerequisites ==
−
=== Key concepts of the class ===
  
   
  +
=== Prerequisite subjects ===
−
*
 
   
−
=== What is the purpose of this course? ===
  
   
  +
=== Prerequisite topics ===
   
−
=== Course Objectives Based on Bloom’s Taxonomy ===
  
   
  +
== Course Topics ==
−
==== What should a student remember at the end of the course? ====
  
  +
{| class="wikitable"
  +
|+ Course Sections and Topics
  +
|-
  +
! Section !! Topics within the section
  +
|-
  +
| Computer security technology and principles ||
  +
# Introduction to computer security
  +
# User authentication and authorization
  +
# Database and data center security
  +
# Network security of data center
  +
# Reverse engineering and malicious software
  +
|-
  +
| Software and system security ||
  +
# Buffer overflow and software security
  +
# OS security
  +
# Guest lecture from industry
  +
|-
  +
| Cryptographic algorithms ||
  +
# Symmetric encryption and message confidentiality
  +
# Public key cryptography and message authentication
  +
|-
  +
| Additional ||
  +
# Compliances and documentation in computer security
  +
# New technologies and research areas in cyber security
  +
# Cybercrime and forensics, incident response
  +
|}
  +
== Intended Learning Outcomes (ILOs) ==
   
  +
=== What is the main purpose of this course? ===
−
By the end of the course, the students should be able to recognize and define
  
  +
The purpose of this course is to teach the students the important aspects of cryptography, authentication, access control, DoS attacks, intrusion detection, etc. The students will learn major types of attacks and methods of protection from them.
   
  +
=== ILOs defined at three levels ===
−
*
 
   
−
==== What should a student be able to understand at the end of the course? ====
 +
==== Level 1: What concepts should a student know/remember/explain? ====
  +
By the end of the course, the students should be able to ...
  +
* Message and user authentication
  +
* Encryption algorithms
  +
* Authorization and access control mechanisms
  +
* Different types of attacks
  +
* Firewalls and intrusion detection methods
   
−
By the end of the course, the students should be able to describe and explain (with examples)
 +
==== Level 2: What basic practical skills should a student be able to perform? ====
  +
By the end of the course, the students should be able to ...
  +
* The importance of authentication and authentication protocols
  +
* Encryption algorithms used for authentication and message integrity
  +
* The importance of authorization and access control, different protocols
  +
* Major types of attacks and methods of protection from them
  +
* Importance of intrusion detection and firewalls
   
  +
==== Level 3: What complex comprehensive skills should a student be able to apply in real-life scenarios? ====
−
*
 
  +
By the end of the course, the students should be able to ...
  +
* Authentication protocols
  +
* Encryption techniques and algorithms
  +
* Well-known access control techniques
  +
* Mitigate the DoS attacks
  +
* Intrusion detection algorithms
  +
* Using firewalls
  +
== Grading ==
   
  +
=== Course grading range ===
−
==== What should a student be able to apply at the end of the course? ====
  
  +
{| class="wikitable"
−  
  +
|+
−
By the end of the course, the students should be able to apply
  
  +
|-
−  
  +
! Grade !! Range !! Description of performance
−
*
 
−  
−
=== Course evaluation ===
  
−  
−
<div id="tab:OSCourseGradingRange">
  
−  
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
−
|+ Course grade breakdown
  
−
!align="center"| '''Component'''
  
−
! '''Points'''
  
 
|-
  
|-
  +
| A. Excellent || 90-100 || -
−
| Laboratory assignments
  
−
|align="right"| 55%
  
 
|-
  
|-
  +
| B. Good || 75-89 || -
−
| Final exam
  
−
|align="right"| 35%
  
 
|-
  
|-
  +
| C. Satisfactory || 60-74 || -
−
| Attendance
  
  +
|-
−
|align="right"| 10%
  
  +
| D. Poor || 0-59 || -
 
|}
  
|}
−
'''Important:''' In order to successfully finish the course, the student is required to score at least 50% in final exam.
  
   
  +
=== Course activities and grading breakdown ===
−
=== Grades range ===
  
  +
{| class="wikitable"
−  
  +
|+
−
<div id="tab:OSCourseGradingRange">
  
  +
|-
−  
  +
! Activity Type !! Percentage of the overall course grade
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
−
|+ Course grading range
  
 
|-
  
|-
  +
| Laboratory assignments || 50%
−
| A. Excellent
  
−
|align="right"| 90-100
  
 
|-
  
|-
  +
| Weekly quizzes || 14%
−
| B. Good
  
−
|align="right"| 75-89
  
 
|-
  
|-
  +
| Attendance || 6%
−
| C. Satisfactory
  
−
|align="right"| 60-74
  
 
|-
  
|-
  +
| Final exam || 30%
−
| D. Poor
  
−
|align="right"| 0-59
  
 
|}
  
|}
   
  +
=== Recommendations for students on how to succeed in the course ===
−
=== Resources and reference material ===
  
   
−
* '''Textbook:'''
 
   
  +
== Resources, literature and reference materials ==
−
== Course Sections ==
  
   
  +
=== Open access resources ===
−
The course is organized in 8 weeks, with every weeks 4 academics hours of lectures and 4 academic hours of tutorials/labs. The main sections of the course and approximate hour distribution between them is as follows:
  
  +
* Required textbook: William Stallings and Lawrie Brown, "Computer Security: Principles and Practice,“ 4th edition, Pearson, 2017.
  +
* Additional textbook: William Stallings, "Cryptography and Network Security: Principles and Practice," 7th Edition, Pearson, 2017.
   
  +
=== Closed access resources ===
−
<div id="tab:OSCourseSections">
  
   
  +
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
  +
=== Software and tools used within the course ===
−
|+ Course Sections
  
  +
−
!align="center"| '''Section'''
  
  +
= Teaching Methodology: Methods, techniques, & activities =
−
! '''Section Title'''
  
  +
−
!align="center"| '''Teaching Hours'''
  
  +
== Activities and Teaching Methods ==
  +
{| class="wikitable"
  +
|+ Activities within each section
 
|-
  
|-
  +
! Learning Activities !! Section 1 !! Section 2 !! Section 3 !! Section 4
−
|align="center"| 1
  
−
| Computer security technology and principles
  
−
|align="center"| 12
  
 
|-
  
|-
  +
| Development of individual parts of software product code || 1 || 1 || 1 || 1
−
|align="center"| 2
  
−
| Software and system security
 
−
|align="center"| 24
  
 
|-
  
|-
  +
| Homework and group projects || 1 || 1 || 1 || 1
−
|align="center"| 3
  
  +
|-
−
| Cryptographic algorithms
  
  +
| Testing (written or computer based) || 1 || 1 || 1 || 1
−
|align="center"| 24
  
−
|}
 +
|-
  +
| Oral polls || 1 || 1 || 1 || 1
−  
  +
|-
−
</div>
  
  +
| Discussions || 1 || 1 || 1 || 1
−
=== Section 1: Introduction to subject, computer networks basics, transport layer protocols, and socket programming ===
  
  +
|}
−  
  +
== Formative Assessment and Course Activities ==
−
==== Topics covered in this section ====
 
−  
−
* General introduction to the course
  
−
* Computer networks basic
  
−
* Socket programming
 
−
* UDP socket programming
  
−
* TCP socket programming
  
−  
−
==== What forms of evaluation were used to test students’ performance in this section? ====
 
   
  +
=== Ongoing performance assessment ===
−
<div id="tab:OSSectionEval1">
  
   
  +
==== Section 1 ====
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
  +
{| class="wikitable"
−
|''' '''
  
  +
|+
−
! '''Yes/No'''
  
 
|-
  
|-
  +
! Activity Type !! Content !! Is Graded?
−
| Development of individual parts of software product code
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || What is meant by the CIA triad? || 1
−
| Homework and group projects
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || What is the difference between data integrity and system integrity? || 1
−
| Midterm evaluation
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || How is cryptanalysis different from brute-force attack? || 1
−
| Testing (written or computer based)
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || List and briefly explain the different approaches to attacking a symmetric encryption scheme. || 1
−
| Reports
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || In general terms, what are four means of authenticating a user’s identity? || 1
−
| Essays
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || What is a Trojan horse attack? || 1
−
| Oral polls
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || What is the difference between authentication and authorization? || 1
−
| Discussions
  
−
|align="center"| 1
  
−
|}
  
−  
−  
−
</div>
  
−
==== Typical questions for ongoing performance evaluation within this section ====
 
−  
−
# What are the distributed systems?
 
−
# Give an example of distributed systems.
  
−
# What are the advantages of layered architecture?
  
−
# What are the roles of transport protocols?
  
−
# How the TCP and UDP differ from each other? When one is preferred over the other?
  
−
# What is socket programming?
  
−
# How socket programming is different for UDP and TCP?
  
−
 
−
==== Typical questions for seminar classes (labs) within this section ====
 
−  
−
# Write a simple UDP/TCP client-server echo program
  
−
# Write a simple chatting program using UDP/TCP sockets
  
−
# Given the simple echo server program, apply socket timeouts and catch timeout exceptions
  
−
# Write a UDP-based reliable file transfer protocol
  
−
# Write a program that parallelly executes the CPU-bound tasks using multiple processes
  
−  
−
==== Test questions for final assessment in this section ====
 
−  
−
# Describe an advantage of layered architecture?
  
−
# Describe the differences between TCP and UDP protocols?
  
−
# Provide examples when using UDP can be more reasonable than TCP?
  
−
# Describe how UDP and TCP socket programming differ from each other?
  
−  
−
=== Section 2: Multithreaded socket programming, RPCs, and distributed system architecture ===
  
−  
−
==== Topics covered in this section ====
 
−  
−
* Multithreading and multithreaded socket programming
  
−
* Remote procedure calls (RPCs)
  
−
* Distributed system architectures
  
−  
−
==== What forms of evaluation were used to test students’ performance in this section? ====
 
−  
−
<div id="tab:OSSectionEval1">
  
−  
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
−
|''' '''
  
−
! '''Yes/No'''
  
 
|-
  
|-
  +
| Question || How does RBAC relate to DAC and MAC? || 1
−
| Development of individual parts of software product code
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || Define the terms database, database management system, and query language. || 1
−
| Homework and group projects
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || What is a relational database and what are its principal ingredients? || 1
−
| Midterm evaluation
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || What is an SQL injection attack? What are the implications of an SQL injection attack? || 1
−
| Testing (written or computer based)
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || List the categories for grouping different types of SQLi attacks. || 1
−
| Reports
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || Why is RBAC considered fit for database access control? || 1
−
| Essays
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || What are three broad mechanisms that malware can use to propagate? || 1
−
| Oral polls
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || What is a blended attack? || 1
−
| Discussions
  
−
|align="center"| 1
  
−
|}
  
−  
−  
−
</div>
  
−
==== Typical questions for ongoing performance evaluation within this section ====
 
−  
−
# How the threads differ from processes?
 
−
# What are the I/O and CPU-bound tasks?
  
−
# For what kind of tasks, using threads is preferred than using processes?
  
−
# What is a remote procedure call?
  
−
# What are some well-known distributed system architectures?
  
−
# Discuss the structured and unstructured decentralized architectures.
  
−
 
−
==== Typical questions for seminar classes (labs) within this section ====
 
−  
−
# You have a list of large numbers, and you need to find if they are prime or not. Would you use multithreading, multiprocessing, or sequential programming in order to complete the task asap? Prove it in practice.
  
−
# You need to send multiple requests to a server and receive responses. Assume there is a few msecs of delay before you receive the response from the server. Would you use multithreading, multiprocessing, or sequential programming in order to complete the task asap? Prove it in practice. (Order of the requests/responses doesn't matter)
  
−
# Discuss two ways of creating the threads using threading module in Python: 1) passing the worker function as a target, 2) subclassing the Thread class
  
−
# Given the function implemented locally, make it available to be called through RPC from remote process? Use xmlRPC.
  
−  
−
==== Test questions for final assessment in this section ====
 
−  
−
# Discuss the differences between the threads and processes.
  
−
# What is the Race condition?
  
−
# Discuss the ways to protect the shared data from the race condition
  
−
# You're given the worker function that just sleeps for a second and quits, implement the same behavior in a subclass of the Thread.
  
−
# Discuss the RPC and its advantages over using the low-level socket programming?
  
−
# Discuss the decentralized architecture: structured and unstructured p2p systems.
  
−  
−
=== Section 3: Coordination, consistency, and replication in distributed systems ===
  
−  
−
==== Topics covered in this section ====
 
−  
−
* Clock synchronization algorithms (NTP, Berkeley)
  
−
* Logical clock (Lamport clocks)
  
−
* Mutual exclusion algorithms: permission-based, token-based
  
−
* Election algorithms: Bully, Ring
  
−
* Consistency models
  
−
* Replica management
  
−
* Consistency protocols
  
−  
−
==== What forms of evaluation were used to test students’ performance in this section? ====
 
−  
−
<div id="tab:OSSectionEval1">
  
−  
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
−
|''' '''
  
−
! '''Yes/No'''
  
 
|-
  
|-
  +
| Question || Define a denial-of-service (DoS) attack || 1
−
| Development of individual parts of software product code
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || State the difference between a SYN flooding attack and a SYN spoofing attack. || 1
−
| Homework and group projects
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || What is the goal of an HTTP flood attack? || 1
−
| Midterm evaluation
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || What is a poison packet attack? Give two examples of such an attack. || 1
−
| Testing (written or computer based)
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || How are intruders classified according to skill level? || 1
−
| Reports
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || List and briefly describe the classifications of intrusion detection systems based on the source and the type of data analyzed. || 1
−
| Essays
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || Consider the given general code for allowing access to a resource: a) Explain the security flaw in this program, b) Rewrite the code to avoid the flaw || 0
−
| Oral polls
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || Develop an attack tree for gaining access to the contents of a physical safe || 0
−
| Discussions
  
−
|align="center"| 1
  
−
|}
  
−  
−  
−
</div>
  
−
==== Typical questions for ongoing performance evaluation within this section ====
 
−  
−
# How NTP protocol works?
 
−
# How Berkeley protocol works?
  
−
# Discuss the mutual exclusion algorithms.
  
−
# Discuss the permanent and server-initiated replicas and their difference
  
−
# Explain the Primary-backup protocol.
  
−
 
−
==== Typical questions for seminar classes (labs) within this section ====
 
−  
−
# Given three machines with drifting clocks, adjust their clocks using Berkeley algorithm.
  
−
# Explain how Bully algorithm for election works
  
−
# Explain how Ring algorithm for election works
 
−
# Explain the centralized (permission-based) method of mutual exclusion
  
−  
−
==== Test questions for final assessment in this section ====
 
−  
−
# Discuss NTP and Berkeley protocols for synchronization and explain their key difference
  
−
# Discuss permission-based and token-based solution for mutual exclusion.
  
−
# Discuss content replication: permanent, server-initiated, and client-initiated replicas.
  
−
# Explain the Primary-backup protocol, its advantages and disadvantages.
  
−  
−
=== Section 4: Fault tolerance and security in distributed systems ===
  
−  
−
==== Topics covered in this section ====
 
−  
−
* Intro to fault tolerance: Failure models, Failure masking by redundancy
  
−
* Process resilience: process groups, process replication, consensus in faulty systems, failure detection
  
−
* Reliable group communication: atomic multicast,
 
−
* Distributed commit
  
−
* Recovery: checkpointing
  
−
* Intro to security: threats, design issues, cryptography
  
−
* Secure channels: authentication, message integrity and confidentiality, secure group communication
  
−
* Access control: general issues, firewalls, secure mobile code, denial of service
  
−
* Secure naming
  
−
* Security management: Key management, secure group management, authorization management
  
−  
−
==== What forms of evaluation were used to test students’ performance in this section? ====
 
−  
−
<div id="tab:OSSectionEval1">
  
−  
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
−
|''' '''
  
−
! '''Yes/No'''
  
 
|-
  
|-
  +
| Question || Typically, in practice, the length of the message is greater than the block size of the encryption algorithm. The simplest approach to handle such encryption is known as electronic codebook (ECB) mode. Explain this mode. Mention a scenario where it cannot be applied. Explain briefly why it is not a secure mode of encryption || 0
−
| Development of individual parts of software product code
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || Consider a very simple symmetric block encryption algorithm, in which 64-bits blocks of plaintext are encrypted using a 128-bit key. Show the decryption equation. || 0
−
| Homework and group projects
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || Explain the suitability or unsuitability of the given passwords || 0
−
| Midterm evaluation
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || Assume that Personal Identification Numbers (PINs) are formed by nine-digit combinations of numbers 0 to 9. Assume that an adversary is able to attempt three PINs per second.<br>Assuming no feedback to the adversary until each attempt has been completed, what is the expected time to discover the correct PIN?<br>Assuming feedback to the adversary flagging an error as each incorrect digit is entered, what is the expected time to discover the correct PIN? || 0
−
| Testing (written or computer based)
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || Assume an application requires access control policies based on the applicant’s age and the type of funding to be provided. Using an ABAC approach, write policy rules for each of the following scenarios:<br>If the applicant’s age is more than 35, only “Research Grants (RG)” can be provided.<br>If the applicant’s age is less than or equal to 35, both “RG and Travel Grants (TG)” can be provided. || 0
−
| Reports
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || Assume a system with K subject attributes, M object attributes and Range () denotes the range of possible values that each attribute can take. What are the number of roles and permissions required for an RBAC model? What is the problem with this approach if additional attributes are added? || 0
−
| Essays
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || Consider a simplified database for an organization that includes information of several departments (identity, name, manager, number of employees) and of managers and employees of the respective departments. Suggest a relational database for efficiently managing this information || 0
−
| Oral polls
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || Users hulkhogan and undertaker do not have the SELECT access right to the Inventory table and the Item table. These tables were created by and are owned by user bruno-s. Write the SQL commands that would enable bruno-s to grant SELECT access to these tables to hulkhogan and undertaker. || 0
−
| Discussions
  
  +
|-
−
|align="center"| 1
  
  +
| Question || Consider the given fragment of code. What type of malware is this? || 0
−
|}
  
  +
|-
  +
| Question || Consider the given fragment embedded in a webpage. What type of malicious software is this? || 0
  +
|-
  +
| Question || In order to implement a classic DoS flood attack, the attacker must generate a sufficiently large volume of packets to exceed the capacity of the link to the target organization. Consider an attack using ICMP echo request (ping) packets that are 100 bytes in size (ignoring framing overhead). How many of these packets per second must the attacker send to flood a target organization using a 8-Mbps link? How many per second if the packets are 1000 bytes in size? Or 1460 bytes? || 0
  +
|-
  +
| Question || It is discussed that an amplification attack, which is a variant of reflection attack, can be launched by using any type of a suitable UDP service, such as the echo service. However, TCP services cannot be used in this attack. Why? || 0
  +
|-
  +
| Question || Consider the first step of the common attack methodology we describe, which is to gather publicly available information on possible targets. What types of information could be used? What does this use suggest to you about the content and detail of such information? How does this correlate with the organization’s business and legal requirements? How do you reconcile these conflicting demands? || 0
  +
|-
  +
| Question || As was mentioned in this chapter, the application gateway does not permit an end-toend TCP connection; rather, it sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. The disadvantage of this approach is the additional processing overhead on each connection since the gateway must examine and forward all traffic in both directions. Describe at least one more limitation of this approach which is not discussed. || 0
  +
|-
  +
| Question || Given table shows a sample of a packet filter firewall ruleset for an imaginary network of IP address that range from 192.168.1.0 to 192.168.1.254. Describe the effect of each rule. || 0
  +
|}
  +
==== Section 2 ====
  +
{| class="wikitable"
  +
|+
  +
|-
  +
! Activity Type !! Content !! Is Graded?
  +
|-
  +
| Question || Define buffer overflow. || 1
  +
|-
  +
| Question || Define an off-by-one attack. || 1
  +
|-
  +
| Question || Define an injection attack. List some examples of injection attacks. What are the general circumstances in which injection attacks are found? || 1
  +
|-
  +
| Question || State the similarities and differences between command injection and SQL injection attacks || 1
  +
|-
  +
| Question || What are the basic steps needed in the process of securing a system? || 1
  +
|-
  +
| Question || State different types of full virtualization with their security requirements. || 1
  +
|-
  +
| Question || List five essential characteristics of cloud computing. || 1
  +
|-
  +
| Question || List and briefly define three cloud service models. || 1
  +
|-
  +
| Question || Briefly explain the most prominent deployment models for cloud computing. || 1
  +
|-
  +
| Question || Describe some of the main cloud-specific security threats. || 1
  +
|-
  +
| Question || Investigate each of the unsafe standard C library functions shown in the figure using the UNIX man pages or any C programming text, and determine a safer alternative to use. || 0
  +
|-
  +
| Question || Investigate the use of a replacement standard C string library, such as Libsafe, bstring, vstr, or other. Determine how significant the required code changes are, if any, to use the chosen library. || 0
  +
|-
  +
| Question || Investigate the issues that arise while using sequence number as both identifier and authenticator of packets. Identify the root cause of the problem. || 0
  +
|-
  +
| Question || Investigate the various types of cross-site scripting (XSS) attacks. How can such attacks be prevented? || 0
  +
|-
  +
| Question || How can we use the TCP Wrappers and tcpd daemon to achieve secure remote control access? What if the network servers are heavily loaded? || 0
  +
|-
  +
| Question || Why is it important to secure the boot process? Is it required to limit which media the system must boot from? || 0
  +
|}
  +
==== Section 3 ====
  +
{| class="wikitable"
  +
|+
  +
|-
  +
! Activity Type !! Content !! Is Graded?
  +
|-
  +
| Question || What are different types of cryptanalysis attacks? || 1
  +
|-
  +
| Question || Why do some block cipher modes of operation only use encryption while others use both encryption and decryption? || 1
  +
|-
  +
| Question || In the context of a hash function, what is a compression function? || 1
  +
|-
  +
| Question || Briefly explain Diffie-Hellman key exchange. || 1
  +
|-
  +
| Question || Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why? || 0
  +
|-
  +
| Question || Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption? || 0
  +
|-
  +
| Question || Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”<br>Will this checksum detect all errors caused by an odd number of error bits? Explain.<br>Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.<br>Comment on the effectiveness of this function for use as a hash function for authentication || 0
  +
|-
  +
| Question || It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible? || 0
  +
|}
  +
==== Section 4 ====
  +
{| class="wikitable"
  +
|+
  +
|-
  +
! Activity Type !! Content !! Is Graded?
  +
|-
  +
| Question || What are different types of cryptanalysis attacks? || 1
  +
|-
  +
| Question || Why do some block cipher modes of operation only use encryption while others use both encryption and decryption? || 1
  +
|-
  +
| Question || In the context of a hash function, what is a compression function? || 1
  +
|-
  +
| Question || Briefly explain Diffie-Hellman key exchange. || 1
  +
|-
  +
| Question || Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why? || 0
  +
|-
  +
| Question || Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption? || 0
  +
|-
  +
| Question || Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”<br>Will this checksum detect all errors caused by an odd number of error bits? Explain.<br>Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.<br>Comment on the effectiveness of this function for use as a hash function for authentication || 0
  +
|-
  +
| Question || It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible? || 0
  +
|}
  +
=== Final assessment ===
  +
'''Section 1'''
  +
# Questions from previous two subsections can be used.
  +
'''Section 2'''
  +
# Questions from previous two subsections can be used.
  +
'''Section 3'''
  +
# Questions from previous two subsections can be used.
  +
'''Section 4'''
  +
# Questions from previous two subsections can be used.
   
  +
=== The retake exam ===
  +
'''Section 1'''
   
  +
'''Section 2'''
−
</div>
  
−
==== Typical questions for ongoing performance evaluation within this section ====
 
−  
−
# Discuss the failure models
 
−
# Discuss different failure masking techniques by redundancy
 
−
# What is k-fault tolerant group?
  
−
# What is general model of failure detection?
  
−
# Explain basic reliable multicasting
  
−
# Explain what is authentication
  
−
# Explain what are message confidentiality and integrity
  
−
 
−
==== Typical questions for seminar classes (labs) within this section ====
 
−  
−
# Same as above
  
   
  +
'''Section 3'''
−
==== Test questions for final assessment in this section ====
 
   
  +
'''Section 4'''
−
# Same as above
  

Latest revision as of 12:48, 23 January 2023

Fundamentals of Information Security

  • Course name: Fundamentals of Information Security
  • Code discipline: XYZ
  • Subject area: xxx

Short Description

This course covers the following concepts: User authentication and authorization; Database and data center security; Reverse engineering and malicious software; Buffer overflow and software security; OS security; Symmetric encryption; Public-key cryptography.

Prerequisites

Prerequisite subjects

Prerequisite topics

Course Topics

Course Sections and Topics
Section Topics within the section
Computer security technology and principles
  1. Introduction to computer security
  2. User authentication and authorization
  3. Database and data center security
  4. Network security of data center
  5. Reverse engineering and malicious software
Software and system security
  1. Buffer overflow and software security
  2. OS security
  3. Guest lecture from industry
Cryptographic algorithms
  1. Symmetric encryption and message confidentiality
  2. Public key cryptography and message authentication
Additional
  1. Compliances and documentation in computer security
  2. New technologies and research areas in cyber security
  3. Cybercrime and forensics, incident response

Intended Learning Outcomes (ILOs)

What is the main purpose of this course?

The purpose of this course is to teach the students the important aspects of cryptography, authentication, access control, DoS attacks, intrusion detection, etc. The students will learn major types of attacks and methods of protection from them.

ILOs defined at three levels

Level 1: What concepts should a student know/remember/explain?

By the end of the course, the students should be able to ...

  • Message and user authentication
  • Encryption algorithms
  • Authorization and access control mechanisms
  • Different types of attacks
  • Firewalls and intrusion detection methods

Level 2: What basic practical skills should a student be able to perform?

By the end of the course, the students should be able to ...

  • The importance of authentication and authentication protocols
  • Encryption algorithms used for authentication and message integrity
  • The importance of authorization and access control, different protocols
  • Major types of attacks and methods of protection from them
  • Importance of intrusion detection and firewalls

Level 3: What complex comprehensive skills should a student be able to apply in real-life scenarios?

By the end of the course, the students should be able to ...

  • Authentication protocols
  • Encryption techniques and algorithms
  • Well-known access control techniques
  • Mitigate the DoS attacks
  • Intrusion detection algorithms
  • Using firewalls

Grading

Course grading range

Grade Range Description of performance
A. Excellent 90-100 -
B. Good 75-89 -
C. Satisfactory 60-74 -
D. Poor 0-59 -

Course activities and grading breakdown

Activity Type Percentage of the overall course grade
Laboratory assignments 50%
Weekly quizzes 14%
Attendance 6%
Final exam 30%

Recommendations for students on how to succeed in the course

Resources, literature and reference materials

Open access resources

  • Required textbook: William Stallings and Lawrie Brown, "Computer Security: Principles and Practice,“ 4th edition, Pearson, 2017.
  • Additional textbook: William Stallings, "Cryptography and Network Security: Principles and Practice," 7th Edition, Pearson, 2017.

Closed access resources

Software and tools used within the course

Teaching Methodology: Methods, techniques, & activities

Activities and Teaching Methods

Activities within each section
Learning Activities Section 1 Section 2 Section 3 Section 4
Development of individual parts of software product code 1 1 1 1
Homework and group projects 1 1 1 1
Testing (written or computer based) 1 1 1 1
Oral polls 1 1 1 1
Discussions 1 1 1 1

Formative Assessment and Course Activities

Ongoing performance assessment

Section 1

Activity Type Content Is Graded?
Question What is meant by the CIA triad? 1
Question What is the difference between data integrity and system integrity? 1
Question How is cryptanalysis different from brute-force attack? 1
Question List and briefly explain the different approaches to attacking a symmetric encryption scheme. 1
Question In general terms, what are four means of authenticating a user’s identity? 1
Question What is a Trojan horse attack? 1
Question What is the difference between authentication and authorization? 1
Question How does RBAC relate to DAC and MAC? 1
Question Define the terms database, database management system, and query language. 1
Question What is a relational database and what are its principal ingredients? 1
Question What is an SQL injection attack? What are the implications of an SQL injection attack? 1
Question List the categories for grouping different types of SQLi attacks. 1
Question Why is RBAC considered fit for database access control? 1
Question What are three broad mechanisms that malware can use to propagate? 1
Question What is a blended attack? 1
Question Define a denial-of-service (DoS) attack 1
Question State the difference between a SYN flooding attack and a SYN spoofing attack. 1
Question What is the goal of an HTTP flood attack? 1
Question What is a poison packet attack? Give two examples of such an attack. 1
Question How are intruders classified according to skill level? 1
Question List and briefly describe the classifications of intrusion detection systems based on the source and the type of data analyzed. 1
Question Consider the given general code for allowing access to a resource: a) Explain the security flaw in this program, b) Rewrite the code to avoid the flaw 0
Question Develop an attack tree for gaining access to the contents of a physical safe 0
Question Typically, in practice, the length of the message is greater than the block size of the encryption algorithm. The simplest approach to handle such encryption is known as electronic codebook (ECB) mode. Explain this mode. Mention a scenario where it cannot be applied. Explain briefly why it is not a secure mode of encryption 0
Question Consider a very simple symmetric block encryption algorithm, in which 64-bits blocks of plaintext are encrypted using a 128-bit key. Show the decryption equation. 0
Question Explain the suitability or unsuitability of the given passwords 0
Question Assume that Personal Identification Numbers (PINs) are formed by nine-digit combinations of numbers 0 to 9. Assume that an adversary is able to attempt three PINs per second.
Assuming no feedback to the adversary until each attempt has been completed, what is the expected time to discover the correct PIN?
Assuming feedback to the adversary flagging an error as each incorrect digit is entered, what is the expected time to discover the correct PIN?		 0
Question Assume an application requires access control policies based on the applicant’s age and the type of funding to be provided. Using an ABAC approach, write policy rules for each of the following scenarios:
If the applicant’s age is more than 35, only “Research Grants (RG)” can be provided.
If the applicant’s age is less than or equal to 35, both “RG and Travel Grants (TG)” can be provided.		 0
Question Assume a system with K subject attributes, M object attributes and Range () denotes the range of possible values that each attribute can take. What are the number of roles and permissions required for an RBAC model? What is the problem with this approach if additional attributes are added? 0
Question Consider a simplified database for an organization that includes information of several departments (identity, name, manager, number of employees) and of managers and employees of the respective departments. Suggest a relational database for efficiently managing this information 0
Question Users hulkhogan and undertaker do not have the SELECT access right to the Inventory table and the Item table. These tables were created by and are owned by user bruno-s. Write the SQL commands that would enable bruno-s to grant SELECT access to these tables to hulkhogan and undertaker. 0
Question Consider the given fragment of code. What type of malware is this? 0
Question Consider the given fragment embedded in a webpage. What type of malicious software is this? 0
Question In order to implement a classic DoS flood attack, the attacker must generate a sufficiently large volume of packets to exceed the capacity of the link to the target organization. Consider an attack using ICMP echo request (ping) packets that are 100 bytes in size (ignoring framing overhead). How many of these packets per second must the attacker send to flood a target organization using a 8-Mbps link? How many per second if the packets are 1000 bytes in size? Or 1460 bytes? 0
Question It is discussed that an amplification attack, which is a variant of reflection attack, can be launched by using any type of a suitable UDP service, such as the echo service. However, TCP services cannot be used in this attack. Why? 0
Question Consider the first step of the common attack methodology we describe, which is to gather publicly available information on possible targets. What types of information could be used? What does this use suggest to you about the content and detail of such information? How does this correlate with the organization’s business and legal requirements? How do you reconcile these conflicting demands? 0
Question As was mentioned in this chapter, the application gateway does not permit an end-toend TCP connection; rather, it sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. The disadvantage of this approach is the additional processing overhead on each connection since the gateway must examine and forward all traffic in both directions. Describe at least one more limitation of this approach which is not discussed. 0
Question Given table shows a sample of a packet filter firewall ruleset for an imaginary network of IP address that range from 192.168.1.0 to 192.168.1.254. Describe the effect of each rule. 0

Section 2

Activity Type Content Is Graded?
Question Define buffer overflow. 1
Question Define an off-by-one attack. 1
Question Define an injection attack. List some examples of injection attacks. What are the general circumstances in which injection attacks are found? 1
Question State the similarities and differences between command injection and SQL injection attacks 1
Question What are the basic steps needed in the process of securing a system? 1
Question State different types of full virtualization with their security requirements. 1
Question List five essential characteristics of cloud computing. 1
Question List and briefly define three cloud service models. 1
Question Briefly explain the most prominent deployment models for cloud computing. 1
Question Describe some of the main cloud-specific security threats. 1
Question Investigate each of the unsafe standard C library functions shown in the figure using the UNIX man pages or any C programming text, and determine a safer alternative to use. 0
Question Investigate the use of a replacement standard C string library, such as Libsafe, bstring, vstr, or other. Determine how significant the required code changes are, if any, to use the chosen library. 0
Question Investigate the issues that arise while using sequence number as both identifier and authenticator of packets. Identify the root cause of the problem. 0
Question Investigate the various types of cross-site scripting (XSS) attacks. How can such attacks be prevented? 0
Question How can we use the TCP Wrappers and tcpd daemon to achieve secure remote control access? What if the network servers are heavily loaded? 0
Question Why is it important to secure the boot process? Is it required to limit which media the system must boot from? 0

Section 3

Activity Type Content Is Graded?
Question What are different types of cryptanalysis attacks? 1
Question Why do some block cipher modes of operation only use encryption while others use both encryption and decryption? 1
Question In the context of a hash function, what is a compression function? 1
Question Briefly explain Diffie-Hellman key exchange. 1
Question Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why? 0
Question Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption? 0
Question Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”
Will this checksum detect all errors caused by an odd number of error bits? Explain.
Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.
Comment on the effectiveness of this function for use as a hash function for authentication		 0
Question It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible? 0

Section 4

Activity Type Content Is Graded?
Question What are different types of cryptanalysis attacks? 1
Question Why do some block cipher modes of operation only use encryption while others use both encryption and decryption? 1
Question In the context of a hash function, what is a compression function? 1
Question Briefly explain Diffie-Hellman key exchange. 1
Question Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why? 0
Question Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption? 0
Question Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”
Will this checksum detect all errors caused by an odd number of error bits? Explain.
Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.
Comment on the effectiveness of this function for use as a hash function for authentication		 0
Question It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible? 0

Final assessment

Section 1

  1. Questions from previous two subsections can be used.

Section 2

  1. Questions from previous two subsections can be used.

Section 3

  1. Questions from previous two subsections can be used.

Section 4

  1. Questions from previous two subsections can be used.

The retake exam

Section 1

Section 2

Section 3

Section 4

Retrieved from "https://eduwiki.innopolis.university/index.php?title=BSc:_Fundamentals_of_Computer_Security&oldid=8046"