BSc:FundamentalsofComputerSecurity.previous version

Fundamentals of Information Security

• Course name: Fundamentals of Information Security
• Course number: XYZ
• Knowledge area: xxx

Course characteristics

Key concepts of the class

• User authentication and authorization
• Database and data center security
• Reverse engineering and malicious software
• Buffer overflow and software security
• OS security
• Symmetric encryption
• Public-key cryptography

What is the purpose of this course?

The purpose of this course is to teach the students the important aspects of cryptography, authentication, access control, DoS attacks, intrusion detection, etc. The students will learn major types of attacks and methods of protection from them.

Course Objectives Based on Bloom’s Taxonomy

What should a student remember at the end of the course?

By the end of the course, the students should be able to recognize and define

• Message and user authentication
• Encryption algorithms
• Authorization and access control mechanisms
• Different types of attacks
• Firewalls and intrusion detection methods

What should a student be able to understand at the end of the course?

By the end of the course, the students should be able to describe and explain (with examples)

• The importance of authentication and authentication protocols
• Encryption algorithms used for authentication and message integrity
• The importance of authorization and access control, different protocols
• Major types of attacks and methods of protection from them
• Importance of intrusion detection and firewalls

What should a student be able to apply at the end of the course?

By the end of the course, the students should be able to apply

• Authentication protocols
• Encryption techniques and algorithms
• Well-known access control techniques
• Mitigate the DoS attacks
• Intrusion detection algorithms
• Using firewalls

Course evaluation

Course grade breakdown

Component	Points
Laboratory assignments	40%
Homework	4%
Weekly quizzes	16%
Attendance	10%
Final exam	30%

Important: In order to successfully finish the course, the student is required to score at least 50% in final exam.

Grades range

Course grading range

A. Excellent	90-100
B. Good	75-89.9
C. Satisfactory	60-74.9
D. Poor	0-59.9

Resources and reference material

• Required textbook: William Stallings and Lawrie Brown, "Computer Security: Principles and Practice,“ 4th edition, Pearson, 2017.
• Additional textbook: William Stallings, "Cryptography and Network Security: Principles and Practice," 7th Edition, Pearson, 2017.

Course Sections

The course is organized in 8 weeks, with every weeks 4 academics hours of lectures and 4 academic hours of tutorials/labs. The main sections of the course and approximate hour distribution between them is as follows:

Course Sections

Section	Section Title	Teaching Hours
1	Computer security technology and principles	23
2	Software and system security	18
3	Cryptographic algorithms	9
4	Additional	14

Section 1: Computer security technology and principles

Section title

Computer security technology and principles

Topics covered in this section

• Introduction to computer security
• User authentication and authorization
• Database and data center security
• Network security of data center
• Reverse engineering and malicious software

What forms of evaluation were used to test students’ performance in this section?

	Yes/No
Development of individual parts of software product code	1
Homework and group projects	1
Midterm evaluation	0
Testing (written or computer based)	1
Reports	0
Essays	0
Oral polls	1
Discussions	1

Typical questions for ongoing performance evaluation within this section

1. What is meant by the CIA triad?
2. What is the difference between data integrity and system integrity?
3. How is cryptanalysis different from brute-force attack?
4. List and briefly explain the different approaches to attacking a symmetric encryption scheme.
5. In general terms, what are four means of authenticating a user’s identity?
6. What is a Trojan horse attack?
7. What is the difference between authentication and authorization?
8. How does RBAC relate to DAC and MAC?
9. Define the terms database, database management system, and query language.
10. What is a relational database and what are its principal ingredients?
11. What is an SQL injection attack? What are the implications of an SQL injection attack?
12. List the categories for grouping different types of SQLi attacks.
13. Why is RBAC considered fit for database access control?
14. What are three broad mechanisms that malware can use to propagate?
15. What is a blended attack?
16. Define a denial-of-service (DoS) attack
17. State the difference between a SYN flooding attack and a SYN spoofing attack.
18. What is the goal of an HTTP flood attack?
19. What is a poison packet attack? Give two examples of such an attack.
20. How are intruders classified according to skill level?
21. List and briefly describe the classifications of intrusion detection systems based on the source and the type of data analyzed.

Typical questions for seminar classes (labs) within this section

1. Consider the given general code for allowing access to a resource: a) Explain the security flaw in this program, b) Rewrite the code to avoid the flaw
2. Develop an attack tree for gaining access to the contents of a physical safe
3. Typically, in practice, the length of the message is greater than the block size of the encryption algorithm. The simplest approach to handle such encryption is known as electronic codebook (ECB) mode. Explain this mode. Mention a scenario where it cannot be applied. Explain briefly why it is not a secure mode of encryption
4. Consider a very simple symmetric block encryption algorithm, in which 64-bits blocks of plaintext are encrypted using a 128-bit key. Show the decryption equation.
5. Explain the suitability or unsuitability of the given passwords
6. Assume that Personal Identification Numbers (PINs) are formed by nine-digit combinations of numbers 0 to 9. Assume that an adversary is able to attempt three PINs per second.
   1. Assuming no feedback to the adversary until each attempt has been completed, what is the expected time to discover the correct PIN?
   2. Assuming feedback to the adversary flagging an error as each incorrect digit is entered, what is the expected time to discover the correct PIN?
7. Assume an application requires access control policies based on the applicant’s age and the type of funding to be provided. Using an ABAC approach, write policy rules for each of the following scenarios:
   1. If the applicant’s age is more than 35, only “Research Grants (RG)” can be provided.
   2. If the applicant’s age is less than or equal to 35, both “RG and Travel Grants (TG)” can be provided.
8. Assume a system with K subject attributes, M object attributes and Range () denotes the range of possible values that each attribute can take. What are the number of roles and permissions required for an RBAC model? What is the problem with this approach if additional attributes are added?
9. Consider a simplified database for an organization that includes information of several departments (identity, name, manager, number of employees) and of managers and employees of the respective departments. Suggest a relational database for efficiently managing this information
10. Users hulkhogan and undertaker do not have the SELECT access right to the Inventory table and the Item table. These tables were created by and are owned by user bruno-s. Write the SQL commands that would enable bruno-s to grant SELECT access to these tables to hulkhogan and undertaker.
11. Consider the given fragment of code. What type of malware is this?
12. Consider the given fragment embedded in a webpage. What type of malicious software is this?
13. In order to implement a classic DoS flood attack, the attacker must generate a sufficiently large volume of packets to exceed the capacity of the link to the target organization. Consider an attack using ICMP echo request (ping) packets that are 100 bytes in size (ignoring framing overhead). How many of these packets per second must the attacker send to flood a target organization using a 8-Mbps link? How many per second if the packets are 1000 bytes in size? Or 1460 bytes?
14. It is discussed that an amplification attack, which is a variant of reflection attack, can be launched by using any type of a suitable UDP service, such as the echo service. However, TCP services cannot be used in this attack. Why?
15. Consider the first step of the common attack methodology we describe, which is to gather publicly available information on possible targets. What types of information could be used? What does this use suggest to you about the content and detail of such information? How does this correlate with the organization’s business and legal requirements? How do you reconcile these conflicting demands?
16. As was mentioned in this chapter, the application gateway does not permit an end-toend TCP connection; rather, it sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. The disadvantage of this approach is the additional processing overhead on each connection since the gateway must examine and forward all traffic in both directions. Describe at least one more limitation of this approach which is not discussed.
17. Given table shows a sample of a packet filter firewall ruleset for an imaginary network of IP address that range from 192.168.1.0 to 192.168.1.254. Describe the effect of each rule.

Test questions for final assessment in this section

Questions from previous two subsections can be used.

Section 2: Software and system security

Section title

Software and system security

Topics covered in this section

• Buffer overflow and software security
• OS security
• Guest lecture from industry

What forms of evaluation were used to test students’ performance in this section?

	Yes/No
Development of individual parts of software product code	1
Homework and group projects	1
Midterm evaluation	0
Testing (written or computer based)	1
Reports	0
Essays	0
Oral polls	1
Discussions	1

Typical questions for ongoing performance evaluation within this section

1. Define buffer overflow.
2. Define an off-by-one attack.
3. Define an injection attack. List some examples of injection attacks. What are the general circumstances in which injection attacks are found?
4. State the similarities and differences between command injection and SQL injection attacks
5. What are the basic steps needed in the process of securing a system?
6. State different types of full virtualization with their security requirements.
7. List five essential characteristics of cloud computing.
8. List and briefly define three cloud service models.
9. Briefly explain the most prominent deployment models for cloud computing.
10. Describe some of the main cloud-specific security threats.

Typical questions for seminar classes (labs) within this section

1. Investigate each of the unsafe standard C library functions shown in the figure using the UNIX man pages or any C programming text, and determine a safer alternative to use.
2. Investigate the use of a replacement standard C string library, such as Libsafe, bstring, vstr, or other. Determine how significant the required code changes are, if any, to use the chosen library.
3. Investigate the issues that arise while using sequence number as both identifier and authenticator of packets. Identify the root cause of the problem.
4. Investigate the various types of cross-site scripting (XSS) attacks. How can such attacks be prevented?
5. How can we use the TCP Wrappers and tcpd daemon to achieve secure remote control access? What if the network servers are heavily loaded?
6. Why is it important to secure the boot process? Is it required to limit which media the system must boot from?

Test questions for final assessment in this section

Questions from previous two subsections can be used.

Section 3: Cryptographic algorithms

Section title

Cryptographic algorithms

Topics covered in this section

• Symmetric encryption and message confidentiality
• Public key cryptography and message authentication

What forms of evaluation were used to test students’ performance in this section?

	Yes/No
Development of individual parts of software product code	1
Homework and group projects	1
Midterm evaluation	0
Testing (written or computer based)	1
Reports	0
Essays	0
Oral polls	1
Discussions	1

Typical questions for ongoing performance evaluation within this section

1. What are different types of cryptanalysis attacks?
2. Why do some block cipher modes of operation only use encryption while others use both encryption and decryption?
3. In the context of a hash function, what is a compression function?
4. Briefly explain Diffie-Hellman key exchange.

Typical questions for seminar classes (labs) within this section

1. Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why?
2. Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption?
3. Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”
   1. Will this checksum detect all errors caused by an odd number of error bits? Explain.
   2. Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.
   3. Comment on the effectiveness of this function for use as a hash function for authentication
4. It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible?

Test questions for final assessment in this section

Questions from previous two subsections can be used.

Section 4: Additional

Section title

Additional

Topics covered in this section

• Compliances and documentation in computer security
• New technologies and research areas in cyber security
• Cybercrime and forensics, incident response

What forms of evaluation were used to test students’ performance in this section?

	Yes/No
Development of individual parts of software product code	1
Homework and group projects	1
Midterm evaluation	0
Testing (written or computer based)	1
Reports	0
Essays	0
Oral polls	1
Discussions	1

Typical questions for ongoing performance evaluation within this section

1. What are different types of cryptanalysis attacks?
2. Why do some block cipher modes of operation only use encryption while others use both encryption and decryption?
3. In the context of a hash function, what is a compression function?
4. Briefly explain Diffie-Hellman key exchange.

Typical questions for seminar classes (labs) within this section

1. Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why?
2. Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption?
3. Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”
   1. Will this checksum detect all errors caused by an odd number of error bits? Explain.
   2. Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.
   3. Comment on the effectiveness of this function for use as a hash function for authentication
4. It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible?

Test questions for final assessment in this section

Questions from previous two subsections can be used.