BSc: Fundamentals of Computer Security
Revision as of 12:57, 12 July 2022 by R.sirgalina (talk | contribs)
Fundamentals of Information Security
- Course name: Fundamentals of Information Security
- Code discipline: XYZ
- Subject area: xxx
Short Description
This course covers the following concepts: User authentication and authorization; Database and data center security; Reverse engineering and malicious software; Buffer overflow and software security; OS security; Symmetric encryption; Public-key cryptography.
Prerequisites
Prerequisite subjects
Prerequisite topics
Course Topics
| Section | Topics within the section |
|---|---|
| Computer security technology and principles |
|
| Software and system security |
|
| Cryptographic algorithms |
|
| Additional |
|
Intended Learning Outcomes (ILOs)
What is the main purpose of this course?
The purpose of this course is to teach the students the important aspects of cryptography, authentication, access control, DoS attacks, intrusion detection, etc. The students will learn major types of attacks and methods of protection from them.
ILOs defined at three levels
Level 1: What concepts should a student know/remember/explain?
By the end of the course, the students should be able to ...
- Message and user authentication
- Encryption algorithms
- Authorization and access control mechanisms
- Different types of attacks
- Firewalls and intrusion detection methods
Level 2: What basic practical skills should a student be able to perform?
By the end of the course, the students should be able to ...
- The importance of authentication and authentication protocols
- Encryption algorithms used for authentication and message integrity
- The importance of authorization and access control, different protocols
- Major types of attacks and methods of protection from them
- Importance of intrusion detection and firewalls
Level 3: What complex comprehensive skills should a student be able to apply in real-life scenarios?
By the end of the course, the students should be able to ...
- Authentication protocols
- Encryption techniques and algorithms
- Well-known access control techniques
- Mitigate the DoS attacks
- Intrusion detection algorithms
- Using firewalls
Grading
Course grading range
| Grade | Range | Description of performance |
|---|---|---|
| A. Excellent | 90-100 | - |
| B. Good | 75-89 | - |
| C. Satisfactory | 60-74 | - |
| D. Poor | 0-59 | - |
Course activities and grading breakdown
| Activity Type | Percentage of the overall course grade |
|---|---|
| Laboratory assignments | 40% |
| Homework | 4% |
| Weekly quizzes | 16% |
| Attendance | 10% |
| Final exam | 30% |
Recommendations for students on how to succeed in the course
Resources, literature and reference materials
Open access resources
- Required textbook: William Stallings and Lawrie Brown, "Computer Security: Principles and Practice,“ 4th edition, Pearson, 2017.
- Additional textbook: William Stallings, "Cryptography and Network Security: Principles and Practice," 7th Edition, Pearson, 2017.
Closed access resources
Software and tools used within the course
Teaching Methodology: Methods, techniques, & activities
Activities and Teaching Methods
| Learning Activities | Section 1 | Section 2 | Section 3 | Section 4 |
|---|---|---|---|---|
| Development of individual parts of software product code | 1 | 1 | 1 | 1 |
| Homework and group projects | 1 | 1 | 1 | 1 |
| Testing (written or computer based) | 1 | 1 | 1 | 1 |
| Oral polls | 1 | 1 | 1 | 1 |
| Discussions | 1 | 1 | 1 | 1 |
Formative Assessment and Course Activities
Ongoing performance assessment
Section 1
| Activity Type | Content | Is Graded? |
|---|---|---|
| Question | What is meant by the CIA triad? | 1 |
| Question | What is the difference between data integrity and system integrity? | 1 |
| Question | How is cryptanalysis different from brute-force attack? | 1 |
| Question | List and briefly explain the different approaches to attacking a symmetric encryption scheme. | 1 |
| Question | In general terms, what are four means of authenticating a user’s identity? | 1 |
| Question | What is a Trojan horse attack? | 1 |
| Question | What is the difference between authentication and authorization? | 1 |
| Question | How does RBAC relate to DAC and MAC? | 1 |
| Question | Define the terms database, database management system, and query language. | 1 |
| Question | What is a relational database and what are its principal ingredients? | 1 |
| Question | What is an SQL injection attack? What are the implications of an SQL injection attack? | 1 |
| Question | List the categories for grouping different types of SQLi attacks. | 1 |
| Question | Why is RBAC considered fit for database access control? | 1 |
| Question | What are three broad mechanisms that malware can use to propagate? | 1 |
| Question | What is a blended attack? | 1 |
| Question | Define a denial-of-service (DoS) attack | 1 |
| Question | State the difference between a SYN flooding attack and a SYN spoofing attack. | 1 |
| Question | What is the goal of an HTTP flood attack? | 1 |
| Question | What is a poison packet attack? Give two examples of such an attack. | 1 |
| Question | How are intruders classified according to skill level? | 1 |
| Question | List and briefly describe the classifications of intrusion detection systems based on the source and the type of data analyzed. | 1 |
| Question | Consider the given general code for allowing access to a resource: a) Explain the security flaw in this program, b) Rewrite the code to avoid the flaw | 0 |
| Question | Develop an attack tree for gaining access to the contents of a physical safe | 0 |
| Question | Typically, in practice, the length of the message is greater than the block size of the encryption algorithm. The simplest approach to handle such encryption is known as electronic codebook (ECB) mode. Explain this mode. Mention a scenario where it cannot be applied. Explain briefly why it is not a secure mode of encryption | 0 |
| Question | Consider a very simple symmetric block encryption algorithm, in which 64-bits blocks of plaintext are encrypted using a 128-bit key. Show the decryption equation. | 0 |
| Question | Explain the suitability or unsuitability of the given passwords | 0 |
| Question | Assume that Personal Identification Numbers (PINs) are formed by nine-digit combinations of numbers 0 to 9. Assume that an adversary is able to attempt three PINs per second. Assuming no feedback to the adversary until each attempt has been completed, what is the expected time to discover the correct PIN? Assuming feedback to the adversary flagging an error as each incorrect digit is entered, what is the expected time to discover the correct PIN? |
0 |
| Question | Assume an application requires access control policies based on the applicant’s age and the type of funding to be provided. Using an ABAC approach, write policy rules for each of the following scenarios: If the applicant’s age is more than 35, only “Research Grants (RG)” can be provided. If the applicant’s age is less than or equal to 35, both “RG and Travel Grants (TG)” can be provided. |
0 |
| Question | Assume a system with K subject attributes, M object attributes and Range () denotes the range of possible values that each attribute can take. What are the number of roles and permissions required for an RBAC model? What is the problem with this approach if additional attributes are added? | 0 |
| Question | Consider a simplified database for an organization that includes information of several departments (identity, name, manager, number of employees) and of managers and employees of the respective departments. Suggest a relational database for efficiently managing this information | 0 |
| Question | Users hulkhogan and undertaker do not have the SELECT access right to the Inventory table and the Item table. These tables were created by and are owned by user bruno-s. Write the SQL commands that would enable bruno-s to grant SELECT access to these tables to hulkhogan and undertaker. | 0 |
| Question | Consider the given fragment of code. What type of malware is this? | 0 |
| Question | Consider the given fragment embedded in a webpage. What type of malicious software is this? | 0 |
| Question | In order to implement a classic DoS flood attack, the attacker must generate a sufficiently large volume of packets to exceed the capacity of the link to the target organization. Consider an attack using ICMP echo request (ping) packets that are 100 bytes in size (ignoring framing overhead). How many of these packets per second must the attacker send to flood a target organization using a 8-Mbps link? How many per second if the packets are 1000 bytes in size? Or 1460 bytes? | 0 |
| Question | It is discussed that an amplification attack, which is a variant of reflection attack, can be launched by using any type of a suitable UDP service, such as the echo service. However, TCP services cannot be used in this attack. Why? | 0 |
| Question | Consider the first step of the common attack methodology we describe, which is to gather publicly available information on possible targets. What types of information could be used? What does this use suggest to you about the content and detail of such information? How does this correlate with the organization’s business and legal requirements? How do you reconcile these conflicting demands? | 0 |
| Question | As was mentioned in this chapter, the application gateway does not permit an end-toend TCP connection; rather, it sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. The disadvantage of this approach is the additional processing overhead on each connection since the gateway must examine and forward all traffic in both directions. Describe at least one more limitation of this approach which is not discussed. | 0 |
| Question | Given table shows a sample of a packet filter firewall ruleset for an imaginary network of IP address that range from 192.168.1.0 to 192.168.1.254. Describe the effect of each rule. | 0 |
Section 2
| Activity Type | Content | Is Graded? |
|---|---|---|
| Question | Define buffer overflow. | 1 |
| Question | Define an off-by-one attack. | 1 |
| Question | Define an injection attack. List some examples of injection attacks. What are the general circumstances in which injection attacks are found? | 1 |
| Question | State the similarities and differences between command injection and SQL injection attacks | 1 |
| Question | What are the basic steps needed in the process of securing a system? | 1 |
| Question | State different types of full virtualization with their security requirements. | 1 |
| Question | List five essential characteristics of cloud computing. | 1 |
| Question | List and briefly define three cloud service models. | 1 |
| Question | Briefly explain the most prominent deployment models for cloud computing. | 1 |
| Question | Describe some of the main cloud-specific security threats. | 1 |
| Question | Investigate each of the unsafe standard C library functions shown in the figure using the UNIX man pages or any C programming text, and determine a safer alternative to use. | 0 |
| Question | Investigate the use of a replacement standard C string library, such as Libsafe, bstring, vstr, or other. Determine how significant the required code changes are, if any, to use the chosen library. | 0 |
| Question | Investigate the issues that arise while using sequence number as both identifier and authenticator of packets. Identify the root cause of the problem. | 0 |
| Question | Investigate the various types of cross-site scripting (XSS) attacks. How can such attacks be prevented? | 0 |
| Question | How can we use the TCP Wrappers and tcpd daemon to achieve secure remote control access? What if the network servers are heavily loaded? | 0 |
| Question | Why is it important to secure the boot process? Is it required to limit which media the system must boot from? | 0 |
Section 3
| Activity Type | Content | Is Graded? |
|---|---|---|
| Question | What are different types of cryptanalysis attacks? | 1 |
| Question | Why do some block cipher modes of operation only use encryption while others use both encryption and decryption? | 1 |
| Question | In the context of a hash function, what is a compression function? | 1 |
| Question | Briefly explain Diffie-Hellman key exchange. | 1 |
| Question | Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why? | 0 |
| Question | Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption? | 0 |
| Question | Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.” Will this checksum detect all errors caused by an odd number of error bits? Explain. Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail. Comment on the effectiveness of this function for use as a hash function for authentication |
0 |
| Question | It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible? | 0 |
Section 4
| Activity Type | Content | Is Graded? |
|---|---|---|
| Question | What are different types of cryptanalysis attacks? | 1 |
| Question | Why do some block cipher modes of operation only use encryption while others use both encryption and decryption? | 1 |
| Question | In the context of a hash function, what is a compression function? | 1 |
| Question | Briefly explain Diffie-Hellman key exchange. | 1 |
| Question | Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why? | 0 |
| Question | Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption? | 0 |
| Question | Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.” Will this checksum detect all errors caused by an odd number of error bits? Explain. Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail. Comment on the effectiveness of this function for use as a hash function for authentication |
0 |
| Question | It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible? | 0 |
Final assessment
Section 1
- Questions from previous two subsections can be used.
Section 2
- Questions from previous two subsections can be used.
Section 3
- Questions from previous two subsections can be used.
Section 4
- Questions from previous two subsections can be used.
The retake exam
Section 1
Section 2
Section 3
Section 4