Difference between revisions of "BSc: Fundamentals of Computer Security"

From IU
Jump to navigation Jump to search
 
(12 intermediate revisions by 3 users not shown)
Line 1: Line 1:
  +
 
= Fundamentals of Information Security =
  
= Fundamentals of Information Security =
  +
* '''Course name''': Fundamentals of Information Security
  +
* '''Code discipline''': XYZ
  +
* '''Subject area''': xxx
   
  +
== Short Description ==
−
* <span>'''Course name:'''</span> Fundamentals of Information Security
  
  +
This course covers the following concepts: User authentication and authorization; Database and data center security; Reverse engineering and malicious software; Buffer overflow and software security; OS security; Symmetric encryption; Public-key cryptography.
−
* <span>'''Course number:'''</span> XYZ
  
−
* <span>'''Knowledge area:'''</span> xxx
  
   
−
== Course characteristics ==
 +
== Prerequisites ==
   
−
=== Key concepts of the class ===
 +
=== Prerequisite subjects ===
   
−
* User authentication and authorization
  
−
* Database and data center security
  
−
* Reverse engineering and malicious software
  
−
* Buffer overflow and software security
  
−
* OS security
  
−
* Symmetric encryption
  
−
* Public-key cryptography
  
   
  +
=== Prerequisite topics ===
−
=== What is the purpose of this course? ===
  
   
−
The purpose of this course is to teach the students the important aspects of cryptography, authentication, access control, DoS attacks, intrusion detection, etc. The students will learn major types of attacks and methods of protection from them.
  
   
−
=== Course Objectives Based on Bloom’s Taxonomy ===
 +
== Course Topics ==
  +
{| class="wikitable"
  +
|+ Course Sections and Topics
  +
|-
  +
! Section !! Topics within the section
  +
|-
  +
| Computer security technology and principles ||
  +
# Introduction to computer security
  +
# User authentication and authorization
  +
# Database and data center security
  +
# Network security of data center
  +
# Reverse engineering and malicious software
  +
|-
  +
| Software and system security ||
  +
# Buffer overflow and software security
  +
# OS security
  +
# Guest lecture from industry
  +
|-
  +
| Cryptographic algorithms ||
  +
# Symmetric encryption and message confidentiality
  +
# Public key cryptography and message authentication
  +
|-
  +
| Additional ||
  +
# Compliances and documentation in computer security
  +
# New technologies and research areas in cyber security
  +
# Cybercrime and forensics, incident response
  +
|}
  +
== Intended Learning Outcomes (ILOs) ==
   
−
==== What should a student remember at the end of the course? ====
 +
=== What is the main purpose of this course? ===
  +
The purpose of this course is to teach the students the important aspects of cryptography, authentication, access control, DoS attacks, intrusion detection, etc. The students will learn major types of attacks and methods of protection from them.
   
  +
=== ILOs defined at three levels ===
−
By the end of the course, the students should be able to recognize and define
  
   
  +
==== Level 1: What concepts should a student know/remember/explain? ====
  +
By the end of the course, the students should be able to ...
 
* Message and user authentication
  
* Message and user authentication
 
* Encryption algorithms
  
* Encryption algorithms
Line 33: Line 58:
 
* Firewalls and intrusion detection methods
  
* Firewalls and intrusion detection methods
   
−
==== What should a student be able to understand at the end of the course? ====
 +
==== Level 2: What basic practical skills should a student be able to perform? ====
  +
By the end of the course, the students should be able to ...
−  
−
By the end of the course, the students should be able to describe and explain (with examples)
  
−  
 
* The importance of authentication and authentication protocols
  
* The importance of authentication and authentication protocols
 
* Encryption algorithms used for authentication and message integrity
  
* Encryption algorithms used for authentication and message integrity
 
* The importance of authorization and access control, different protocols
  
* The importance of authorization and access control, different protocols
 
* Major types of attacks and methods of protection from them
  
* Major types of attacks and methods of protection from them
−
* Importance of intrusion detection and firewalls
+
* Importance of intrusion detection and firewalls
−  
−
==== What should a student be able to apply at the end of the course? ====
  
−  
−
By the end of the course, the students should be able to apply
  
   
  +
==== Level 3: What complex comprehensive skills should a student be able to apply in real-life scenarios? ====
  +
By the end of the course, the students should be able to ...
 
* Authentication protocols
  
* Authentication protocols
 
* Encryption techniques and algorithms
  
* Encryption techniques and algorithms
Line 52: Line 73:
 
* Mitigate the DoS attacks
  
* Mitigate the DoS attacks
 
* Intrusion detection algorithms
  
* Intrusion detection algorithms
−
* Using firewalls
 +
* Using firewalls
  +
== Grading ==
   
−
=== Course evaluation ===
 +
=== Course grading range ===
  +
{| class="wikitable"
−  
  +
|+
−
<div id="tab:OSCourseGradingRange">
  
−  
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
−
|+ Course grade breakdown
  
−
!align="center"| '''Component'''
  
−
! '''Points'''
  
 
|-
  
|-
  +
! Grade !! Range !! Description of performance
−
| Laboratory assignments
  
−
|align="right"| 55%
  
 
|-
  
|-
  +
| A. Excellent || 90-100 || -
−
| Final exam
  
−
|align="right"| 35%
  
 
|-
  
|-
  +
| B. Good || 75-89 || -
−
| Attendance
  
  +
|-
−
|align="right"| 10%
  
  +
| C. Satisfactory || 60-74 || -
  +
|-
  +
| D. Poor || 0-59 || -
 
|}
  
|}
−
'''Important:''' In order to successfully finish the course, the student is required to score at least 50% in final exam.
  
   
  +
=== Course activities and grading breakdown ===
−
=== Grades range ===
  
  +
{| class="wikitable"
−  
  +
|+
−
<div id="tab:OSCourseGradingRange">
  
  +
|-
−  
  +
! Activity Type !! Percentage of the overall course grade
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
−
|+ Course grading range
  
 
|-
  
|-
  +
| Laboratory assignments || 50%
−
| A. Excellent
  
−
|align="right"| 90-100
  
 
|-
  
|-
  +
| Weekly quizzes || 14%
−
| B. Good
  
−
|align="right"| 75-89
  
 
|-
  
|-
  +
| Attendance || 6%
−
| C. Satisfactory
  
−
|align="right"| 60-74
  
 
|-
  
|-
  +
| Final exam || 30%
−
| D. Poor
  
−
|align="right"| 0-59
  
 
|}
  
|}
   
  +
=== Recommendations for students on how to succeed in the course ===
−
=== Resources and reference material ===
  
   
−
* '''Required textbook:''' William Stallings and Lawrie Brown, "Computer Security: Principles and Practice,“ 4th edition, Pearson, 2017.
  
−
* '''Required textbook:''' William Stallings, "Cryptography and Network Security: Principles and Practice," 7th Edition, Pearson, 2017.
  
   
  +
== Resources, literature and reference materials ==
−
== Course Sections ==
  
   
  +
=== Open access resources ===
−
The course is organized in 8 weeks, with every weeks 4 academics hours of lectures and 4 academic hours of tutorials/labs. The main sections of the course and approximate hour distribution between them is as follows:
  
  +
* Required textbook: William Stallings and Lawrie Brown, "Computer Security: Principles and Practice,“ 4th edition, Pearson, 2017.
  +
* Additional textbook: William Stallings, "Cryptography and Network Security: Principles and Practice," 7th Edition, Pearson, 2017.
   
  +
=== Closed access resources ===
−
<div id="tab:OSCourseSections">
  
   
  +
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
  +
=== Software and tools used within the course ===
−
|+ Course Sections
  
  +
−
!align="center"| '''Section'''
  
  +
= Teaching Methodology: Methods, techniques, & activities =
−
! '''Section Title'''
  
  +
−
!align="center"| '''Teaching Hours'''
  
  +
== Activities and Teaching Methods ==
  +
{| class="wikitable"
  +
|+ Activities within each section
 
|-
  
|-
  +
! Learning Activities !! Section 1 !! Section 2 !! Section 3 !! Section 4
−
|align="center"| 1
  
−
| Computer security technology and principles
  
−
|align="center"| 23
  
 
|-
  
|-
  +
| Development of individual parts of software product code || 1 || 1 || 1 || 1
−
|align="center"| 2
  
−
| Software and system security
 
−
|align="center"| 18
  
 
|-
  
|-
  +
| Homework and group projects || 1 || 1 || 1 || 1
−
|align="center"| 3
  
−
| Cryptographic algorithms
  
−
|align="center"| 9
  
 
|-
  
|-
  +
| Testing (written or computer based) || 1 || 1 || 1 || 1
−
|align="center"| 4
  
  +
|-
−
| Additional
  
  +
| Oral polls || 1 || 1 || 1 || 1
−
|align="center"| 14
  
  +
|-
−  
  +
| Discussions || 1 || 1 || 1 || 1
−
|}
  
  +
|}
−  
  +
== Formative Assessment and Course Activities ==
−
</div>
  
−
=== Section 1: Computer security technology and principles ===
  
−  
−
==== Topics covered in this section ====
 
−  
−
* Introduction to computer security
  
−
* User authentication and authorization
  
−
* Database and data center security
  
−
* Network security of data center
  
−
* Reverse engineering and malicious software
  
−  
−
==== What forms of evaluation were used to test students’ performance in this section? ====
 
   
  +
=== Ongoing performance assessment ===
−
<div id="tab:OSSectionEval1">
  
   
  +
==== Section 1 ====
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
  +
{| class="wikitable"
−
|''' '''
  
  +
|+
−
! '''Yes/No'''
  
 
|-
  
|-
  +
! Activity Type !! Content !! Is Graded?
−
| Development of individual parts of software product code
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || What is meant by the CIA triad? || 1
−
| Homework and group projects
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || What is the difference between data integrity and system integrity? || 1
−
| Midterm evaluation
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || How is cryptanalysis different from brute-force attack? || 1
−
| Testing (written or computer based)
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || List and briefly explain the different approaches to attacking a symmetric encryption scheme. || 1
−
| Reports
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || In general terms, what are four means of authenticating a user’s identity? || 1
−
| Essays
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || What is a Trojan horse attack? || 1
−
| Oral polls
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || What is the difference between authentication and authorization? || 1
−
| Discussions
  
−
|align="center"| 1
  
−
|}
  
−  
−  
−
</div>
  
−
==== Typical questions for ongoing performance evaluation within this section ====
 
−  
−
# What is meant by the CIA triad?
  
−
# What is the difference between data integrity and system integrity?
  
−
# How is cryptanalysis different from brute-force attack?
  
−
# List and briefly explain the different approaches to attacking a symmetric encryption scheme.
  
−
# In general terms, what are four means of authenticating a user’s identity?
  
−
# What is a Trojan horse attack?
  
−
# What is the difference between authentication and authorization?
  
−
# How does RBAC relate to DAC and MAC?
  
−
# Define the terms database, database management system, and query language.
  
−
# What is a relational database and what are its principal ingredients?
  
−
# What is an SQL injection attack? What are the implications of an SQL injection attack?
  
−
# List the categories for grouping different types of SQLi attacks.
  
−
# Why is RBAC considered fit for database access control?
  
−
# What are three broad mechanisms that malware can use to propagate?
  
−
# What is a blended attack?
  
−
# Define a denial-of-service (DoS) attack
  
−
# State the difference between a SYN flooding attack and a SYN spoofing attack.
  
−
# What is the goal of an HTTP flood attack?
  
−
# What is a poison packet attack? Give two examples of such an attack.
  
−
# How are intruders classified according to skill level?
  
−
# List and briefly describe the classifications of intrusion detection systems based on the source and the type of data analyzed.
  
−  
−
==== Typical questions for seminar classes (labs) within this section ====
 
−  
−
# Consider the given general code for allowing access to a resource: a) Explain the security flaw in this program, b) Rewrite the code to avoid the flaw
  
−
# Develop an attack tree for gaining access to the contents of a physical safe
  
−
# Typically, in practice, the length of the message is greater than the block size of the encryption algorithm. The simplest approach to handle such encryption is known as electronic codebook (ECB) mode. Explain this mode. Mention a scenario where it cannot be applied. Explain briefly why it is not a secure mode of encryption
  
−
# Consider a very simple symmetric block encryption algorithm, in which 64-bits blocks of plaintext are encrypted using a 128-bit key. Show the decryption equation.
  
−
# Explain the suitability or unsuitability of the given passwords
  
−
# Assume that Personal Identification Numbers (PINs) are formed by nine-digit combinations of numbers 0 to 9. Assume that an adversary is able to attempt three PINs per second.
  
−
## Assuming no feedback to the adversary until each attempt has been completed, what is the expected time to discover the correct PIN?
  
−
## Assuming feedback to the adversary flagging an error as each incorrect digit is entered, what is the expected time to discover the correct PIN?
  
−
# Assume an application requires access control policies based on the applicant’s age and the type of funding to be provided. Using an ABAC approach, write policy rules for each of the following scenarios:
  
−
## If the applicant’s age is more than 35, only “Research Grants (RG)” can be provided.
  
−
## If the applicant’s age is less than or equal to 35, both “RG and Travel Grants (TG)” can be provided.
  
−
# Assume a system with K subject attributes, M object attributes and Range () denotes the range of possible values that each attribute can take. What are the number of roles and permissions required for an RBAC model? What is the problem with this approach if additional attributes are added?
  
−
# Consider a simplified database for an organization that includes information of several departments (identity, name, manager, number of employees) and of managers and employees of the respective departments. Suggest a relational database for efficiently managing this information
  
−
# Users hulkhogan and undertaker do not have the SELECT access right to the Inventory table and the Item table. These tables were created by and are owned by user bruno-s. Write the SQL commands that would enable bruno-s to grant SELECT access to these tables to hulkhogan and undertaker.
  
−
# Consider the given fragment of code. What type of malware is this?
  
−
# Consider the given fragment embedded in a webpage. What type of malicious software is this?
  
−
# In order to implement a classic DoS flood attack, the attacker must generate a sufficiently large volume of packets to exceed the capacity of the link to the target organization. Consider an attack using ICMP echo request (ping) packets that are 100 bytes in size (ignoring framing overhead). How many of these packets per second must the attacker send to flood a target organization using a 8-Mbps link? How many per second if the packets are 1000 bytes in size? Or 1460 bytes?
  
−
# It is discussed that an amplification attack, which is a variant of reflection attack, can be launched by using any type of a suitable UDP service, such as the echo service. However, TCP services cannot be used in this attack. Why?
  
−
# Consider the first step of the common attack methodology we describe, which is to gather publicly available information on possible targets. What types of information could be used? What does this use suggest to you about the content and detail of such information? How does this correlate with the organization’s business and legal requirements? How do you reconcile these conflicting demands?
  
−
# As was mentioned in this chapter, the application gateway does not permit an end-toend TCP connection; rather, it sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. The disadvantage of this approach is the additional processing overhead on each connection since the gateway must examine and forward all traffic in both directions. Describe at least one more limitation of this approach which is not discussed.
  
−
# Given table shows a sample of a packet filter firewall ruleset for an imaginary network of IP address that range from 192.168.1.0 to 192.168.1.254. Describe the effect of each rule.
  
−  
−
==== Test questions for final assessment in this section ====
 
−  
−
Questions from previous two subsections can be used.
  
−  
−
=== Section 2: Software and system security ===
  
−  
−
==== Topics covered in this section ====
 
−  
−
* Buffer overflow and software security
  
−
* OS security
  
−
* Guest lecture from industry
  
−  
−
==== What forms of evaluation were used to test students’ performance in this section? ====
 
−  
−
<div id="tab:OSSectionEval1">
  
−  
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
−
|''' '''
  
−
! '''Yes/No'''
  
 
|-
  
|-
  +
| Question || How does RBAC relate to DAC and MAC? || 1
−
| Development of individual parts of software product code
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || Define the terms database, database management system, and query language. || 1
−
| Homework and group projects
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || What is a relational database and what are its principal ingredients? || 1
−
| Midterm evaluation
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || What is an SQL injection attack? What are the implications of an SQL injection attack? || 1
−
| Testing (written or computer based)
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || List the categories for grouping different types of SQLi attacks. || 1
−
| Reports
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || Why is RBAC considered fit for database access control? || 1
−
| Essays
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || What are three broad mechanisms that malware can use to propagate? || 1
−
| Oral polls
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || What is a blended attack? || 1
−
| Discussions
  
−
|align="center"| 1
  
−
|}
  
−  
−  
−
</div>
  
−
==== Typical questions for ongoing performance evaluation within this section ====
 
−  
−
# Define buffer overflow.
 
−
# Define an off-by-one attack.
  
−
# Define an injection attack. List some examples of injection attacks. What are the general circumstances in which injection attacks are found?
  
−
# State the similarities and differences between command injection and SQL injection attacks
  
−
# What are the basic steps needed in the process of securing a system?
  
−
# State different types of full virtualization with their security requirements.
  
−
# List five essential characteristics of cloud computing.
  
−
# List and briefly define three cloud service models.
  
−
# Briefly explain the most prominent deployment models for cloud computing.
  
−
# Describe some of the main cloud-specific security threats.
  
−  
−
==== Typical questions for seminar classes (labs) within this section ====
 
−  
−
# Investigate each of the unsafe standard C library functions shown in the figure using the UNIX man pages or any C programming text, and determine a safer alternative to use.
  
−
# Investigate the use of a replacement standard C string library, such as Libsafe, bstring, vstr, or other. Determine how significant the required code changes are, if any, to use the chosen library.
  
−
# Investigate the issues that arise while using sequence number as both identifier and authenticator of packets. Identify the root cause of the problem.
  
−
# Investigate the various types of cross-site scripting (XSS) attacks. How can such attacks be prevented?
 
−
# How can we use the TCP Wrappers and tcpd daemon to achieve secure remote control access? What if the network servers are heavily loaded?
  
−
# Why is it important to secure the boot process? Is it required to limit which media the system must boot from?
  
−  
−
==== Test questions for final assessment in this section ====
 
−  
−
Questions from previous two subsections can be used.
  
−  
−
=== Section 3: Cryptographic algorithms ===
  
−  
−
==== Topics covered in this section ====
 
−  
−
* Symmetric encryption and message confidentiality
  
−
* Public key cryptography and message authentication
  
−  
−
==== What forms of evaluation were used to test students’ performance in this section? ====
 
−  
−
<div id="tab:OSSectionEval1">
  
−  
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
−
|''' '''
  
−
! '''Yes/No'''
  
 
|-
  
|-
  +
| Question || Define a denial-of-service (DoS) attack || 1
−
| Development of individual parts of software product code
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || State the difference between a SYN flooding attack and a SYN spoofing attack. || 1
−
| Homework and group projects
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || What is the goal of an HTTP flood attack? || 1
−
| Midterm evaluation
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || What is a poison packet attack? Give two examples of such an attack. || 1
−
| Testing (written or computer based)
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || How are intruders classified according to skill level? || 1
−
| Reports
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || List and briefly describe the classifications of intrusion detection systems based on the source and the type of data analyzed. || 1
−
| Essays
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || Consider the given general code for allowing access to a resource: a) Explain the security flaw in this program, b) Rewrite the code to avoid the flaw || 0
−
| Oral polls
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || Develop an attack tree for gaining access to the contents of a physical safe || 0
−
| Discussions
  
  +
|-
−
|align="center"| 1
  
  +
| Question || Typically, in practice, the length of the message is greater than the block size of the encryption algorithm. The simplest approach to handle such encryption is known as electronic codebook (ECB) mode. Explain this mode. Mention a scenario where it cannot be applied. Explain briefly why it is not a secure mode of encryption || 0
−
|}
  
  +
|-
−  
  +
| Question || Consider a very simple symmetric block encryption algorithm, in which 64-bits blocks of plaintext are encrypted using a 128-bit key. Show the decryption equation. || 0
−  
  +
|-
−
</div>
  
  +
| Question || Explain the suitability or unsuitability of the given passwords || 0
−
==== Typical questions for ongoing performance evaluation within this section ====
 
  +
|-
−  
  +
| Question || Assume that Personal Identification Numbers (PINs) are formed by nine-digit combinations of numbers 0 to 9. Assume that an adversary is able to attempt three PINs per second.<br>Assuming no feedback to the adversary until each attempt has been completed, what is the expected time to discover the correct PIN?<br>Assuming feedback to the adversary flagging an error as each incorrect digit is entered, what is the expected time to discover the correct PIN? || 0
−
# What are different types of cryptanalysis attacks?
  
  +
|-
−
# Why do some block cipher modes of operation only use encryption while others use both encryption and decryption?
  
  +
| Question || Assume an application requires access control policies based on the applicant’s age and the type of funding to be provided. Using an ABAC approach, write policy rules for each of the following scenarios:<br>If the applicant’s age is more than 35, only “Research Grants (RG)” can be provided.<br>If the applicant’s age is less than or equal to 35, both “RG and Travel Grants (TG)” can be provided. || 0
−
# In the context of a hash function, what is a compression function?
  
  +
|-
−
# Briefly explain Diffie-Hellman key exchange.
  
  +
| Question || Assume a system with K subject attributes, M object attributes and Range () denotes the range of possible values that each attribute can take. What are the number of roles and permissions required for an RBAC model? What is the problem with this approach if additional attributes are added? || 0
−
 
  +
|-
−
==== Typical questions for seminar classes (labs) within this section ====
 
  +
| Question || Consider a simplified database for an organization that includes information of several departments (identity, name, manager, number of employees) and of managers and employees of the respective departments. Suggest a relational database for efficiently managing this information || 0
−  
  +
|-
−
# Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why?
  
  +
| Question || Users hulkhogan and undertaker do not have the SELECT access right to the Inventory table and the Item table. These tables were created by and are owned by user bruno-s. Write the SQL commands that would enable bruno-s to grant SELECT access to these tables to hulkhogan and undertaker. || 0
−
# Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption?
  
−
# Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”
  
−
## Will this checksum detect all errors caused by an odd number of error bits? Explain.
  
−
## Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.
  
−
## Comment on the effectiveness of this function for use as a hash function for authentication
  
−
# It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible?
  
−  
−
==== Test questions for final assessment in this section ====
 
−  
−
Questions from previous two subsections can be used.
  
−  
−
=== Section 4: Additional ===
  
−  
−
==== Topics covered in this section ====
 
−  
−
* Compliances and documentation in computer security
  
−
* New technologies and research areas in cyber security
  
−
* Cybercrime and forensics, incident response
  
−  
−
==== What forms of evaluation were used to test students’ performance in this section? ====
 
−  
−
<div id="tab:OSSectionEval1">
  
−  
−
{| style="border-spacing: 2px; border: 1px solid darkgray;"
  
−
|''' '''
  
−
! '''Yes/No'''
  
 
|-
  
|-
  +
| Question || Consider the given fragment of code. What type of malware is this? || 0
−
| Development of individual parts of software product code
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || Consider the given fragment embedded in a webpage. What type of malicious software is this? || 0
−
| Homework and group projects
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || In order to implement a classic DoS flood attack, the attacker must generate a sufficiently large volume of packets to exceed the capacity of the link to the target organization. Consider an attack using ICMP echo request (ping) packets that are 100 bytes in size (ignoring framing overhead). How many of these packets per second must the attacker send to flood a target organization using a 8-Mbps link? How many per second if the packets are 1000 bytes in size? Or 1460 bytes? || 0
−
| Midterm evaluation
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || It is discussed that an amplification attack, which is a variant of reflection attack, can be launched by using any type of a suitable UDP service, such as the echo service. However, TCP services cannot be used in this attack. Why? || 0
−
| Testing (written or computer based)
  
−
|align="center"| 1
  
 
|-
  
|-
  +
| Question || Consider the first step of the common attack methodology we describe, which is to gather publicly available information on possible targets. What types of information could be used? What does this use suggest to you about the content and detail of such information? How does this correlate with the organization’s business and legal requirements? How do you reconcile these conflicting demands? || 0
−
| Reports
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || As was mentioned in this chapter, the application gateway does not permit an end-toend TCP connection; rather, it sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. The disadvantage of this approach is the additional processing overhead on each connection since the gateway must examine and forward all traffic in both directions. Describe at least one more limitation of this approach which is not discussed. || 0
−
| Essays
  
−
|align="center"| 0
  
 
|-
  
|-
  +
| Question || Given table shows a sample of a packet filter firewall ruleset for an imaginary network of IP address that range from 192.168.1.0 to 192.168.1.254. Describe the effect of each rule. || 0
−
| Oral polls
  
  +
|}
−
|align="center"| 1
  
  +
==== Section 2 ====
  +
{| class="wikitable"
  +
|+
 
|-
  
|-
  +
! Activity Type !! Content !! Is Graded?
−
| Discussions
  
  +
|-
−
|align="center"| 1
  
  +
| Question || Define buffer overflow. || 1
−
|}
  
  +
|-
  +
| Question || Define an off-by-one attack. || 1
  +
|-
  +
| Question || Define an injection attack. List some examples of injection attacks. What are the general circumstances in which injection attacks are found? || 1
  +
|-
  +
| Question || State the similarities and differences between command injection and SQL injection attacks || 1
  +
|-
  +
| Question || What are the basic steps needed in the process of securing a system? || 1
  +
|-
  +
| Question || State different types of full virtualization with their security requirements. || 1
  +
|-
  +
| Question || List five essential characteristics of cloud computing. || 1
  +
|-
  +
| Question || List and briefly define three cloud service models. || 1
  +
|-
  +
| Question || Briefly explain the most prominent deployment models for cloud computing. || 1
  +
|-
  +
| Question || Describe some of the main cloud-specific security threats. || 1
  +
|-
  +
| Question || Investigate each of the unsafe standard C library functions shown in the figure using the UNIX man pages or any C programming text, and determine a safer alternative to use. || 0
  +
|-
  +
| Question || Investigate the use of a replacement standard C string library, such as Libsafe, bstring, vstr, or other. Determine how significant the required code changes are, if any, to use the chosen library. || 0
  +
|-
  +
| Question || Investigate the issues that arise while using sequence number as both identifier and authenticator of packets. Identify the root cause of the problem. || 0
  +
|-
  +
| Question || Investigate the various types of cross-site scripting (XSS) attacks. How can such attacks be prevented? || 0
  +
|-
  +
| Question || How can we use the TCP Wrappers and tcpd daemon to achieve secure remote control access? What if the network servers are heavily loaded? || 0
  +
|-
  +
| Question || Why is it important to secure the boot process? Is it required to limit which media the system must boot from? || 0
  +
|}
  +
==== Section 3 ====
  +
{| class="wikitable"
  +
|+
  +
|-
  +
! Activity Type !! Content !! Is Graded?
  +
|-
  +
| Question || What are different types of cryptanalysis attacks? || 1
  +
|-
  +
| Question || Why do some block cipher modes of operation only use encryption while others use both encryption and decryption? || 1
  +
|-
  +
| Question || In the context of a hash function, what is a compression function? || 1
  +
|-
  +
| Question || Briefly explain Diffie-Hellman key exchange. || 1
  +
|-
  +
| Question || Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why? || 0
  +
|-
  +
| Question || Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption? || 0
  +
|-
  +
| Question || Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”<br>Will this checksum detect all errors caused by an odd number of error bits? Explain.<br>Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.<br>Comment on the effectiveness of this function for use as a hash function for authentication || 0
  +
|-
  +
| Question || It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible? || 0
  +
|}
  +
==== Section 4 ====
  +
{| class="wikitable"
  +
|+
  +
|-
  +
! Activity Type !! Content !! Is Graded?
  +
|-
  +
| Question || What are different types of cryptanalysis attacks? || 1
  +
|-
  +
| Question || Why do some block cipher modes of operation only use encryption while others use both encryption and decryption? || 1
  +
|-
  +
| Question || In the context of a hash function, what is a compression function? || 1
  +
|-
  +
| Question || Briefly explain Diffie-Hellman key exchange. || 1
  +
|-
  +
| Question || Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why? || 0
  +
|-
  +
| Question || Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption? || 0
  +
|-
  +
| Question || Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”<br>Will this checksum detect all errors caused by an odd number of error bits? Explain.<br>Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.<br>Comment on the effectiveness of this function for use as a hash function for authentication || 0
  +
|-
  +
| Question || It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible? || 0
  +
|}
  +
=== Final assessment ===
  +
'''Section 1'''
  +
# Questions from previous two subsections can be used.
  +
'''Section 2'''
  +
# Questions from previous two subsections can be used.
  +
'''Section 3'''
  +
# Questions from previous two subsections can be used.
  +
'''Section 4'''
  +
# Questions from previous two subsections can be used.
   
  +
=== The retake exam ===
  +
'''Section 1'''
   
  +
'''Section 2'''
−
</div>
  
−
==== Typical questions for ongoing performance evaluation within this section ====
 
−  
−
# What are different types of cryptanalysis attacks?
  
−
# Why do some block cipher modes of operation only use encryption while others use both encryption and decryption?
  
−
# In the context of a hash function, what is a compression function?
  
−
# Briefly explain Diffie-Hellman key exchange.
  
−
 
−
==== Typical questions for seminar classes (labs) within this section ====
 
−  
−
# Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why?
  
−
# Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption?
  
−
# Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”
  
−
## Will this checksum detect all errors caused by an odd number of error bits? Explain.
  
−
## Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.
  
−
## Comment on the effectiveness of this function for use as a hash function for authentication
  
−
# It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible?
  
   
  +
'''Section 3'''
−
==== Test questions for final assessment in this section ====
 
   
  +
'''Section 4'''
−
Questions from previous two subsections can be used.
  

Latest revision as of 12:48, 23 January 2023

Fundamentals of Information Security

  • Course name: Fundamentals of Information Security
  • Code discipline: XYZ
  • Subject area: xxx

Short Description

This course covers the following concepts: User authentication and authorization; Database and data center security; Reverse engineering and malicious software; Buffer overflow and software security; OS security; Symmetric encryption; Public-key cryptography.

Prerequisites

Prerequisite subjects

Prerequisite topics

Course Topics

Course Sections and Topics
Section Topics within the section
Computer security technology and principles
  1. Introduction to computer security
  2. User authentication and authorization
  3. Database and data center security
  4. Network security of data center
  5. Reverse engineering and malicious software
Software and system security
  1. Buffer overflow and software security
  2. OS security
  3. Guest lecture from industry
Cryptographic algorithms
  1. Symmetric encryption and message confidentiality
  2. Public key cryptography and message authentication
Additional
  1. Compliances and documentation in computer security
  2. New technologies and research areas in cyber security
  3. Cybercrime and forensics, incident response

Intended Learning Outcomes (ILOs)

What is the main purpose of this course?

The purpose of this course is to teach the students the important aspects of cryptography, authentication, access control, DoS attacks, intrusion detection, etc. The students will learn major types of attacks and methods of protection from them.

ILOs defined at three levels

Level 1: What concepts should a student know/remember/explain?

By the end of the course, the students should be able to ...

  • Message and user authentication
  • Encryption algorithms
  • Authorization and access control mechanisms
  • Different types of attacks
  • Firewalls and intrusion detection methods

Level 2: What basic practical skills should a student be able to perform?

By the end of the course, the students should be able to ...

  • The importance of authentication and authentication protocols
  • Encryption algorithms used for authentication and message integrity
  • The importance of authorization and access control, different protocols
  • Major types of attacks and methods of protection from them
  • Importance of intrusion detection and firewalls

Level 3: What complex comprehensive skills should a student be able to apply in real-life scenarios?

By the end of the course, the students should be able to ...

  • Authentication protocols
  • Encryption techniques and algorithms
  • Well-known access control techniques
  • Mitigate the DoS attacks
  • Intrusion detection algorithms
  • Using firewalls

Grading

Course grading range

Grade Range Description of performance
A. Excellent 90-100 -
B. Good 75-89 -
C. Satisfactory 60-74 -
D. Poor 0-59 -

Course activities and grading breakdown

Activity Type Percentage of the overall course grade
Laboratory assignments 50%
Weekly quizzes 14%
Attendance 6%
Final exam 30%

Recommendations for students on how to succeed in the course

Resources, literature and reference materials

Open access resources

  • Required textbook: William Stallings and Lawrie Brown, "Computer Security: Principles and Practice,“ 4th edition, Pearson, 2017.
  • Additional textbook: William Stallings, "Cryptography and Network Security: Principles and Practice," 7th Edition, Pearson, 2017.

Closed access resources

Software and tools used within the course

Teaching Methodology: Methods, techniques, & activities

Activities and Teaching Methods

Activities within each section
Learning Activities Section 1 Section 2 Section 3 Section 4
Development of individual parts of software product code 1 1 1 1
Homework and group projects 1 1 1 1
Testing (written or computer based) 1 1 1 1
Oral polls 1 1 1 1
Discussions 1 1 1 1

Formative Assessment and Course Activities

Ongoing performance assessment

Section 1

Activity Type Content Is Graded?
Question What is meant by the CIA triad? 1
Question What is the difference between data integrity and system integrity? 1
Question How is cryptanalysis different from brute-force attack? 1
Question List and briefly explain the different approaches to attacking a symmetric encryption scheme. 1
Question In general terms, what are four means of authenticating a user’s identity? 1
Question What is a Trojan horse attack? 1
Question What is the difference between authentication and authorization? 1
Question How does RBAC relate to DAC and MAC? 1
Question Define the terms database, database management system, and query language. 1
Question What is a relational database and what are its principal ingredients? 1
Question What is an SQL injection attack? What are the implications of an SQL injection attack? 1
Question List the categories for grouping different types of SQLi attacks. 1
Question Why is RBAC considered fit for database access control? 1
Question What are three broad mechanisms that malware can use to propagate? 1
Question What is a blended attack? 1
Question Define a denial-of-service (DoS) attack 1
Question State the difference between a SYN flooding attack and a SYN spoofing attack. 1
Question What is the goal of an HTTP flood attack? 1
Question What is a poison packet attack? Give two examples of such an attack. 1
Question How are intruders classified according to skill level? 1
Question List and briefly describe the classifications of intrusion detection systems based on the source and the type of data analyzed. 1
Question Consider the given general code for allowing access to a resource: a) Explain the security flaw in this program, b) Rewrite the code to avoid the flaw 0
Question Develop an attack tree for gaining access to the contents of a physical safe 0
Question Typically, in practice, the length of the message is greater than the block size of the encryption algorithm. The simplest approach to handle such encryption is known as electronic codebook (ECB) mode. Explain this mode. Mention a scenario where it cannot be applied. Explain briefly why it is not a secure mode of encryption 0
Question Consider a very simple symmetric block encryption algorithm, in which 64-bits blocks of plaintext are encrypted using a 128-bit key. Show the decryption equation. 0
Question Explain the suitability or unsuitability of the given passwords 0
Question Assume that Personal Identification Numbers (PINs) are formed by nine-digit combinations of numbers 0 to 9. Assume that an adversary is able to attempt three PINs per second.
Assuming no feedback to the adversary until each attempt has been completed, what is the expected time to discover the correct PIN?
Assuming feedback to the adversary flagging an error as each incorrect digit is entered, what is the expected time to discover the correct PIN?		 0
Question Assume an application requires access control policies based on the applicant’s age and the type of funding to be provided. Using an ABAC approach, write policy rules for each of the following scenarios:
If the applicant’s age is more than 35, only “Research Grants (RG)” can be provided.
If the applicant’s age is less than or equal to 35, both “RG and Travel Grants (TG)” can be provided.		 0
Question Assume a system with K subject attributes, M object attributes and Range () denotes the range of possible values that each attribute can take. What are the number of roles and permissions required for an RBAC model? What is the problem with this approach if additional attributes are added? 0
Question Consider a simplified database for an organization that includes information of several departments (identity, name, manager, number of employees) and of managers and employees of the respective departments. Suggest a relational database for efficiently managing this information 0
Question Users hulkhogan and undertaker do not have the SELECT access right to the Inventory table and the Item table. These tables were created by and are owned by user bruno-s. Write the SQL commands that would enable bruno-s to grant SELECT access to these tables to hulkhogan and undertaker. 0
Question Consider the given fragment of code. What type of malware is this? 0
Question Consider the given fragment embedded in a webpage. What type of malicious software is this? 0
Question In order to implement a classic DoS flood attack, the attacker must generate a sufficiently large volume of packets to exceed the capacity of the link to the target organization. Consider an attack using ICMP echo request (ping) packets that are 100 bytes in size (ignoring framing overhead). How many of these packets per second must the attacker send to flood a target organization using a 8-Mbps link? How many per second if the packets are 1000 bytes in size? Or 1460 bytes? 0
Question It is discussed that an amplification attack, which is a variant of reflection attack, can be launched by using any type of a suitable UDP service, such as the echo service. However, TCP services cannot be used in this attack. Why? 0
Question Consider the first step of the common attack methodology we describe, which is to gather publicly available information on possible targets. What types of information could be used? What does this use suggest to you about the content and detail of such information? How does this correlate with the organization’s business and legal requirements? How do you reconcile these conflicting demands? 0
Question As was mentioned in this chapter, the application gateway does not permit an end-toend TCP connection; rather, it sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. The disadvantage of this approach is the additional processing overhead on each connection since the gateway must examine and forward all traffic in both directions. Describe at least one more limitation of this approach which is not discussed. 0
Question Given table shows a sample of a packet filter firewall ruleset for an imaginary network of IP address that range from 192.168.1.0 to 192.168.1.254. Describe the effect of each rule. 0

Section 2

Activity Type Content Is Graded?
Question Define buffer overflow. 1
Question Define an off-by-one attack. 1
Question Define an injection attack. List some examples of injection attacks. What are the general circumstances in which injection attacks are found? 1
Question State the similarities and differences between command injection and SQL injection attacks 1
Question What are the basic steps needed in the process of securing a system? 1
Question State different types of full virtualization with their security requirements. 1
Question List five essential characteristics of cloud computing. 1
Question List and briefly define three cloud service models. 1
Question Briefly explain the most prominent deployment models for cloud computing. 1
Question Describe some of the main cloud-specific security threats. 1
Question Investigate each of the unsafe standard C library functions shown in the figure using the UNIX man pages or any C programming text, and determine a safer alternative to use. 0
Question Investigate the use of a replacement standard C string library, such as Libsafe, bstring, vstr, or other. Determine how significant the required code changes are, if any, to use the chosen library. 0
Question Investigate the issues that arise while using sequence number as both identifier and authenticator of packets. Identify the root cause of the problem. 0
Question Investigate the various types of cross-site scripting (XSS) attacks. How can such attacks be prevented? 0
Question How can we use the TCP Wrappers and tcpd daemon to achieve secure remote control access? What if the network servers are heavily loaded? 0
Question Why is it important to secure the boot process? Is it required to limit which media the system must boot from? 0

Section 3

Activity Type Content Is Graded?
Question What are different types of cryptanalysis attacks? 1
Question Why do some block cipher modes of operation only use encryption while others use both encryption and decryption? 1
Question In the context of a hash function, what is a compression function? 1
Question Briefly explain Diffie-Hellman key exchange. 1
Question Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why? 0
Question Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption? 0
Question Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”
Will this checksum detect all errors caused by an odd number of error bits? Explain.
Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.
Comment on the effectiveness of this function for use as a hash function for authentication		 0
Question It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible? 0

Section 4

Activity Type Content Is Graded?
Question What are different types of cryptanalysis attacks? 1
Question Why do some block cipher modes of operation only use encryption while others use both encryption and decryption? 1
Question In the context of a hash function, what is a compression function? 1
Question Briefly explain Diffie-Hellman key exchange. 1
Question Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why? 0
Question Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption? 0
Question Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”
Will this checksum detect all errors caused by an odd number of error bits? Explain.
Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.
Comment on the effectiveness of this function for use as a hash function for authentication		 0
Question It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible? 0

Final assessment

Section 1

  1. Questions from previous two subsections can be used.

Section 2

  1. Questions from previous two subsections can be used.

Section 3

  1. Questions from previous two subsections can be used.

Section 4

  1. Questions from previous two subsections can be used.

The retake exam

Section 1

Section 2

Section 3

Section 4

Retrieved from "https://eduwiki.innopolis.university/index.php?title=BSc:_Fundamentals_of_Computer_Security&oldid=8046"