BSc: Fundamentals of Computer Security

From IU
Revision as of 12:48, 23 January 2023 by S.seytnazarov (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

Fundamentals of Information Security

  • Course name: Fundamentals of Information Security
  • Code discipline: XYZ
  • Subject area: xxx

Short Description

This course covers the following concepts: User authentication and authorization; Database and data center security; Reverse engineering and malicious software; Buffer overflow and software security; OS security; Symmetric encryption; Public-key cryptography.

Prerequisites

Prerequisite subjects

Prerequisite topics

Course Topics

Course Sections and Topics
Section Topics within the section
Computer security technology and principles
  1. Introduction to computer security
  2. User authentication and authorization
  3. Database and data center security
  4. Network security of data center
  5. Reverse engineering and malicious software
Software and system security
  1. Buffer overflow and software security
  2. OS security
  3. Guest lecture from industry
Cryptographic algorithms
  1. Symmetric encryption and message confidentiality
  2. Public key cryptography and message authentication
Additional
  1. Compliances and documentation in computer security
  2. New technologies and research areas in cyber security
  3. Cybercrime and forensics, incident response

Intended Learning Outcomes (ILOs)

What is the main purpose of this course?

The purpose of this course is to teach the students the important aspects of cryptography, authentication, access control, DoS attacks, intrusion detection, etc. The students will learn major types of attacks and methods of protection from them.

ILOs defined at three levels

Level 1: What concepts should a student know/remember/explain?

By the end of the course, the students should be able to ...

  • Message and user authentication
  • Encryption algorithms
  • Authorization and access control mechanisms
  • Different types of attacks
  • Firewalls and intrusion detection methods

Level 2: What basic practical skills should a student be able to perform?

By the end of the course, the students should be able to ...

  • The importance of authentication and authentication protocols
  • Encryption algorithms used for authentication and message integrity
  • The importance of authorization and access control, different protocols
  • Major types of attacks and methods of protection from them
  • Importance of intrusion detection and firewalls

Level 3: What complex comprehensive skills should a student be able to apply in real-life scenarios?

By the end of the course, the students should be able to ...

  • Authentication protocols
  • Encryption techniques and algorithms
  • Well-known access control techniques
  • Mitigate the DoS attacks
  • Intrusion detection algorithms
  • Using firewalls

Grading

Course grading range

Grade Range Description of performance
A. Excellent 90-100 -
B. Good 75-89 -
C. Satisfactory 60-74 -
D. Poor 0-59 -

Course activities and grading breakdown

Activity Type Percentage of the overall course grade
Laboratory assignments 50%
Weekly quizzes 14%
Attendance 6%
Final exam 30%

Recommendations for students on how to succeed in the course

Resources, literature and reference materials

Open access resources

  • Required textbook: William Stallings and Lawrie Brown, "Computer Security: Principles and Practice,“ 4th edition, Pearson, 2017.
  • Additional textbook: William Stallings, "Cryptography and Network Security: Principles and Practice," 7th Edition, Pearson, 2017.

Closed access resources

Software and tools used within the course

Teaching Methodology: Methods, techniques, & activities

Activities and Teaching Methods

Activities within each section
Learning Activities Section 1 Section 2 Section 3 Section 4
Development of individual parts of software product code 1 1 1 1
Homework and group projects 1 1 1 1
Testing (written or computer based) 1 1 1 1
Oral polls 1 1 1 1
Discussions 1 1 1 1

Formative Assessment and Course Activities

Ongoing performance assessment

Section 1

Activity Type Content Is Graded?
Question What is meant by the CIA triad? 1
Question What is the difference between data integrity and system integrity? 1
Question How is cryptanalysis different from brute-force attack? 1
Question List and briefly explain the different approaches to attacking a symmetric encryption scheme. 1
Question In general terms, what are four means of authenticating a user’s identity? 1
Question What is a Trojan horse attack? 1
Question What is the difference between authentication and authorization? 1
Question How does RBAC relate to DAC and MAC? 1
Question Define the terms database, database management system, and query language. 1
Question What is a relational database and what are its principal ingredients? 1
Question What is an SQL injection attack? What are the implications of an SQL injection attack? 1
Question List the categories for grouping different types of SQLi attacks. 1
Question Why is RBAC considered fit for database access control? 1
Question What are three broad mechanisms that malware can use to propagate? 1
Question What is a blended attack? 1
Question Define a denial-of-service (DoS) attack 1
Question State the difference between a SYN flooding attack and a SYN spoofing attack. 1
Question What is the goal of an HTTP flood attack? 1
Question What is a poison packet attack? Give two examples of such an attack. 1
Question How are intruders classified according to skill level? 1
Question List and briefly describe the classifications of intrusion detection systems based on the source and the type of data analyzed. 1
Question Consider the given general code for allowing access to a resource: a) Explain the security flaw in this program, b) Rewrite the code to avoid the flaw 0
Question Develop an attack tree for gaining access to the contents of a physical safe 0
Question Typically, in practice, the length of the message is greater than the block size of the encryption algorithm. The simplest approach to handle such encryption is known as electronic codebook (ECB) mode. Explain this mode. Mention a scenario where it cannot be applied. Explain briefly why it is not a secure mode of encryption 0
Question Consider a very simple symmetric block encryption algorithm, in which 64-bits blocks of plaintext are encrypted using a 128-bit key. Show the decryption equation. 0
Question Explain the suitability or unsuitability of the given passwords 0
Question Assume that Personal Identification Numbers (PINs) are formed by nine-digit combinations of numbers 0 to 9. Assume that an adversary is able to attempt three PINs per second.
Assuming no feedback to the adversary until each attempt has been completed, what is the expected time to discover the correct PIN?
Assuming feedback to the adversary flagging an error as each incorrect digit is entered, what is the expected time to discover the correct PIN?
0
Question Assume an application requires access control policies based on the applicant’s age and the type of funding to be provided. Using an ABAC approach, write policy rules for each of the following scenarios:
If the applicant’s age is more than 35, only “Research Grants (RG)” can be provided.
If the applicant’s age is less than or equal to 35, both “RG and Travel Grants (TG)” can be provided.
0
Question Assume a system with K subject attributes, M object attributes and Range () denotes the range of possible values that each attribute can take. What are the number of roles and permissions required for an RBAC model? What is the problem with this approach if additional attributes are added? 0
Question Consider a simplified database for an organization that includes information of several departments (identity, name, manager, number of employees) and of managers and employees of the respective departments. Suggest a relational database for efficiently managing this information 0
Question Users hulkhogan and undertaker do not have the SELECT access right to the Inventory table and the Item table. These tables were created by and are owned by user bruno-s. Write the SQL commands that would enable bruno-s to grant SELECT access to these tables to hulkhogan and undertaker. 0
Question Consider the given fragment of code. What type of malware is this? 0
Question Consider the given fragment embedded in a webpage. What type of malicious software is this? 0
Question In order to implement a classic DoS flood attack, the attacker must generate a sufficiently large volume of packets to exceed the capacity of the link to the target organization. Consider an attack using ICMP echo request (ping) packets that are 100 bytes in size (ignoring framing overhead). How many of these packets per second must the attacker send to flood a target organization using a 8-Mbps link? How many per second if the packets are 1000 bytes in size? Or 1460 bytes? 0
Question It is discussed that an amplification attack, which is a variant of reflection attack, can be launched by using any type of a suitable UDP service, such as the echo service. However, TCP services cannot be used in this attack. Why? 0
Question Consider the first step of the common attack methodology we describe, which is to gather publicly available information on possible targets. What types of information could be used? What does this use suggest to you about the content and detail of such information? How does this correlate with the organization’s business and legal requirements? How do you reconcile these conflicting demands? 0
Question As was mentioned in this chapter, the application gateway does not permit an end-toend TCP connection; rather, it sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. The disadvantage of this approach is the additional processing overhead on each connection since the gateway must examine and forward all traffic in both directions. Describe at least one more limitation of this approach which is not discussed. 0
Question Given table shows a sample of a packet filter firewall ruleset for an imaginary network of IP address that range from 192.168.1.0 to 192.168.1.254. Describe the effect of each rule. 0

Section 2

Activity Type Content Is Graded?
Question Define buffer overflow. 1
Question Define an off-by-one attack. 1
Question Define an injection attack. List some examples of injection attacks. What are the general circumstances in which injection attacks are found? 1
Question State the similarities and differences between command injection and SQL injection attacks 1
Question What are the basic steps needed in the process of securing a system? 1
Question State different types of full virtualization with their security requirements. 1
Question List five essential characteristics of cloud computing. 1
Question List and briefly define three cloud service models. 1
Question Briefly explain the most prominent deployment models for cloud computing. 1
Question Describe some of the main cloud-specific security threats. 1
Question Investigate each of the unsafe standard C library functions shown in the figure using the UNIX man pages or any C programming text, and determine a safer alternative to use. 0
Question Investigate the use of a replacement standard C string library, such as Libsafe, bstring, vstr, or other. Determine how significant the required code changes are, if any, to use the chosen library. 0
Question Investigate the issues that arise while using sequence number as both identifier and authenticator of packets. Identify the root cause of the problem. 0
Question Investigate the various types of cross-site scripting (XSS) attacks. How can such attacks be prevented? 0
Question How can we use the TCP Wrappers and tcpd daemon to achieve secure remote control access? What if the network servers are heavily loaded? 0
Question Why is it important to secure the boot process? Is it required to limit which media the system must boot from? 0

Section 3

Activity Type Content Is Graded?
Question What are different types of cryptanalysis attacks? 1
Question Why do some block cipher modes of operation only use encryption while others use both encryption and decryption? 1
Question In the context of a hash function, what is a compression function? 1
Question Briefly explain Diffie-Hellman key exchange. 1
Question Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why? 0
Question Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption? 0
Question Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”
Will this checksum detect all errors caused by an odd number of error bits? Explain.
Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.
Comment on the effectiveness of this function for use as a hash function for authentication
0
Question It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible? 0

Section 4

Activity Type Content Is Graded?
Question What are different types of cryptanalysis attacks? 1
Question Why do some block cipher modes of operation only use encryption while others use both encryption and decryption? 1
Question In the context of a hash function, what is a compression function? 1
Question Briefly explain Diffie-Hellman key exchange. 1
Question Suppose that your organization wants you to ensure the security of its data while the data is in transit. Which one out of stream cipher and block cipher would you select and why? 0
Question Can we perform encryption operations in parallel on multiple blocks of plaintext in any of the five modes? How about decryption? 0
Question Consider a 32-bit hash function defined as the concatenation of two 16-bit functions: XOR and RXOR, defined as “two simple hash functions.”
Will this checksum detect all errors caused by an odd number of error bits? Explain.
Will this checksum detect all errors caused by an even number of error bits? If not, characterize the error patterns that will cause the checksum to fail.
Comment on the effectiveness of this function for use as a hash function for authentication
0
Question It is possible to use a hash function to construct a block cipher with a structure similar to DES. Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible? 0

Final assessment

Section 1

  1. Questions from previous two subsections can be used.

Section 2

  1. Questions from previous two subsections can be used.

Section 3

  1. Questions from previous two subsections can be used.

Section 4

  1. Questions from previous two subsections can be used.

The retake exam

Section 1

Section 2

Section 3

Section 4