Difference between revisions of "MSc: Security of systems and networks"

From IU
Jump to navigation Jump to search
(Created page with "= Security of systems and networks = * <span>'''Course name:'''</span> Security of systems and networks (SSN) * <span>'''Course number:'''</span> SNE-08 == Course character...")
 
 
(19 intermediate revisions by the same user not shown)
Line 9: Line 9:
 
=== Key concepts of the class ===
  
=== Key concepts of the class ===
   
−
* Network security
  
 
* Applied cryptography
  
* Applied cryptography
 
* Security protocols
  
* Security protocols
−
* Internet security
 +
* Network and Internet security
  +
* Authentication and Authorization
  +
* Software Security
   
 
=== What is the purpose of this course? ===
  
=== What is the purpose of this course? ===
   
  +
This course will cover the fundamentals of security, security protocols, and their
−
CIA course serves as kick-start for the security and network engineering Masters program. Before diving into the depth of the topics, the students must know preliminary concepts related to computer networks services and applications therein. This course is designed to cover the basic services offered by the Internet including operating systems and computer architecture. The concepts from this course will be used throughout the course of whole masters. More precisely, this course will cover the basic computer architecture and assembly language programming, Domain Name Services (DNS), DNSSec, email, web, directories, and disks. This course will also cover protocols and ABNF. The theory part will strengthen the theoretical aspects of the concepts whereas the lab exercises will provide the students with the opportunity to have hands-on experience of the ideas they learnt in the lectures.
  
  +
applications in real-world. The topics covered in this course include applied
  +
cryptography, authentication, passwords, practical security, social aspects of
  +
security, SSL/TLS, email security, PKI, and IPSec. Furthermore, this course
  +
will strengthen the security knowledge of the students and guide them in the
  +
right direction for their upcoming research projects and advanced courses. The
  +
course is divided into two parts. The first part will cover the theory and hands-on practice of the concepts taught at class. And the second part of the course
  +
will focus on the course projects. The student will work on a security project
  +
by using the concepts taught in the class.
  +
   
 
== Prerequisites ==
  
== Prerequisites ==
  +
* No specific prerequisites are mandated.
−
* The course will benefit if students already know some of the following topics: Basics of TCP/IP networks: TCP/IP stack, transport protocols, application layer protocols, IP addressing, OSI -7 layer model
  
−
* Linux OS: architecture, system calls, ELF binary structure, networking and administration
 
−
* Shell Scripting: ability to work with the terminal as administrator and automatise tasks
  
   
 
== Recommendations for students on how to succeed in the course ==
  
== Recommendations for students on how to succeed in the course ==
 
References:
  
References:
  +
* Attend the lectures
−
* [https://www.linuxtopia.org/online_books/linux_for_beginners_index.html Linux for Beginners]
  
  +
* Read the lecture notes
−
* [https://www.linuxtopia.org/online_books/linux_kernel/kernel_configuration/index.html Linux Kernel and Architecture]
  
  +
* Read the related chapters in the book
−
* [https://www.linuxtopia.org/online_books/linux_network_administrators_guide/index.html Linux Administration and Networking]
  
−
* [https://www.shellscript.sh/ Shell Scripting]
  
−
* [https://cds.cern.ch/record/676686/files/0130384887_TOC.pdf Computer Networks]
  
   
−
== Course Objectives Based on Bloom’s Taxonomy ==
  
   
  +
* Attend and finish the labs
−
=== What should a student remember at the end of the course? ===
  
   
−
By the end of the course, the students should be able to:
  
   
  +
* Finish your assigned project successfully
−
* Identify different Internet applications and understand their working principles from the protocols point of view
  
−
* Demonstrate the acquired knowledge and skills in classical internet applications including DNS, Email, and Directory services.
  
−
* Able to write regular expressions and context-free grammar that are essential in Internet applications and information exchange through the networks
  
−
* Able to partition disks and remember the booting principles as well as secure booting
  
   
  +
== Course Objectives Based on Bloom’s Taxonomy ==
−
=== What should a student be able to understand at the end of the course? ===
  
   
  +
=== What should a student remember at the end of the course? ===
−
By the end of the course, the students should be able to describe and explain (with examples)
  
  +
  +
  +
By the end of the course, the students should be able to:
   
−
* Demonstrate knowledge and skills to use web services
 +
* Demonstrate the acquired knowledge and skills in applied cryptography (symmetric and asymmetric cryptography),
  +
* Operate classical enigma machine, encode and decode messages with it
−
* Demonstrate the essential knowledge of disks and calculate particular locations/addresses in disks
  
  +
* Demonstrate the working knowledge of famous cryptographic algorithms and discuss their shortcomings
−
* Reason about problems in the current DNS and the need to upgrade to DNSSEC and DNS over HTTPS
  
−
* Demonstrate the knowledge of email and other services configuration
 +
* Demonstrate and operate the already implemented security protocols over internet,
  +
* Reason about the problems in the security of networked systems and current internet and their existing solutions,
  +
* Solve mathematical problems (especially in number theory),
   
 
=== What should a student be able to apply at the end of the course? ===
  
=== What should a student be able to apply at the end of the course? ===
   
−
By the end of the course, the students should be able to apply the acquired knowledge in the following way.
 +
By the end of the course, the students should be able to apply:
   
  +
* Crypt-analyze ciphertext and decrypt through frequency analysis and other important techniques
−
* Install, Configure, update, and manage DNS services over a network
  
  +
* Design security protocols
−
* Configure, maintain, and update the secure DNS over a network
  
  +
* Find security flaws in security protocols
−
* Update, add, and delete records in DNS
  
  +
* Get hands-on experience of the existing enterprise cryptographic algorithms and use them in projects,
−
* Configure a secure mail server and maintain it
  
  +
* Demonstrate the skill of finding out security issues in networked systems and internet technologies,
−
* Get hands-on experience of the afore-mentioned technologies on their own servers.
  
   
 
=== Course evaluation ===
  
=== Course evaluation ===
  +
  +
The acquired knowledge will be evaluated via labs, a project, and the exam, with points as in the following table:
   
  +
{| class="wikitable" style="margin:auto"
−
<div id="tab:CIACourseGrading">
  
  +
|+
−  
−
{|
  
−
|+ Course grade breakdown
  
−
!
  
−
!
  
−
!align="center"| '''Proposed points'''
  
 
|-
  
|-
  +
! Type of Evaluation !! Points
−
| Labs/seminar classes
  
−
| 20
  
−
|align="center"| 20
  
 
|-
  
|-
  +
| Labs/seminar classes || 30
−
| Lab tasks assessment
  
−
| 40
  
−
|align="center"| 40
  
 
|-
  
|-
  +
| Project || 35
−
| Exams
  
−
| 40
 +
|-
  +
| Exam || 35
−
|align="center"| 40
  
 
|}
  
|}
−  
−  
−
</div>
  
−
If necessary, please indicate freely your course’s features in terms of students’ performance assessment: None
  
   
 
=== Grades range ===
  
=== Grades range ===
   
  +
The grades will be given according to the following table:
−
<div id="tab:CIACourseGradingRange">
  
   
  +
{| class="wikitable" style="margin:auto"
−
{|
  
  +
|+
−
|+ Course grading range
  
−
!
  
−
!
  
−
!align="center"| '''Proposed range'''
  
 
|-
  
|-
  +
! Grade !! Range of points
−
| A. Excellent
  
−
| 90-100
  
−
|align="center"|
  
 
|-
  
|-
  +
| A. Excellent || 88-100
−
| B. Good
  
−
| 75-89
  
−
|align="center"|
  
 
|-
  
|-
−
| C. Satisfactory
 +
| B. Good || 77-87
−
| 60-74
  
−
|align="center"|
  
 
|-
  
|-
  +
| C. Satisfactory || 51-76
−
| D. Poor
  
−
| 0-59
 +
|-
  +
| D. Poor || 0-50
−
|align="center"|
  
 
|}
  
|}
−  
−  
−
</div>
  
−
If necessary, please indicate freely your course’s grading features: The semester starts with the default range as proposed in the Table [[#tab:CIACourseGradingRange|2]], but it may change slightly (usually reduced) depending on how the semester progresses.
  
   
 
=== Resources and reference material ===
  
=== Resources and reference material ===
   
 
* Lecture slides
  
* Lecture slides
−
* RFCs
 +
* Book
−
* Link to the online material will be provided (if any)
 +
* Links to the online material will be provided (if any)
   
 
== Course Sections ==
  
== Course Sections ==
Line 129: Line 111:
 
The main sections of the course and approximate hour distribution between them is as follows:
  
The main sections of the course and approximate hour distribution between them is as follows:
   
  +
{| class="wikitable" style="margin:auto"
−
{|
  
−
|+ Course Sections
 +
|+
−
!align="center"| '''Section'''
  
−
! '''Section Title'''
  
−
!align="center"| '''Teaching Hours'''
  
 
|-
  
|-
  +
! Section !! Section Title !! Teaching Hours
−
|align="center"| 1
  
−
| Intro, Booting, Operating Systems Essentials, and Computer Architecture
  
−
|align="center"| 8
  
 
|-
  
|-
  +
| 1 || Cryptography || 40%
−
|align="center"| 2
  
−
| DNS, DNSSEC, DoH
  
−
|align="center"| 14
  
 
|-
  
|-
  +
| 2 || Access Control || 25%
−
|align="center"| 3
  
−
| Email
  
−
|align="center"| 4
  
 
|-
  
|-
  +
| 3 || Protocols || 25%
−
|align="center"| 4
  
−
| ABNF, Deflating, Directory Services, Disks, Web, and Protocols
  
−
|align="center"| 12
  
 
|-
  
|-
  +
| 4 || Software || 10%
−
|align="center"| 5
  
  +
|-
−
| Labs
  
  +
| 5 || Labs|| 24h
−
|align="center"| 56
  
  +
|-
  +
| 6 || Project|| 32h
 
|}
  
|}
   
−
=== Section 1 ===
 +
=== Section 1 title: ===
   
  +
Cryptography
−
=== Section title: ===
  
−  
−
Booting, Operating Systems, and Computer Architecture
  
   
 
=== Topics covered in this section: ===
  
=== Topics covered in this section: ===
   
  +
−
* Booting principles and disks
  
−
* Essentials of operating systems
 +
* Basics of Crypto
  +
* Symmetric Key Crypto
−
* Fundamentals of computer architecture
  
  +
* Public Key Crypto
  +
* Hash Functions
   
 
=== What forms of evaluation were used to test students’ performance in this section? ===
  
=== What forms of evaluation were used to test students’ performance in this section? ===
  +
−  
−
<div class="tabular">
 +
{| class="wikitable" style="margin:auto"
  +
|+
−  
  +
|-
−
<span>|a|c|</span> &amp; '''Yes/No'''<br />
  
  +
! Form !! Yes/No
−
Development of individual parts of software product code &amp; 0<br />
  
  +
|-
−
Homework and group projects &amp; 1<br />
  
  +
| Development of individual parts of software product code || No
−
Midterm evaluation &amp; 0<br />
  
  +
|-
−
Testing (written or computer based) &amp; 1<br />
  
  +
| Homework and group projects || Yes
−
Reports &amp; 1<br />
  
  +
|-
−
Essays &amp; 0<br />
  
  +
| Midterm evaluation || No
−
Oral polls &amp; 0<br />
  
  +
|-
−
Discussions &amp; 1<br />
  
  +
| Testing (written or computer based) || Yes
−  
  +
|-
  +
| Reports || Yes
  +
|-
  +
| Essays || No
  +
|-
  +
| Oral polls || No
  +
|-
  +
| Discussions || Yes
  +
|}
   
   
−
</div>
  
 
=== Typical questions for ongoing performance evaluation within this section ===
  
=== Typical questions for ongoing performance evaluation within this section ===
   
−
# What are the different steps in booting?
 +
# What are typical classic crypto methods?
  +
# What are the differences in stream and block ciphers from performance standpoint?
−
# How the disks are partitioned?
  
  +
# How to measure the security of cryptographic algorithms?
−
# Explain UEFI booting
  
  +
# How to encrypt and decrypt with different asymmetric crypto algorithms?
  +
# How to embedd backdoors in crypto algorithms?
  +
# How to realize key exchange through Hiffie-Hellman using traditional techniques and elliptic curve techniques?
  +
# How to make security algorithms efficient?
   
 
=== Typical questions for seminar classes (labs) within this section ===
  
=== Typical questions for seminar classes (labs) within this section ===
   
  +
# Make enigma machine with pringle box
−
# Demonstrating the knowledge of booting
  
  +
# Assess the security of different setups of RSA
−
# Analyze assembly code at a basic level
  
  +
# Implement man in the middle attack
−
# Demonstrate the system and library calls in operating systems
  
  +
# Implement addition over elliptic curves
  +
# Solve crypto math problems
   
 
=== Test questions for final assessment in this section ===
  
=== Test questions for final assessment in this section ===
Line 201: Line 188:
 
# Same as above
  
# Same as above
   
−
=== Section 2 ===
 +
=== Section 2 title: ===
   
  +
Access Control
−
=== Section title: ===
  
−  
−
DNS, DNSSEC, and DoH
  
   
 
=== Topics covered in this section: ===
  
=== Topics covered in this section: ===
   
  +
* Authentication
−
* DNS
  
  +
* Authorization
−
* DNSSEC
  
−
* DoH
  
   
 
=== What forms of evaluation were used to test students’ performance in this section? ===
  
=== What forms of evaluation were used to test students’ performance in this section? ===
   
−
<div class="tabular">
 +
{| class="wikitable" style="margin:auto"
  +
|+
  +
|-
  +
! Form !! Yes/No
  +
|-
  +
| Development of individual parts of software product code || No
  +
|-
  +
| Homework and group projects || Yes
  +
|-
  +
| Midterm evaluation || No
  +
|-
  +
| Testing (written or computer based) || Yes
  +
|-
  +
| Reports || Yes
  +
|-
  +
| Essays || No
  +
|-
  +
| Oral polls || No
  +
|-
  +
| Discussions || Yes
  +
|}
   
−
<span>|a|c|</span> &amp; '''Yes/No'''<br />
  
−
Development of individual parts of software product code &amp; 0<br />
  
−
Homework and group projects &amp; 1<br />
  
−
Midterm evaluation &amp; 0<br />
  
−
Testing (written or computer based) &amp; 1<br />
  
−
Reports &amp; 1<br />
  
−
Essays &amp; 0<br />
  
−
Oral polls &amp; 0<br />
  
−
Discussions &amp; 1<br />
  
   
−  
−  
−
</div>
  
 
=== Typical questions for ongoing performance evaluation within this section ===
  
=== Typical questions for ongoing performance evaluation within this section ===
   
  +
# What are pros and cons of using symmetric and asymmetric cryptographic mechanisms for authentication?
−
# Hows does DNS query get resolved?
  
−
# What is iterative and recursive DNS server?
 +
# What is man in the middle attack?
  +
# Develop home-grown authentication mechanisms?
−
# How does wildcard work in DNS?
  
  +
# How Kerberos reduces the communication overhead?
−
# What is zone walking in secure DNS?
  
−
# What is delegation in DNS?
 +
# Where is shibboleth used?
−
# What is NSEC and NSEC3 records in DNSSEC?
  
−
# What is the difference between DNSSEC and DoH?
  
   
 
=== Typical questions for seminar classes (labs) within this section ===
  
=== Typical questions for seminar classes (labs) within this section ===
   
  +
# Implement different variants of authentication protocols
−
# Configure DNS, DNSSEC, and DoH (with specific tasks)
  
  +
# Find out security flaws in authentication protocols
  +
# Identify shortcomings of different protocols
   
 
=== Test questions for final assessment in this section ===
  
=== Test questions for final assessment in this section ===
   
  +
# Same as above
−
# How does DNS query get resolved in DNS?
  
−
# How zones are formed?
  
−
# How delegation works in DNS?
  
−
# How resource records are verified in DNSSEC?
  
−
# What is meant by zone walking and how is it avoided?
  
−
# Why do we need DNSSEC where we can use simple DNS over HTTPS?
  
−  
−
=== Section 3 ===
  
   
−
=== Section title: ===
 +
=== Section 3 title: ===
   
  +
Protocols
−
Email
  
   
 
=== Topics covered in this section: ===
  
=== Topics covered in this section: ===
   
  +
* Simple Authentication Protocols
−
* Email architecture
  
  +
* Real-World Security Protocols
−
* Spam management
  
   
 
=== What forms of evaluation were used to test students’ performance in this section? ===
  
=== What forms of evaluation were used to test students’ performance in this section? ===
   
−
<div class="tabular">
  
   
  +
{| class="wikitable" style="margin:auto"
−
<span>|a|c|</span> &amp; '''Yes/No'''<br />
  
  +
|+
−
Development of individual parts of software product code &amp; 0<br />
  
  +
|-
−
Homework and group projects &amp; 1<br />
  
  +
! Form !! Yes/No
−
Midterm evaluation &amp; 0<br />
  
  +
|-
−
Testing (written or computer based) &amp; 1<br />
  
  +
| Development of individual parts of software product code || No
−
Reports &amp; 1<br />
  
  +
|-
−
Essays &amp; 0<br />
  
  +
| Homework and group projects || Yes
−
Oral polls &amp; 0<br />
  
  +
|-
−
Discussions &amp; 1<br />
  
  +
| Midterm evaluation || No
  +
|-
  +
| Testing (written or computer based) || Yes
  +
|-
  +
| Reports || Yes
  +
|-
  +
| Essays || No
  +
|-
  +
| Oral polls || No
  +
|-
  +
| Discussions || Yes
  +
|}
   
   
−  
−
</div>
  
 
=== Typical questions for ongoing performance evaluation within this section ===
  
=== Typical questions for ongoing performance evaluation within this section ===
   
  +
# How does SSL and TLS work?
−
# What are different protocols used in email?
  
  +
# HOw does SSL and TLS combine symmetric and asymmetric cryptography?
−
# What are the different agents used in email system?
  
  +
# Why IPSec is so over-engineered? and what are the security flaws?
−
# How to avoid spamming in email?
  
  +
# What are different components of IPSec
−
# How to configure email servers?
  
   
 
=== Typical questions for seminar classes (labs) within this section ===
  
=== Typical questions for seminar classes (labs) within this section ===
   
  +
# Implement IPSec
−
# Configure email server
  
  +
# Assess the security of SSL and TLS handshakes
−
# Configure anti-spamming techniques
  
   
 
=== Test questions for final assessment in this section ===
  
=== Test questions for final assessment in this section ===
   
  +
# Same as above
−
# What are different agents and their roles in email architecture?
  
−
# How MX records work?
  
−
# How to configure different anti-spamming policies?
  
   
−
=== Section 4 ===
 +
=== Section 4 title: ===
   
  +
Software
−
=== Section title: ===
  
−  
−
Directory, Web, Protocol, ABNF and Deflating
  
   
 
=== Topics covered in this section: ===
  
=== Topics covered in this section: ===
   
  +
* Software Flaws and Malware
−
* Directory services
  
  +
* Insecurity in Software
−
* Web
  
  +
* Operating Systems and Security
−
* Protocols
  
−
* ABNF
  
−
* Deflating
  
   
 
=== What forms of evaluation were used to test students’ performance in this section? ===
  
=== What forms of evaluation were used to test students’ performance in this section? ===
   
−
<div class="tabular">
  
−  
−
<span>|a|c|</span> &amp; '''Yes/No'''<br />
  
−
Development of individual parts of software product code &amp; 0<br />
  
−
Homework and group projects &amp; 1<br />
  
−
Midterm evaluation &amp; 0<br />
  
−
Testing (written or computer based) &amp; 1<br />
  
−
Reports &amp; 1<br />
  
−
Essays &amp; 0<br />
  
−
Oral polls &amp; 0<br />
  
−
Discussions &amp; 1<br />
  
   
  +
{| class="wikitable" style="margin:auto"
  +
|+
  +
|-
  +
! Form !! Yes/No
  +
|-
  +
| Development of individual parts of software product code || No
  +
|-
  +
| Homework and group projects || Yes
  +
|-
  +
| Midterm evaluation || No
  +
|-
  +
| Testing (written or computer based) || Yes
  +
|-
  +
| Reports || Yes
  +
|-
  +
| Essays || No
  +
|-
  +
| Oral polls || No
  +
|-
  +
| Discussions || Yes
  +
|}
   
−  
−
</div>
  
 
=== Typical questions for ongoing performance evaluation within this section ===
  
=== Typical questions for ongoing performance evaluation within this section ===
   
  +
# Why is software as important to security as crypto, access control, protocols?
−
# How directory services are implemented?
  
  +
# If your software is subject to attack, can your security can be broken Regardless of strength of crypto, access control, or protocols? Why?
−
# How permissions are set?
  
  +
# What are the main factors of software that compromise the security of systems?
−
# How disk partitions are made?
  
−
# How different web protocols work?
  
−
# How network packets are management in a standard way through ABNF?
  
−
# How to write new formats through ABNF?
  
−  
−
=== Typical questions for seminar classes (labs) within this section ===
  
   
  +
−
# Implement different web services
  
−
# Configure active directory
  
   
 
=== Test questions for final assessment in this section ===
  
=== Test questions for final assessment in this section ===

Latest revision as of 19:24, 20 December 2022

Security of systems and networks

  • Course name: Security of systems and networks (SSN)
  • Course number: SNE-08


Course characteristics

Key concepts of the class

  • Applied cryptography
  • Security protocols
  • Network and Internet security
  • Authentication and Authorization
  • Software Security

What is the purpose of this course?

This course will cover the fundamentals of security, security protocols, and their applications in real-world. The topics covered in this course include applied cryptography, authentication, passwords, practical security, social aspects of security, SSL/TLS, email security, PKI, and IPSec. Furthermore, this course will strengthen the security knowledge of the students and guide them in the right direction for their upcoming research projects and advanced courses. The course is divided into two parts. The first part will cover the theory and hands-on practice of the concepts taught at class. And the second part of the course will focus on the course projects. The student will work on a security project by using the concepts taught in the class.


Prerequisites

  • No specific prerequisites are mandated.

Recommendations for students on how to succeed in the course

References:

  • Attend the lectures
  • Read the lecture notes
  • Read the related chapters in the book


  • Attend and finish the labs


  • Finish your assigned project successfully

Course Objectives Based on Bloom’s Taxonomy

What should a student remember at the end of the course?

By the end of the course, the students should be able to:

  • Demonstrate the acquired knowledge and skills in applied cryptography (symmetric and asymmetric cryptography),
  • Operate classical enigma machine, encode and decode messages with it
  • Demonstrate the working knowledge of famous cryptographic algorithms and discuss their shortcomings
  • Demonstrate and operate the already implemented security protocols over internet,
  • Reason about the problems in the security of networked systems and current internet and their existing solutions,
  • Solve mathematical problems (especially in number theory),

What should a student be able to apply at the end of the course?

By the end of the course, the students should be able to apply:

  • Crypt-analyze ciphertext and decrypt through frequency analysis and other important techniques
  • Design security protocols
  • Find security flaws in security protocols
  • Get hands-on experience of the existing enterprise cryptographic algorithms and use them in projects,
  • Demonstrate the skill of finding out security issues in networked systems and internet technologies,

Course evaluation

The acquired knowledge will be evaluated via labs, a project, and the exam, with points as in the following table:

Type of Evaluation Points
Labs/seminar classes 30
Project 35
Exam 35

Grades range

The grades will be given according to the following table:

Grade Range of points
A. Excellent 88-100
B. Good 77-87
C. Satisfactory 51-76
D. Poor 0-50

Resources and reference material

  • Lecture slides
  • Book
  • Links to the online material will be provided (if any)

Course Sections

The main sections of the course and approximate hour distribution between them is as follows:

Section Section Title Teaching Hours
1 Cryptography 40%
2 Access Control 25%
3 Protocols 25%
4 Software 10%
5 Labs 24h
6 Project 32h

Section 1 title:

Cryptography

Topics covered in this section:

  • Basics of Crypto
  • Symmetric Key Crypto
  • Public Key Crypto
  • Hash Functions

What forms of evaluation were used to test students’ performance in this section?

Form Yes/No
Development of individual parts of software product code No
Homework and group projects Yes
Midterm evaluation No
Testing (written or computer based) Yes
Reports Yes
Essays No
Oral polls No
Discussions Yes


Typical questions for ongoing performance evaluation within this section

  1. What are typical classic crypto methods?
  2. What are the differences in stream and block ciphers from performance standpoint?
  3. How to measure the security of cryptographic algorithms?
  4. How to encrypt and decrypt with different asymmetric crypto algorithms?
  5. How to embedd backdoors in crypto algorithms?
  6. How to realize key exchange through Hiffie-Hellman using traditional techniques and elliptic curve techniques?
  7. How to make security algorithms efficient?

Typical questions for seminar classes (labs) within this section

  1. Make enigma machine with pringle box
  2. Assess the security of different setups of RSA
  3. Implement man in the middle attack
  4. Implement addition over elliptic curves
  5. Solve crypto math problems

Test questions for final assessment in this section

  1. Same as above

Section 2 title:

Access Control

Topics covered in this section:

  • Authentication
  • Authorization

What forms of evaluation were used to test students’ performance in this section?

Form Yes/No
Development of individual parts of software product code No
Homework and group projects Yes
Midterm evaluation No
Testing (written or computer based) Yes
Reports Yes
Essays No
Oral polls No
Discussions Yes


Typical questions for ongoing performance evaluation within this section

  1. What are pros and cons of using symmetric and asymmetric cryptographic mechanisms for authentication?
  2. What is man in the middle attack?
  3. Develop home-grown authentication mechanisms?
  4. How Kerberos reduces the communication overhead?
  5. Where is shibboleth used?

Typical questions for seminar classes (labs) within this section

  1. Implement different variants of authentication protocols
  2. Find out security flaws in authentication protocols
  3. Identify shortcomings of different protocols

Test questions for final assessment in this section

  1. Same as above

Section 3 title:

Protocols

Topics covered in this section:

  • Simple Authentication Protocols
  • Real-World Security Protocols

What forms of evaluation were used to test students’ performance in this section?

Form Yes/No
Development of individual parts of software product code No
Homework and group projects Yes
Midterm evaluation No
Testing (written or computer based) Yes
Reports Yes
Essays No
Oral polls No
Discussions Yes


Typical questions for ongoing performance evaluation within this section

  1. How does SSL and TLS work?
  2. HOw does SSL and TLS combine symmetric and asymmetric cryptography?
  3. Why IPSec is so over-engineered? and what are the security flaws?
  4. What are different components of IPSec

Typical questions for seminar classes (labs) within this section

  1. Implement IPSec
  2. Assess the security of SSL and TLS handshakes

Test questions for final assessment in this section

  1. Same as above

Section 4 title:

Software

Topics covered in this section:

  • Software Flaws and Malware
  • Insecurity in Software
  • Operating Systems and Security

What forms of evaluation were used to test students’ performance in this section?

Form Yes/No
Development of individual parts of software product code No
Homework and group projects Yes
Midterm evaluation No
Testing (written or computer based) Yes
Reports Yes
Essays No
Oral polls No
Discussions Yes

Typical questions for ongoing performance evaluation within this section

  1. Why is software as important to security as crypto, access control, protocols?
  2. If your software is subject to attack, can your security can be broken Regardless of strength of crypto, access control, or protocols? Why?
  3. What are the main factors of software that compromise the security of systems?


Test questions for final assessment in this section

  1. As above
Retrieved from "https://eduwiki.innopolis.university/index.php?title=MSc:_Security_of_systems_and_networks&oldid=7999"