Difference between revisions of "NPS CS4614 Summer 2014"

From Simson Garfinkel
Jump to navigationJump to search
m (Simson moved page CS4614 to NPS CS4614 Summer 2014)
 
(9 intermediate revisions by the same user not shown)
Line 251: Line 251:


==Week 8 (August 25): Hardware Security==
==Week 8 (August 25): Hardware Security==
* Brocker, Matthew; Checkoway, Stephen, [https://jscholarship.library.jhu.edu/handle/1774.2/36569 iSeeYou: Disabling the MacBook Webcam Indicator LED]
* Brocker, Matthew; Checkoway, Stephen, [https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/brocker iSeeYou: Disabling the MacBook Webcam Indicator LED], Usenix Security 2014
* Karl Koscher  et al, [http://www.autosec.org/pubs/cars-oakland2010.pdf Experimental Security Analysis of a Modern Automobile] IEEE Symposium on Security and Privacy, May 2010
* Karl Koscher  et al, [http://www.autosec.org/pubs/cars-oakland2010.pdf Experimental Security Analysis of a Modern Automobile] IEEE Symposium on Security and Privacy, May 2010
* Stephen Checkoway et al, [http://www.autosec.org/pubs/cars-usenixsec2011.pdf Comprehensive Experimental Analyses of Automotive Attack Surfaces], USENIX Security Sympsium, August 2011.
* Stephen Checkoway et al, [http://www.autosec.org/pubs/cars-usenixsec2011.pdf Comprehensive Experimental Analyses of Automotive Attack Surfaces], USENIX Security Symposium, August 2011.
 
==Week 9 (September 1): Formal Methods and Semi-Formal Bug Finding==
Special guest lecturer George Dinolt
* Lampson, B. W., "Protection," in Proc. Fifth Princeton Symposium on INformation Sciences and Systems, Princeton University, March 1971, pp. 437-443, reprinted in Operating Systems Review, 8,1, January 1974, pp. 18-24  http://www.simson.net/CS4614/p18-lampson.pdf
* A Symbiotic Relationship Between Formal Methods and Security, Wing, Jeannette M. , 1998, http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=798355  http://www.simson.net/CS4614/Wing98.pdf
* Model Checking An Entire Linux Distribution for Security Violations , Schwarz, Benjamin and Chen, Hao and Wagner, David and Lin, Jeremy and Tu, Wei and Morrison, Geoff and West, Jacob , ACSAC 2005, https://www.cs.berkeley.edu/~daw/papers/mops-full.pdf
 
==Week 10 (September 8): Quantum Computing and cryptography  ==
Special guest lecturer Ted Huffmire
* Scott Aaronson. The Limits of Quantum Computers. Scientific American, March 2008, Pages 62-69. http://www.cs.virginia.edu/~robins/The_Limits_of_Quantum_Computers.pdf
* Jeremy Hsu. D-Wave's Year of Computing Dangerously. IEEE Spectrum, Vol. 50, No. 12, December 2013, Pages 11-13. http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=6676982
* Nicolas Gisin, et al. Quantum Cryptography. Reviews of Modern Physics, Volume 74, Issue 1, 8 March 2002, Pages 145-195. http://journals.aps.org/rmp/abstract/10.1103/RevModPhys.74.145
 
==Week 11 (September 15): Electronic Voting==
*  ''Optional:' David Evans and Nathanael Paul, [http://www.cs.virginia.edu/~evans/pubs/sp-voting.html Election Security: Perception and Reality],  IEEE Security and Privacy, January-February 2004.
*  ''Optional:' [https://www.usenix.org/conference/evtwote14/workshop-program/presentation/michel A Systematic Approach to Analyzing Voting Terminal Event Logs], Laurent D. Michel, Alexander A. Shvartsman, and Nikolaj Volgushev, University of Connecticut, EVT/WOTE '14 San Diego, CA,  August 18-19 2014


==Week 9 (September 1): Electronic Voting==
* David Evans and Nathanael Paul, [http://www.cs.virginia.edu/~evans/pubs/sp-voting.html Election Security: Perception and Reality],  IEEE Security and Privacy, January-February 2004.
* Kohno et al, [http://avirubin.com/vote.pdf Analysis of an Electronic Voting System], IEEE Symposium on Security and Privacy 2004. IEEE Computer Society Press, May 2004
* ''Optional:'  [http://people.csail.mit.edu/rivest/voting/reports/2004-01-20%20RABA%20evaluation%20of%20Diebold%20AccuVote.pdf Trusted Agent Report Diebold AccuVote-TS Voting System], RABA Innovative Solution Cell (RiSC), Dr. Michael A. Wertheimer, Director
* ''Optional:'  [http://people.csail.mit.edu/rivest/voting/reports/2004-01-20%20RABA%20evaluation%20of%20Diebold%20AccuVote.pdf Trusted Agent Report Diebold AccuVote-TS Voting System], RABA Innovative Solution Cell (RiSC), Dr. Michael A. Wertheimer, Director
* ''Optional:'' Lamone, [http://www.elections.state.md.us/pdf/SBE_Response_Update_to_RABA_072204.pdf  Response to: Department of Legislative Services Trusted Agent Report on Diebold AccuVote-TS Voting System], July 22, 2004
* ''Optional:'' Lamone, [http://www.elections.state.md.us/pdf/SBE_Response_Update_to_RABA_072204.pdf  Response to: Department of Legislative Services Trusted Agent Report on Diebold AccuVote-TS Voting System], July 22, 2004
 
* ''Optional:'' Kohno et al, [http://avirubin.com/vote.pdf Analysis of an Electronic Voting System], IEEE Symposium on Security and Privacy 2004. IEEE Computer Society Press, May 2004
==Week 10 (September 8): Quantum Cryptography and Computing==
* Dave Bacon and Debbie Leung. [http://dl.acm.org/citation.cfm?id=1284648 Toward a World with Quantum Computers], Communications of the ACM, Vol. 50, No. 7, September 2007.
* Scott Aaronson [http://www.cs.virginia.edu/~robins/The_Limits_of_Quantum_Computers.pdf The Limits of Quantum Computers], Scientific American, 2008
* Hsu, [http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=6676982 D-Wave's Year of Computing Dangerously], Spectrum, IEEE , Volume 50, Issue 12, December 2013, 11 - 13
 
==Week 11 (September 15): The Future==
We will discuss the papers of the entire summer and put them into context


Please consider reading this paper:
Please consider reading this paper:
Line 274: Line 280:


==QUIZ #2: Due September 16==
==QUIZ #2: Due September 16==
===Other Quantum Computing Papers===
* Dave Bacon and Debbie Leung. [http://dl.acm.org/citation.cfm?id=1284648 Toward a World with Quantum Computers], Communications of the ACM, Vol. 50, No. 7, September 2007.
* Scott Aaronson [http://www.cs.virginia.edu/~robins/The_Limits_of_Quantum_Computers.pdf The Limits of Quantum Computers], Scientific American, 2008
* Hsu, [http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=6676982 D-Wave's Year of Computing Dangerously], Spectrum, IEEE , Volume 50, Issue 12, December 2013, 11 - 13


=Papers that didn't make the cut=
=Papers that didn't make the cut=

Latest revision as of 19:28, 28 April 2020

Naval Postgraduate School Summer 2014

CS4614: Advanced Topics in Computer Security (3-1) Faculty: Garfinkel

Syllabus

Contact Information

Course CLE: Sakai
Piazza: https://piazza.com/nps/summer2014/cs4614/home
Course Location: Google Hangouts (or VTC)
Instructor: Simson L. Garfinkel, Ph.D.
Phone: 202-649-0029
Internet e-mail: slgarfin
Website: http://www.simson.net
Informal TA Alan B.

Course Information

Course Goal

This course teaches students the seminal computer security papers of the past four decades. We use these papers to build graduate level knowledge and reasoning skills. We do this through reading and discussing the papers, both verbally and in writing. This pedagogical approach is constructivist, in that it encourages the students to develop their own viewpoints and conclusions.

Learning Outcomes

Upon successful completion of this course, you will be able to:

  • Read and understand an academic research paper on computer security.
  • Find the salient points of an academic research paper.
  • Present aspects of a security paper to your peers.
  • Find related papers.

Course Format

The course format is a reading and discussion seminar. Each week explores a central concept in computer security with three papers. The first class each week will be devoted to class management and previewing the week's papers. The second class will be a deep-dive on the papers. For the third class students will find follow-up papers, prepare discussions, and present those papers in class.

The course will have two open tests consisting of 20 questions drawn from the readings. The first test draws from the first half of the papers, while the second test draws from the second half.

Prerequisites

We assume that students are familiar with current best practices for administration and configuration of commercial products for the day-to-day processing of information. Particular emphasis is placed on research regarding the protection of high value data, the foundations of high assurance policy enforcement, and the uses of multilevel security.

Students must have graduate level abilities to research, organize and evaluate technical problems, and to participate in related discussions (e.g., speaking, explaining, querying, and active listening).

Assessment

Grades are calculated as follows:

Class participation: 40% (2-paragraph assignments and comments on other students)

Quiz #1: 30%

Quiz #2: 30%

When you write your 2-paragraph assignments, try to answer the "Five Reading Questions" that you have seen in other NPS courses:

0. What concern or question do you bring to the reading?
1. What are the author's main claims?
2. What grounding does the author offer for the claims?
3. What is the author's main motivation for doing this work?
4. What actions does the author recommend?
5. What opened or closed for you in this reading?

The purpose of the questions is to locate the author in the much larger network of human conversations. What is that author saying? Do you accept the claims? Why? Who influenced the author? What "school of thought" does the author belong to? Who did the author subsequently influence? Did the author settle any questions for you? Open new questions that you will pursue in the future?

The quizzes will be take-home quizzes administered via Sakai. There will one multiple-choice and one free-response question for each of the mandatory papers that we discussed. I will be drafting these quizzes as we read the papers.

Protocols

Communication is a central part of every course. This section of the syllabus describes what we expect from your communications with your fellow students and the course staff.

Notifications

For announcements and assignments, the course Piazza collaboration site is our authoritative form of communication. Students are expected to either check the Piazza website at least three times a week or sign up for e-mail alerts. If you miss an announcement, it should be on the Piazza site.

Homework

All homework is due on Friday of each week for the week that it is assigned. Late homework is not accepted except in extraordinary cases. It is our intent to have graded homework back to you by the following monday.

Class Participation

This is a seminar-style class. As such, class participation on the website is an important part of the experience.

Students will be given a "first half" class participation grade following the midterm examination, giving students a "heads up" on how they are doing while there is still an opportunity to make substantive improvements.

General protocols for Email and Discussion Forums

Although email and discussion forums may feel like talking, it's important to remember that they are written communication. You may feel the need to quickly respond to a message, but many minutes, hours, or even days may elapse between the time that you write something and the time it will be read. Therefore:

  • Before you send or post a message, take the time to read it through from beginning to end.
  • Please be sure to check your spelling, grammar, and punctuation. Avoid sending large blocks of text.
  • In general, avoid writing messages in UPPERCASE, as this makes your message hard to read and is impolite in modern electronic communications.

Discussion Forum Protocols

  • Participation is required. We will monitor both how many new threads you start and how often you respond to threads started by others. Both are required for full credit.
  • All online discussion must be civil. Feel free to dissect the idea presented by someone else, but do not attack the person.
  • Try to be concise in your messages.
  • Do not quote extensively from the works of others; post links instead.
  • If you do post a link, please write a few sentences that summarize it and present your opinion about the work. Do not simply post links; this does not count as participation in a discussion.
  • Remember, there are multiple copies made of everything that is posted in the discussion forum. There are copies on backup tapes, copies on every computer that accesses the forum, and potentially copies sent by email as well. Even though the intend the forum to be a "safe" space for academic discussions, remember that anything you write might well come back to haunt you.

Communication with Course Staff

  • All email directed to the course staff should be sent to the professor.
  • Email should only be used for personal matters; if you have a question about the content of the course that others would benefit from, please post it to the discussion forum.
  • Homework should not be submitted by email unless specifically requested by the course staff for a particular assignment.
  • Please obtain prior approval before sending email messages with attachments larger than 2MB.
  • We will strive to answer most mail within 24 hours; if you do not have a response within 48 hours, please resend your message.

Office Hours

Professor Garfinkel maintains regular office hours and is available at other times by appointment.


Schedule

  • July 7, 2014 --- Instruction Begins
  • Sept 1, 2014 --- Labor Day (no classes)
  • Sept 16, 2014 --- Last Day of Classes
  • Sept 18-19,2014 --- Final Exam

Week 1 (July 7): System Security

References (don't read)

Week 2 (July 14): Passwords

Week 3 (July 21): Encryption and PKI

Optional current stuff
optional historical stuff

Week 4 (July 28): Attacking Encryption

Week 5 (August 4): Mixnets and Tor

Note: Professor Garfinkel will be at the DFRWS Conference this week. There will be no FRIDAY class. Please take the quiz instead.

Save this for next week:

QUIZ #1 - Due August 8th

Week 6 (August 11): Usability

Students interested in usability are invited to read Professor Garfinkel's usability literature review at http://simson.net/work/hcisec-review.pdf

In week 6 we will be reading:

Week 7 (August 18): Software Security


See also

Week 8 (August 25): Hardware Security

Week 9 (September 1): Formal Methods and Semi-Formal Bug Finding

Special guest lecturer George Dinolt

Week 10 (September 8): Quantum Computing and cryptography

Special guest lecturer Ted Huffmire

Week 11 (September 15): Electronic Voting

Please consider reading this paper:

QUIZ #2: Due September 16

Other Quantum Computing Papers

Papers that didn't make the cut

Quantum Cryptography

Network

  • Detecting prefix hijackings in the internet with argus


Information Warfare

  • Lunt, Aggregation and Inference: Facts and Fallacies
  • Denning, A dialogue on Aggregation Problems

Common Criteria

  • Common Criteria for Information Technology Security Evaluation (specific readings will be identified)
  • Julian, Turning Security on Its Head

Secure Systems

  • Schell, Information Security: Science, Pseudoscience, and Flying Pigs
  • Denning, The Limits of Formal Security Models
  • Building Trust into a Multi-Level File System, Cynthia E. Irvine, Todd B. Acheson, and Michael Thompson, Gemini Computers

Mobile Hardware Vulnerabilities

Physics Principles and Computer Systems

Books

  • Gasser's Building a Secure Computer System (old, but also available online for free!),
  • Kaufman, Perlman and Speciner Network Security (perhaps aging too, but the humor always has me rolling on the floor, and so insightful),
  • Anderson Security Engineering (which I've never read all the way through; I keep trying to find an excuse to)

See Also