CEN 5410 Computer and Network Security

Last modified 2010.11.30 Instructor: Richard Newman

• Email address: nemo @ cise . ufl . edu
• Office: E346 CSE
• Phone: 352/450-3444/392-1200 sec'y
• Fax: 352/392-1220
• Office Hours : T 10:40-11:30, R 10:40-11:30, 5:00-6:00pm

Announcements

• Extra review session Tuesday 12/7 1:55 in EDGE Studio C (CSE-122) - email me questions or topics you want to review
• Read KPS 15 and 20.
• Answer to Exam 2 question 2b is now available.
• Turn in project by 12/8 4:55 pm
• Exam 3 Tuesday 12/7 in class; network security (cryptographic protocols, network vulnerabilities, attacks, controls)
• Turn in project by 12/8 4:55 pm
• Quiz 6 Thursday 12/2 (during regular class periods)
• Exam 2 Statistics: Mean=12.6, Stdev=4.5, Median=11
• Exam 2 Tuesday 11/9 KPS Ch 2-7, Pfl Ch 2 and 12, lectures - EDGE students will have until 4:00 pm 11/12 to return exam 2.
• Quiz 5 Tuesday 11/2 (during regular class periods)
• Extra taping session Tuesday 11/2 5th Period in EDGE Studio D (CSE-112)
• Exam 1 Statistics: Mean=17.8, Stdev=5.7, Median=19
• Exam 1 Scores available on Sakai now
• Exam 1 Thursday 10/7 KPS Ch 1, Pfl Ch 1, 3,4,5, lectures
• Quiz 3 Tuesday 10/5
• Seminar Fri 10/1 2:00 CSE-E404 "Information Assurance, Security, and Forensics," Adel Elmaghraby, Univ. of Louisville, KY.
• Read Pfleeger 4/e Ch. 5 (2/e Ch. 7), notes on Common Criteria
• Prepare a short description of your term project - submit via email by Tues. 9/28
• Quiz 2 Thursday 9/23
• Read Pfleeger 4/e Ch. 4 (2/e Ch. 6)
• Read Pfleeger 4/e Ch. 3 (2/e Ch. 5)
• Read KPS Ch. 1
• Read Pfleeger Ch. 1

Syllabus

EDGE Students EDGE students should refer to

Exam Info

Quiz Keys

Homework Info

Project Info

Powerpoint slides

Course Outline Topics

• Part I - Computer Security
  • Introduction - basic principles - security goals
  • intro (ps)
  • intro (pdf
    • Common Vulnerabilties and Exposures from Mitre
  • Program security
  • Program security (ps)
  • Program security (pdf
    • Vulnerability info from BugTraq
    • Word Macro Virus help from the University of South Carolina
  • Operating system security
  • Operating system security (ps)
  • Operating system security (pdf
    • Monthly counts of defacements for various OS's from Attrition
    • defacements for various OS's from Attrition
    • Windows 2000 Security Guides from NSA
  • Trusted operating systems
  • Trusted operating systems (ps)
  • Trusted operating systems (pdf)
    • Notes on the Common Criteria
    • Common Criteria
    • Cryptographic Traffic Analysis Prevention
  • Database Security - time permitting
• Part II - Cryptology
  • Steganography
    • a paper on effect of JPEG on image steganography
  • Basic cryptology
  • Basic cryptology (postscript) Basic cryptology (pdf)
    • IEEE Spectrum article on crypto
  • Symmetric cryptography
  • Symmetric cryptography (ps)
  • Symmetric cryptography (pdf)
  • Hashes and message digests
  • Hashes and message digests (postscript)
  • Hashes and message digests (pdf)
  • Asymmetric cryptography
  • Asymmetric cryptography (Postscript)
  • Asymmetric cryptography (PDF)
  • Secret Sharing and Key Escrow
  • Secret Sharing and Key Escrow (Postscript)
  • Secret Sharing and Key Escrow (PDF)
• Part III - Network Security
  • Cryptographic authentication & PKI
  • Network Cryptographic Protocols(ps)
  • Network Cryptographic Protocols(pdf)
  • Authentication website
  • Cryptographic protocols and practice - BAN Logic
    • DEC SRC TR-039: A Logic of Authentication (Postscript)
    • DEC SRC TR-039: A Logic of Authentication (PDF)
    • John Gordon's definitive biography of Alice and Bob (text)
  • Network & distributed system security
  • Network & distributed system security(PDF)
  • Electronic mail security(PDF)
  • Traffic Analysis Prevention(PDF)
  • Network Security Standards (PDF)
  • IP Security Option(PDF)
  • Firewalls and protocol vulnerabilities(PDF)
  • info paper on DDOS (PDF)
• Part IV - Other Topics in Security
  • Security QoS
    • a paper on security QoS
    • a paper on cost of SQoS
  • Security administration
  • Legal and ethical issues

Course Assignments

• CONTINUALLY UPDATED - VIEW OFTEN!
• Homeworks
• Exams
• Projects

Other Materials

• Slides on distributed authentication and authorization
• Powerpoint slides from previous edition of course
• DEC SRC TR-039: A Logic of Authentication
• DEC SRC TR-039-appendix: A Logic of Authentication Appendix
• DEC SRC TR-067: Authentication and Delegation with Smart-cards
• DEC SRC TR-070: A Calculus for Access Control in Distributed Systems
• DEC SRC TR-083: Authentication in Distributed Systems: Theory & Practice
• DEC SRC TR-117: Authentication in the Taos Operating System
• DEC SRC TR-125: Prudent Engineering Practice for Cryptographic Protocols

Interesting Security Sites

• NIST National Vulnerability Database
• Computer Security Division of NIST
• HIPAA Health Insurance Portability and Accountability Act of 1996
• Purdue COAST (Center for Operations, Audit and Security Technology) , which has since been subsumed by...
• Purdue CERIAS (Center for Education and Research in Information Assurance and Security)
• FIRST (the Internet guys in the white hats)
• IETF Security Area Working Groups
• CIPHER - Newsletter of the IEEE Computer Society's TC on Security and Privacy
• Counterpane's cryptogram archive site
• RSA Labs' site
• Amit Gandre's site for UF security interest group