CEN 5410 Computer and Network Security

Last modified 2013.11.21

Instructor: Richard Newman

• Email address: nemo @ cise . ufl . edu
• Office: E346 CSE
• Phone: 352/505-1579/392-1200 sec'y
• Fax: 352/392-1220
• Office Hours : TR 10:30-11:30 and 2:00-3:00

Announcements

• No in-class Exam 3 - rather an online version will be given, with some essay questions.
• Read Stallings Ch. 23 - Firewalls
• Read Stallings Ch. 22 - Intruders
• Read Stallings Ch. 20 - IPSec
• Read Stallings Ch. 16
• Read Stallings Ch. 15
• Read Pfleeger Ch. 7
• Exam 2 covering Pfleeger Ch 2, Stallings Ch 2-12 will be held Tuesday 11/26/13

  same format and instructions as Exam 1 (e.g., 1 8.5x11 crib sheet allowed)

• Extra sessions - 10th period (4:05) in Studio B

  tentative schedule (the closer, the more definite)

  • Wed. 11/13 - Exam 1 review
  • Mon. 11/18 - Ch. 4 - Finite groups
  • Wed. 11/20 - Ch. 8 - Number Theory
  • Mon. 11/25 - if needed, maybe Ch. 10 - Other PKCS
• Read Stallings Ch. 14
• Read Stallings Ch. 13
• Read Stallings Ch. 12
• Read Stallings Ch. 11
• Read Stallings Ch. 9
• Read Stallings Ch. 7
• Read Stallings Ch. 6
• Read Stallings Ch. 5
• Read Stallings Ch. 3
• Read Stallings Ch. 2 (wait on Ch. 1 until later)
• Now read Pfleeger Ch. 2 on crypto
• Chi Sigma IO meeting - Saturday 12 Oct at 11:00 in MCCA 2186. Guest speaker is Rich Coleman, "Careers in National Security". All are welcome.
• Exam 1 on 10 Oct 2013 in class; covers computer security (Ch. 1,3,4 and class notes)
• Read Pfleeger Ch. 4
• Read Pfleeger Ch. 3
• Skip Pfleeger Ch. 2 for now
• Read Pfleeger Ch. 1

Syllabus

EDGE Students EDGE students should refer to

Exam Info

Quiz Keys

Homework Info

Project Info

Powerpoint slides

Course Outline Topics

• Part I - Computer Security
  • Introduction - basic principles - security goals
  • intro (ps)
  • intro (pdf
    • Common Vulnerabilties and Exposures from Mitre
  • Program security
  • Program security (ps)
  • Program security (pdf
    • Vulnerability info from BugTraq
    • Word Macro Virus help from the University of South Carolina
  • Operating system security
  • Operating system security (ps)
  • Operating system security (pdf
    • Monthly counts of defacements for various OS's from Attrition
    • defacements for various OS's from Attrition
    • Windows 2000 Security Guides from NSA
  • Trusted operating systems
  • Trusted operating systems (ps)
  • Trusted operating systems (pdf)
    • Notes on the Common Criteria
    • Common Criteria
    • Cryptographic Traffic Analysis Prevention
  • Database Security - time permitting
• Part II - Cryptology
  • Steganography
    • a paper on effect of JPEG on image steganography
  • Basic cryptology
  • Basic cryptology (postscript) Basic cryptology (pdf)
    • IEEE Spectrum article on crypto
  • Symmetric cryptography
  • Symmetric cryptography (ps)
  • Symmetric cryptography (pdf)
  • Hashes and message digests
  • Hashes and message digests (postscript)
  • Hashes and message digests (pdf)
  • Asymmetric cryptography
  • Asymmetric cryptography (Postscript)
  • Asymmetric cryptography (PDF)
  • Secret Sharing and Key Escrow
  • Secret Sharing and Key Escrow (Postscript)
  • Secret Sharing and Key Escrow (PDF)
• Part III - Network Security
  • Cryptographic authentication & PKI
  • Network Cryptographic Protocols(ps)
  • Network Cryptographic Protocols(pdf)
  • Authentication website
  • Cryptographic protocols and practice - BAN Logic
    • DEC SRC TR-039: A Logic of Authentication (Postscript)
    • DEC SRC TR-039: A Logic of Authentication (PDF)
    • John Gordon's definitive biography of Alice and Bob (text)
  • Network & distributed system security
  • Network & distributed system security(PDF)
  • Electronic mail security(PDF)
  • Traffic Analysis Prevention(PDF)
  • Network Security Standards (PDF)
  • IP Security Option(PDF)
  • Firewalls and protocol vulnerabilities(PDF)
  • info paper on DDOS (PDF)
• Part IV - Other Topics in Security
  • Security QoS
    • a paper on security QoS
    • a paper on cost of SQoS
  • Security administration
  • Legal and ethical issues

Course Assignments

• CONTINUALLY UPDATED - VIEW OFTEN!
• Homeworks
• Exams
• Projects

Other Materials

• Slides on distributed authentication and authorization
• Powerpoint slides from previous edition of course
• DEC SRC TR-039: A Logic of Authentication
• DEC SRC TR-039-appendix: A Logic of Authentication Appendix
• DEC SRC TR-067: Authentication and Delegation with Smart-cards
• DEC SRC TR-070: A Calculus for Access Control in Distributed Systems
• DEC SRC TR-083: Authentication in Distributed Systems: Theory & Practice
• DEC SRC TR-117: Authentication in the Taos Operating System
• DEC SRC TR-125: Prudent Engineering Practice for Cryptographic Protocols

Interesting Security Sites

• NIST National Vulnerability Database
• Computer Security Division of NIST
• HIPAA Health Insurance Portability and Accountability Act of 1996
• Purdue COAST (Center for Operations, Audit and Security Technology) , which has since been subsumed by...
• Purdue CERIAS (Center for Education and Research in Information Assurance and Security)
• FIRST (the Internet guys in the white hats)
• IETF Security Area Working Groups
• CIPHER - Newsletter of the IEEE Computer Society's TC on Security and Privacy
• Bruce Schneier's site
• Schneier's infosec blog
• RSA Labs' site
• Attrition web site
• UF stego site
• Amit Gandre's site for UF security interest group