CMPSCI 177: Computer Security and Privacy, Fall Quarter, 2013
Meeting Times
Lecture: Monday/Wednesday 2:00pm-3:15pm -- Phelps 1401
Discussion: Tuesday 5:00pm-5:50pm -- Phelps 3505
Instructor
Richard A. Kemmerer
2165 Harold Frank Hall
Phone: 893-4232
Email: kemm AT cs.ucsb.edu
Office Hours: Monday, Wednesday 3:30pm - 4:30pm. Other times by appointment
Teaching Assistant
Kyle MacNamara
Phelps 1413
Email: kyle AT cs.ucsb.edu
Office Hours:
Monday 12:00-1:00, Tuesday 9:00-10:00, Wednesday 12:00-1:00, Thursday 2:00-3:00, Friday: 4:00-5:00
Purpose
This course will analyze the technical difficulties of
producing secure computer information systems that
provide guaranteed controlled sharing.
Emphasis will be on software models and design.
Current systems and methods will be examined and critiqued.
The possible certification of such systems will also be investigated
Prerequisites
The prerequisites for this course are some familiarity with programming
languages and systems
and the courage to read
through some difficult-to-read technical papers.
The course prerequisite is CMPSC170.
Required Text
Introduction to Computer Security
by Matt Bishop
(or Computer Security: Art and Science by Matt Bishop)
Recommended Texts
Introduction to Computer Security
by Goodrich and Tamassia
Information Security Principles and Practice
by Mark Stamp
In addition, a collection of articles from the literature
and research papers
to read and discuss in class
will be available.
Seminar Topics
Threats: spoofing, browsing, leakage, confinement,
covert channels (storage and timing),
Trojan horse, virus, spyware,
aggregation, denial of service, and statistical inference.
Security Mechanisms: capabilities, access control lists,
discretionary and mandatory access control, authentication
mechanisms, inference controls.
Techniques: penetration analysis,
intrusion detection, risk analysis, and
information flow analysis (Threat Trees, Shared Resource Matrix, and
Covert Flow Trees).
Encryption: conventional and public key encryption, digital signatures,
DES, Clipper chip.
Authentication techniques: passwords, challenge-response, and biometrics.
Secure Operating Systems and Databases: reference monitor, security kernel,
Multics, PSOS, Data Secure Unix, KSOS, SCOMP, LOCK, and ASOS.
Network Security: cryptographic techniques,
firewalls, sniffers, and
network browsers.
Security Models: Bell-LaPadula, Clark-Wilson,
Take-Grant model, integrity model,
container model,
simple security, and *-property.
Electronic voting machine security.
Accreditation: DoD Computer Security Center and
the Trusted Computer System Evaluation Criteria (TCSEC),
European efforts and criteria (ITSEC),
The Common Criteria (CC),
and formal verification.
Course Requirements
There will be homework assignments, a midterm, and a final exam.
Final Exam
Monday December 9, 2013, 4:00pm - 7:00pm, Phelps 1401