CS513: System Security - Topic Outline

The outline below gives the topics to be covered in class this semester. We are hoping to cover alot of material. And there is some risk that we won't get through it all.

The outline also contains links to notes for past CS513 lectures. These scribed lecture notes are being offered solely on an "as is" basis --- what is actually covered in lecture this semester and the manner in which that material is presented may differ from these scribed lecture notes.

Suggested readings in our course textbooks are given in the outline within square brackets.

[P]	Charles Pfleeger. Security in computing. Prentice Hall, 1996.
[KPS]	Charlie Kaufman, Radia Perlman, and Mike Speciner. Network Security. Private Communication in a Public World. Prentice Hall, 1995.
[S]	Bruce Schneier. Applied Cryptography. Second Edition. Wiley, 1996.

Links are also given to other sources that expand upon the material that will be covered in lecture.

Entries in the outline prefixed by * are provided for students wishing to go beyond the anticipated scope of this semester's CS513 offering.

Note. Cornell University Policy restricts the use of these notes. In addition, these notes are copyright F.B. Schneider. All rights reserved.

Topic Outline

• Introduction [P chptr 1; Trust in Cyberspace chptrs 1 and 6.]
  • Problem scope: Threats and vulnerabilities
  • Design principles for secure systems

• Cryptography [P chptrs 2, 3 and 4.1-4.2; KPS chptrs 2 and 3]
  • Primitive cryptosystems
  • Symmetric key cryptosystems
    • Key distribution centers and Kerberos [KPS chptrs 7.7-8, 10, 11; IEEE Comm Article]
  • Public key cryptosystems
    • Public key infrastructure [KPS chptrs 7.7]
    • Certificates
  • Secret sharing [S 3.7]
    • Distributed services and replication management

• User Authentication [P chptr 6.5; chptr 8]
  • Passwords
  • Trusted paths and smartcards
  • Biometrics

• Controlling Access to Objects [P chptr 6.1-6.4]
  • Policy and Mechanism for Protected Subsystems
  • *Theory of Protection Matricies
  • Enforcement of Complete Mediation
  • Access Control Lists
  • Capabilities
    • Implementation by indirection
    • Implementation by sparse name space
    • Revocation and Review
  • Delegation in Distributed Systems

• Application-Dependent Security Policies and Enforcement [P chptrs 7.1-7.4]
  • Discretionary (DAC) vs Mandatory Access Control (MAC) Policies
  • Commercial Security Policies
  • EM Class Policies
  • SFI Enforcement
  • Inlined Reference Monitors
  • Proof Carrying Code
  • *Security in Java

• Availability and Denial of Service

• Information Flow
  • Program analysis techniques
  • Covert channels [P chptr 5.2]

• Exostructure
  • Intrusion Detection
  • Virus Detection [P chptr 5.1; IBM Web page]
  • Firewalls [P chptr 9.5]