Content
This course motivates the need for computer security and introduces central concepts of computer security such as security objectives, threats, threat analysis, security policy and mechanism, assumptions and trust, and assurance.
We discuss authentication mechanisms, followed by various security models and show which security related questions can be answered in these models. The models we discussed include the Access Control Matrix Model, the Take-Grant Protection Model, the Bell-LaPadula and related models, the Chinese Wall Model, the Lattice Model of Information Flow.
Subsequently, we cover principles of security architectures and go through design approaches for secure systems e.g., capability based systems and hardware rotection mechanism concepts such as protection rings. Based on the learned, we may look at selected case studies of existing systems.
In the remainder of the course, we cover exploitation techniques for specific implementation vulnerabilities such as race conditions, stack and heap overflows, integer overflows, and return oriented programming. We continue with a discussion of insider threats, insider recruitment and social engineering attacks.
If time permits, we continue to look at the problems that arise when humans interface with security e.g., password habits and password entry mechanisms, human responses to security prompts, incentives and distractors for better security, or reverse Turing tests.