Computer System Security schedule

Introduction

Handouts: Protection (Not required reading, but may be a useful reference), Why chosen ciphertext security matters.

Building systems with cryptography

Read: Password authentication,
Prudent Engineering Practice (PS version).

Handout: Client Authentication on the Web.

Key management & User authentication

Read: Certificate Chain Discovery,
Kerberos.

Handout: Self-certifying file system.

Information flow & Mandatory Access Control

Read: Orange book (skim this),
JIF,
VMM security kernel.

Secure operating systems

Read: TAOS (PS version),
flask.

Handout: KeyKOS.

"Trusted" Computing/Midterm Review

Read: XOM,
Terra.

Handout: AEGIS, (PS Version).

Software Bugs

Read: Detection of buffer overruns,
Inferring errors in systems code,
Address space randomization.

Safety

Read: Software fault isolation,
Proof carrying code,
Security Architectures for Java,
Java security.

Dealing with compromise

Read: Byzantine fault tolerance.

Handouts: SFSRO,
SUNDR.

Network Security

Read: Listen and Whisper.

Handout: TCP attack,
DNS attack,
Denial of service.

Worms

Read: Dynamic Taint Analysis.

Handout: Code Red,
Autograph.

Anonymity and Privacy

Read: Crowds.

Handout: nym.alias.net,
Infranet,
Mix-nets,
DC-nets.

Other System Failures/Final review

Read: Electronic Voting,
SSH timing.

Handout: Why Cryptosystems Fail.