Lectures

Lecture content will be posted here. I will also try to post PDF versions for your note-taking purposes.

Goals
What do we want when we ask for “security”?
Adversaries, abstraction and trust
What makes computer security special
Software
How does software really run on a modern computer?
Stack smashing
Smashing the stack with buffer overflows
Control-flow hijacking
The cat-and-mouse game between memory exploits and defences
Code-reuse attacks
Writing software without invalid memory accesses
Memory safety
Writing software without invalid memory accesses
Finding memory unsafety
How can we locate and eliminate memory safety violations?
Host security
An introduction to host security: processes, users and authorization
DAC and MAC
Mandatory Access Control: history and contemporary uses
Cryptography
A high-level introduction to some important cryptographic basics
Symmetric-key ciphers
More modern cryptographic primitives with symmetric keys
Modes, MACs and hashes
Block cipher modes, message authentication codes and cryptographic hash functions
Passwords
Hashing passwords. What makes a good password?
Secondary authentication
Supplementing passwords with additional factors
Compartmentalization
Sandboxing, capabilities and compartmentalization
Public-key cryptography
Cryptography using asymmetric keys
Code signing
Code signing and verification on various platforms
Network security
Models, assumptions and fundamentals of networking
Security protocols
Models, assumptions and fundamentals of networking
Private messaging
Secure vs private messaging and its implications
Middleboxes
The things between you and what you want to access
DNS security
DNS, cache poisoning and DNSSEC
Wi-Fi security
Networking without wires… though not without threats!
Virtual private networks
More efforts to private a network “like in the office”
Web security
Some key Web context: introduction, history and model
Cross-site scripting
Getting around the same-origin policy, legitimately or illegitimately
SQL injection
Another example of input validation and how hard it can be
Web authentication
Authentication “as she is played” on the Web
Private browsing
Motivations and mechanisms for private browsing