Lectures

What do we want when we ask for “security”?

How do we think about adversaries and the threats they pose? What does “trust” mean in a security context? What do we have to trust?

How does software really run on a modern computer?

Smashing the stack with buffer overflows

The cat-and-mouse game between memory exploits and defences

Writing software without invalid memory accesses

How can we locate and eliminate memory safety violations?

An introduction to host security: processes, users and authorization

Mandatory Access Control: history and contemporary uses

Mandatory Access Control: history and contemporary uses

A high-level introduction to some important cryptographic basics

More modern cryptographic primitives with symmetric keys

Message authentication codes and cryptographic hash functions

Entropy, when it helps us understand password quality and when it doesn’t

Supplementing passwords with additional factors

Cryptography using asymmetric keys

Code signing and verification on various platforms

Sandboxing, capabilities and compartmentalization

Models, assumptions and fundamentals of networking

Models, assumptions and fundamentals of networking

Secure vs private messaging and its implications

The things between you and what you want to access

DNS, cache poisoning and DNSSEC

Networking without wires… though not without threats!

More efforts to private a network “like in the office”

Some key Web context: introduction, history and model

Getting around the same-origin policy, legitimately or illegitimately

Another example of input validation and how hard it can be

Authentication “as she is played” on the Web

Motivations and mechanisms for private browsing