SYLLABUS: Applied Security CIS-5930 Spring 2007 Tue./Thu. 2:00-3:15pm @ 103 LOVE BLDG or @016 LOVE BLDG (Lab meetings) CONTACT INFORMATION: Instructor: Breno de Medeiros, Assistant Professor 269 Love Bldg Office hours: Tue./Thu. 3:30-5:00pm Phone: (850) 645-2356 / Fax: (850) 644-0058 [email protected] http://www.cs.fsu.edu/~breno COURSE MATERIALS: Textbook: The course has no textbook. Printed materials, such as instructor notes, research papers, and other reading assignments will be posted in the website and/or distributed in hardcopy form during class meetings. Reading assignment materials will be distributed one week in advance. Data Structures and Algorithm Analysis in C++ (3rd edition), by M. A. Weiss. Addison-Wesley, ISBN-10: 032144146X & ISBN-13: 9780321441461 Suggested texts: Computer Security: Art & Science, by Matt Bishop. 1st edition. Addison-Wesley. Inside Network Perimeter Security, by Stephen Northcutt et al. 2nd edition. Sans Institute Press. Internet Denial of Service, Attack and Defense Mechanisms, by Jelena Mirkovich et al. Prentice Hall. Other Materials: Posted class slides & programming assignments. Class URL: http://www.cs.fsu.edu/~breno/CIS-5930/ COURSE DESCRIPTION: Topics • Secure host configuration (Unix and Windows servers) • Vulnerability analysis • Authentication mechanisms• Firewalls (static and dynamic) • Host and network intrusion detection systems • Application security issues • Web server security • Writing security policies COURSE OBJECTIVES: In this course, students will familiarize themselves with current and emerging threats to the security of computer systems and networks, including viruses, worms, network intrusion, and spam, and with techniques for the prevention, detection, and recovery from such attacks, such as firewalls, intrusion detection systems, secure coding practices and others. The approach is to study these attack and defense mechanisms in a systematic way. The goal is to lead the students to develop both practical and analytical skills to identify, and correct or mitigate threats in computer systems. The course time will be divided between lectures and lab activities. COURSE POLICIES: Class attendance is mandatory. While roll-call will not be used, the instructor will present solutions in class for the types of problems that will be argued in exams: Each class will include about 15 minutes of exam preparation, and there will be no specific class devoted to midterm review. Attendance of recitation sessions is also required. Pop-quizzes given in recitation sessions will account for 10% of the final grade. Lateness policy on assignments: No deadline extensions are allowed without a medical reason and proper written documentation provided by the Thagard Student Health Center, as per University policies. Assignments are due at 11:59pm on Fridays. Assignments late for 1 minute up to less than 24 hours will receive a 10% penalty. Assignments late for less than 48 hours (but for more than 24 hours) will be penalized 20%. Assignments later than 48 hours will be assigned a grade of 0, but still reviewed for correctness, with feedback provided. Make-up policy on exams: No make-up exams will be given without a medical reason and proper written documentation provided by the Thagard Student Health Center, as per University policy (see Student Handbook). Accommodations for missed exams for other reasons are possible within circumstances foreseen by University policies. Examples of situations where such accommodations can be made are for conflicts with religious observance practices and/or in cases involving bereavement due to the loss of a close relative. Students dealing with such a personal loss are urged to seek support from the University counseling center, and to contact all their instructors to prepare a comprehensive coping strategy (Individual Counseling Student Counseling Center, 2nd Floor, Student Life Building, 644-2003.). Policy on violations of the Academic Honor code: All programming assignments and exams are individual assignments. No cheating or plagiarism will be tolerated. Assignments where evidence of wrongdoing is conclusive willbe given a grade of 0, irrespective of correctness. In addition, students who actively seek to hurt the performance of other students by using the department/academic computing resources in any manner that is incompatible with the stated policies will be assigned a final grade of F for the course. Note of compliance with American with Disabilities Act: Students with disabilities who may require special accommodation with classes or exams should register with the Student Disability Resource Center (SDRC), and bring a letter from the SDRC to the instructor indicating their needs. This should be done within the first week of class. The instructor is personally committed to provide opportunities for students with disabilities to achieve their potential, and such students are encouraged to provide suggestions on how their learning may be facilitated. GRADING/EVALUATION: A: 91-100 A-: 89, 90 B: 79 – 88 (B+ and B- are assigned within this range based on both grades and student participation/attendance) C: 70 – 78 (C+ and C- are assigned within this range based on both grades and student participation/attendance) D: 59 – 69 F: 0 - 58 ASSIGNMENTS/RESPONSIBILITIES: Previous knowledge: • Operating systems • Concepts of networks and/or network administration If you are not sure whether you have the necessary skills for the course, contact the instructor during the 1st week of classes. Programming Assignments - 40% of total grade Exams - 20% of total grade Midterm Exam 1 - 10% Thursday, February 15, 2:00 to 3:15pm, in regular classroom. Final Exam - 10% Monday, April 23, 10:00- 12:00 noon, in regular classroom. Course project - 40%, divided into components:• Project proposal: A 4-page document including a description of planned work, a review of related references, and a list of tools and skills required for implementation. A minimum of 8 citations (each reviewed within the body of the proposal) is required. 10%. • Project presentation in class: A powerpoint presentation of the project proposal, to last 15