Introduction to Security

Lecturer: Mr M.G. Kuhn (mgk25@cl.cam.ac.uk)

No. of lectures: 6

Prerequisite courses: Discrete Mathematics, Operating Systems

This course is a prerequisite for Distributed Systems (Part II and Diploma) and Security (Part II).

Aims

This course is a broad introduction to both computer security and cryptography. It covers important basic concepts and techniques.

Lectures

• Introduction. Application-specific security requirements, security management, targets and policies, privacy and data protection, computer misuse legislation, low-cost attack examples, patterns of failure.

• Operating system and network security. Discretionary access control in POSIX and Windows NT, elevated rights and setuid bits, auditing, mandatory access control policies, multi-level security systems, information flow control, covert channels, Clark/Wilson integrity, capabilities, trusted computing base, OS security functions, common implementation vulnerabilities, taxonomy of malicious software, TCP/IP vulnerabilities, address spoofing, firewalls, denial of service attacks, security evaluation methodology and standards, computer forensics. [2 lectures]

• Symmetric cryptography. Historic ciphers, Kerckhoffs' principles, Vernam cipher, properties of pseudo-random and secure hash functions, computational security, birthday paradox, block ciphers, Feistel and SP networks, modes of operation, message authentication codes.

• Authentication techniques. Biometrics, passwords, one-way and challenge-response authentication protocols, Needham-Schroeder, Kerberos, protocol failure examples, smartcards and RFID.

• Asymmetric cryptography. Number theory revisited, discrete logarithm problem, Diffie-Hellman key exchange, ElGamal encryption and signature, hybrid cryptography, key certificates and public key infrastructure.

Objectives

By the end of the course students should

• appreciate the range of different meanings that ``security'' has in different applications

• be familiar with the most common security terms and concepts

• have a basic understanding of the most commonly used attack techniques and protection mechanisms

• have gained basic insight into aspects of modern cryptography and its applications

Recommended books

Gollmann, D. (1999). Computer Security. Wiley.
Schneier, B. (1995). Applied Cryptography: Protocols, Algorithms, and Source in C. Wiley (2nd ed.).

Further reading:

Stinson, D. (2002). Cryptography - Theory and Practice. Chapman & Hall/CRC.
Anderson, R. (2001). Security Engineering: A Guide to Building Dependable Distributed Systems. Wiley.
Cheswick, W.R. & Bellovin, S.M. (1994). Firewalls and Internet Security: Repelling the Wily Hacker. Addison-Wesley (2nd ed.).
Garfinkel, S. & Spafford, G. (1996). Practical Unix and Internet Security. O'Reilly (2nd ed.).