1. Introduction to Computer Security II
January 2019
Introduction to Computer Security II
COMP0055
Emiliano De Cristofaro

2. Welcome Format Assessment Office Hours
10x2h lectures per week (Thursday 10-noon, Roberts G08)
Week 1-5, 7-11 (week 6 is “reading week”)
10x2h lab sessions (Wednesdays 15-17, MPEB 1.21) with TAs (Srdjan & David)
Useful to both learn new skills and work on the coursework
Two shifts, every other week, A-L / M-Z
Assessment
70% closed-book exam (2.5 hours)
30% coursework, 3 practical assignments:
Network security (8 points), Web security (10 points), Software security (12 points)
Office Hours
Thursdays , MPEB 6.04
Moodle enrolment key: imahacker!

3. Course Aim From syllabus: In other words:
“Providing an advanced understanding of network and computer security vulnerabilities and countermeasures in real-world systems.”
In other words:
Gain a deep understanding of protocol/software vulnerabilities, and learn how to exploit/fix them
Only by “getting your hands dirty” you can become a security expert

4. Think as an attacker
One can't secure a system without being aware of ways to break it...
“You can’t make something secure if you don’t know how to break it.” (Marc Weber Tobias)
Schneier’s “Law”:
“Any person can invent a security system so clever that he or she can't imagine a way of breaking it.”
Caveat emptor!
The only reason we will be learning about attack techniques is to build better defenses
That is, don’t use this knowledge to perform attacks!!!

5. The importance of exploiting vulnerabilities
In class, we can only teach you how vulnerabilities work in theory Only by exploiting vulnerabilities in practice you will really understand them and learn how to prevent them For each coursework assignment, we will indicate the questions that you need to answer correctly to pass the coursework, but to become a complete security expert you should spend considerable time completing even the most difficult exercises – you will have 2-4 weeks to complete the assignments - Start early!

6. Ethics & Law Malicious hacking/cracking is illegal
Discussing vulnerabilities/how they are exploited is useful
E.g., for education, awareness, …
Full disclosure policy
The information about vulnerability has been already distributed to parties that may provide a solution to the problem (e.g., vendors)
See: Responsible vulnerability disclosure process (IETF Internet Draft)
Preventing similar mistakes from being repeated

7. Academic Conduct High standard expected in academic conduct:
Regulations on how to avoid plagiarism
Reference and credit sources appropriately
High standard expected in professional conduct:
Computer Misuse and Data Protection
Procedures for research with human subjects
Responsible research and disclosure procedures
Compliance and risk based assessments

8. Tentative List of Topics
Denial of service
MiTM/Spoofing
Network Security
Wireless Security
SQL, CSRF, XSS, Clickjacking
Android security
Windows security
Race Conditions
Malware
Memory corruption
Buffer overflows
Intrusion/Anomaly Detection
Firewalls

9. Textbooks
Pfleeger and Pfleeger. “Analyzing Computer Security: A Threat/Vulnerability/Countermeasure Approach” Dieter Gollmann. “Computer Security” Ross Anderson. “Security Engineering” Kaufman, Perlman, Speciner. “Network Security” Koziol, et al. “The Shellcoder’s Handbook” Mitnick. “The Art of Intrusion” Stallings. “Cryptography and Network Security”