CS 536: Advanced Information Assurance Concepts
Catalog Description: Cryptographic systems, coding and decoding of messages; network, database, and operating system security issues, capability and access-control mechanisms; current trends and research in mandatory and discretionary security policies. Additional projects/assignments reqd for grad cr.
Type: Technical Elective course for all Computer Science majors. Required course for Computer Science with Information Assurance emphasis majors.
Total Credits: 3
Course Coordinator: Michael Haney
URL: Course site is on Blackboard (http://bblearn.uidaho.edu/).
Prerequisites: CS 336: Introduction to Information Assurance, OR demonstrated knowledge of Information Assurance and Cybersecurity concepts and issues.
Textbook: None. Course material is based on academic publications and will be distributed via the course site on Blackboard.
Course Goals: The goal of this course is to engage students in critical thinking about information assurance issues, techniques, and challenges, through a review of seminal works in historical context. This course is will provide insight into the major issues of information assurance and information systems protection that have been the focus of research for the past 40+ years. We will conduct our studies by examining both seminal academic publications and recent case studies and, through group discussions and student presentations, try to understand how systems should be secured in theory and yet so often fail in practice.
In the process, students will learn how to organize their research and writing to create properly structured academic papers and organized bibliographies. Students will practice skimming, reading, and re-reading papers to develop understanding and critique others’ analysis, as well as determine paper pedigree, and thus begin to discriminate between original sources of high pedigree, quality secondary sources, and those which do not belong in works cited. This is a small but essential part of conducting quality IA research.
Modules, Topics, and Competencies
From the 2014 NSA/DHS List of Knowledge Units and Focus Areas, published September 2013:
- 1.4 Cyber Threats
- 1.5 Fundamental Security Design Principles
- 1.6 IA Fundamentals
- 1.7 Intro to Cryptography
- 1.8 IT System Components
- 1.10 Policy, Legal, Ethics, and Compliance
- 2.1 Databases
- 2.4 Operating Systems Concepts
- 3.6 Cyber Security Planning and Management’
- 3.22 IA Architectures
- 3.23 IA Compliance
- 3.47 Systems Certification and Accreditation
- 3.48 Systems Security Engineering
In lieu of a textbook, a selection of the following academic papers may be assigned. All of the items in this list may not be formally assigned readings. Nor is this list exhaustive of papers which may be assigned during the course of the semester. This is considered a good starting point for an essential reading list to support a thorough study of the subject of information assurance.
- Abadi, Martín, and Roger Needham. "Prudent engineering practice for cryptographic protocols." IEEE Transactions on Software Engineering 1 (1996): 6-15.
- Anderson, Ross, and Roger Needham. "Programming Satan's computer." In Computer Science Today, pp. 426-440. Springer Berlin Heidelberg, 1995.
- Anderson, Ross. "Why cryptosystems fail." In Proceedings of the 1st ACM Conference on Computer and Communications Security, pp. 215-227. ACM, 1993.
- Anderson, James P. “Computer security threat monitoring and surveillance.” Vol. 17. Technical Report, James P. Anderson Company, Fort Washington, Pennsylvania, 1980.
- Bell, D. Elliott, and Leonard J. LaPadula. “Secure computer systems: Mathematical foundations.” No. MTR-2547-VOL-1. MITRE Corp., Bedford, MA, 1973.
- Bell, David E., and Leonard J. LaPadula. "Computer security model: Unified exposition and multics interpretation." MITRE Corp., Bedford, MA, Tech. Rep. ESD-TR-75-306, June (1975).
- Bellovin, Steven M. "Security problems in the TCP/IP protocol suite." ACM SIGCOMM Computer Communication Review 19, no. 2 (1989): 32-48.
- Bellovin, Steven M. "A look back at Security problems in the TCP/IP protocol suite." In Computer Security Applications Conference, 2004. 20th Annual, pp. 229-249. IEEE, 2004.
- Blankenship, L, aka "The Mentor". "The conscience of a hacker.” Phrack magazine, 1 (7), phile 3 of 10. (1986).
- Burrows, Michael, Martin Abadi, and Roger M. Needham. "A logic of authentication." In Proceedings of the Royal Society of London A: Mathematical, Physical and Engineering Sciences, vol. 426, no. 1871, pp. 233-271. The Royal Society, 1989.
- Chaum, David L. "Untraceable electronic mail, return addresses, and digital pseudonyms." Communications of the ACM 24, no. 2 (1981): 84-90.
- Clark, David D., and David R. Wilson. "A comparison of commercial and military computer security policies." In Security and Privacy, 1987 IEEE Symposium on, pp. 184-184. IEEE, 1987.
- Denning, Dorothy E. "An intrusion-detection model." Software Engineering, IEEE Transactions on 2 (1987): 222-232.
- Diffie, Whitfield, and Martin E. Hellman. "New directions in cryptography." Information Theory, IEEE Transactions on 22, no. 6 (1976): 644-654.
- Dingledine, Roger, Nick Mathewson, and Paul Syverson. “Tor: The second-generation onion router.” Naval Research Lab. Washington DC, 2004.
- Douceur, John R. "The sybil attack." In Peer-to-peer Systems, pp. 251-260. Springer Berlin Heidelberg, 2002.
- Forrest, Stephanie, Steven Hofmeyr, Aniln Somayaji, and Thomas Longstaff. "A sense of self for unix processes." In Security and Privacy, 1996. Proceedings. 1996 IEEE Symposium on, pp. 120-128. IEEE, 1996.
- Froomkin, A. Michael. "The metaphor is the key: cryptography, the clipper chip, and the constitution." University of Pennsylvania Law Review (1995): 709-897.
- Goldwasser, Shafi, and Silvio Micali. "Probabilistic encryption." Journal of Computer and System Sciences 28, no. 2 (1984): 270-299.
- Grampp, Fred T., and Robert H. Morris. "The UNIX system: UNIX operating system security." AT&T Bell Laboratories Technical Journal 63, no. 8 (1984): 1649-1672.
- Harrison, Michael A., Walter L. Ruzzo, and Jeffrey D. Ullman. "Protection in operating systems." Communications of the ACM 19, no. 8 (1976): 461-471.
- Hofmeyr, Steven A., Stephanie Forrest, and Anil Somayaji. "Intrusion detection using sequences of system calls." Journal of Computer Security 6, no. 3 (1998): 151-180.
- Huang, Andrew. "Keeping secrets in hardware: The Microsoft Xbox(tm) case study." Cryptographic Hardware and Embedded Systems (CHES) 2523 (2002): 213-227.
- Karger, Paul A., and Roger R. Schell. "Multics security evaluation: Vulnerability analysis." HQ Electronic Systems Division: Hanscom AFB, MA. 1974.
- Karger, Paul, and Roger R. Schell. "Thirty years later: Lessons from the multics security evaluation." In Computer Security Applications Conference, 2002. Proceedings. 18th Annual, pp. 119-126. IEEE, 2002.
- Landwehr, Carl E., Alan R. Bull, John P. McDermott, and William S. Choi. "A taxonomy of computer program security flaws." ACM Computing Surveys (CSUR) 26, no. 3 (1994): 211-254.
- Lunt, Teresa F. "Automated audit trail analysis and intrusion detection: A survey." In Proceedings of the 11th National Computer Security Conference. 1988.
- Maconachy, W. Victor, Corey D. Schou, Daniel Ragsdale, and Don Welch. "A model for information assurance: An integrated approach." In Proceedings of the 2001 IEEE Workshop on Information Assurance and Security, vol. 310. New York, USA, 2001.
- Myers, Philip Alan. “Subversion: the neglected aspect of computer security.” Master’s Thesis. Naval Postgraduate School, Monterey, CA, 1980.
- Neumann, Peter G., Larry Robinson, Karl N. Levitt, R. S. Boyer, and A. R. Saxena. “A Provably Secure Operating System.” Stanford Research Institute (SRI). Menlo Park, CA, 1975.
- One, Aleph. "Smashing the stack for fun and profit." Phrack magazine 7, no. 49 (1996): 14-16.
- Ptacek, Thomas H., and Timothy N. Newsham. “Insertion, evasion, and denial of service: Eluding network intrusion detection.” Secure Networks, Inc. Calgary, Alberta, 1998.
- Paxson, Vern. "Bro: a system for detecting network intruders in real-time." Computer Networks 31, no. 23 (1999): 2435-2463.
- Provos, Niels, Dean McNamee, Panayiotis Mavrommatis, Ke Wang, and Nagendra Modadugu. "The ghost in the browser: analysis of web-based malware." In Proceedings of the First Workshop on Hot Topics in Understanding Botnets, USENIX, vol. 10, pp. 4-4. 2007.
- Raymond, Eric S. “The Cathedral & the Bazaar: Musings on linux and open source by an accidental revolutionary." O'Reilly Media, Inc., 2001.
- Saltzer, Jerome H., and Michael D. Schroeder. "The protection of information in computer systems." Proceedings of the IEEE 63, no. 9 (1975): 1278-1308.
- Saltzer, Jerome H. "Protection and the control of information sharing in Multics." Communications of the ACM 17, no. 7 (1974): 388-402.
- Sandhu, Ravi, and Pierangela Samarati. "Authentication, access control, and audit." ACM Computing Surveys (CSUR) 28, no. 1 (1996): 241-243.
- Sandhu, Ravi S., Edward J. Coyne, Hal L. Feinstein, and Charles E. Youman. "Role-based access control models." Computer 2 (1996): 38-47.
- Schneier, Bruce, and John Kelsey. "Secure audit logs to support computer forensics." ACM Transactions on Information and System Security (TISSEC) 2, no. 2 (1999): 159-176.
- Schneier, Bruce. "Attack trees." Dr. Dobb’s Journal 24, no. 12 (1999): 21-29.
- Spafford, Eugene H. "The Internet worm program: An analysis." ACM SIGCOMM Computer Communication Review 19, no. 1 (1989): 17-57.
- Steiner, Jennifer G., B. Clifford Neuman, and Jeffrey I. Schiller. "Kerberos: An Authentication Service for Open Network Systems." In USENIX Winter, pp. 191-202. 1988.
- Thompson, Ken. "Reflections on trusting trust." Communications of the ACM 27, no. 8 (1984): 761-763.