ISA 662

ISA 662: INFORMATION SYSTEMS SECURITY

Professor Duminda Wijesekera

Spring 2007, Tuesday 4:30pm - 7:10pm, Innovation Hall 103

Instructor:	Dr. Duminda Wijesekera
Email:	dwijesek@gmu.edu (please include "isa662" in your subject line)
Office:	S&T-II Room 351
Office phone:	(703) 993-1578
Office hours: TA: Office: Office hours:	Monday 3:00-4:00PM, Tuesday3:00-4:00PM Baoxian Zhao bzhao@gmu.edu(please include "isa662" in your subject line) STII, Room 468 Thursday. 02:00PM-4:00PM or by appointment(preferred)
Webpage:	http://www.ise.gmu.edu/~duminda/classes/spring07/isa662/index.htm

Acknowledgment:

We borrowed materials from Fall 2006 class of Dr.Sandhu

Important Notice:

Here is a useful material to help you with Question 4 on Exam 4
Exam 4 was reuploaded on 8:12PM, May 7. So make sure your version is new one
Examination 4: take-home examination is posted here.Due by hard copy on 5/15/07 at regularly scheduled class time. Submit in Room 468, ST2 Building to Baoxian Zhao.
Exam 2 papers were distributed on 05/01/2007. Here is sample solution. The deadline of regrading your exam paper is May 15.
Assig 2 will be postponed to 4/3/2007
Exam 2 will be postponed to 4/10/2007
Exam 1 was distributed on 03/20/2007. Here is sample solution
Assignment 2 has been posted
2/27/2007, Assignment 1 will be distributed on today's class. Here are grading rules for this assignment.
The schedule is updated.
Announcement: Exam 1 will be postponed by one week.
Announcement: because today's class is cancelled, please submit Assigment 1 to bzhao@gmu.edu by the end of 2/13/2007 ( with ISA662 Assig 1 title) by email
RSA Crypto FAQ is updated. Thank Krishna for finding past broken link
Assignment 1 has been posted
Watch this space for important announcements throughout the course. Recent announcements will be highlighted in red.

Course Prerequisites:

Must have completed all foundation requirements for the MS-ISA degree or equivalent.
Must be internet, web and pdf (get Acrobat Reader here) capable.
Must be capable of accessing papers available to all GMU students in the GMU Digital Library via University Libraries -- Database Wizard.

Grading:

Grades will be based on examinations, assignments and class participation.
Final grades will be assigned by “curving” grades assigned on individual assignments and examinations.
All examinations will be closed-book in-class. There is no opportunity for make-up examinations except for extreme situations.

Schedule:

The schedule is subject to change and adjustment as the semester proceeds.
The course is structured into 3 parts. The first two parts have two assignments. Each of three parts has an examination. Exam 4 is a final taken-home exam.
Assigned readings for a lecture should be read in full in advance of the lecture for maximum benefit.
Readings marked with a REF qualifier are not required to be read in full. Selected aspects will be covered in class.

Part I: Cryptography

Assignment for Part I is available here and due in class on 2/13/07.

1/23/2007:
Part 1: Introduction to Security
- My slides: Introduction to ISA 662 Today's Lecture
- Bishop, Chapter 1 An Overview of Computer Security. Bishop's slides: ppt, pdf.
- Good-Enough Security: Toward a Pragmatic Business-Driven Discipline, Ravi Sandhu, IEEE Internet Computing, Vol. 7, No.1, January/February 2003.
- Unconventional Wisdom by Bellovin, S., IEEE Security & Privacy Magazine, Volume 4, Issue 1, Jan.-Feb. 2006 Page(s):88 - 88
- How to think about security by Whittaker, J.A. and Ford, R. IEEE Security & Privacy Magazine, Volume 4, Issue 2, Mar.-Apr. 2006 Page(s): 68- 71.
- Hackers get to the root of the problem by Dan Geer. IEEE Computer, May 2006, Page(s): 17-19.
- The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets, Evan Cooke, Farnam Jahanian and Danny McPherson, Proc. USENIX Workshop on Steps to Reducing Unwanted Traffic on the Internet, 2005.
- Malicious Bots Threaten Network Security, Dan Geer, IEEE Computer, January 2005, Industry Trends Column.
Part 2: Cryptography
- My slides: Introduction || Symmetric encryption
- REF: RSA Crypto FAQ
1/30/2007: Cryptography continued
- My slides: Ahmed K Alazzawe's slides || Symmetric encryption (continued) || Asymmetric encryption || Asymmetric signatures and key exchange || Symmetric MACs
- REF: RSA Crypto FAQ
2/6/2007: Challenge-Response. Digital Certificates.
- My slides: Challenge-response || Digital certificates
- REF: RSA Crypto FAQ
2/13/2007: Due to the bad weather, class is canceled.
2/20/2006: Cryptographic Protocols: SSL and its pitfalls.
- My slides: SSL || SSL pitfalls
- "An overview of PKI trust models" by Perlman, R. IEEE Network, Volume: 13 Issue: 6 , Nov.-Dec. 1999 Page(s): 38-43.
- "The problem with multiple roots in Web browsers-certificate masquerading" by Hayes, J.M. Proceedings Seventh IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises, IEEE 1998. (WET ICE '98) 17-19 June 1998 Page(s): 306 -311.
- "Restricting access with certificate attributes in multiple root environments - a recipe for certificate masquerading" by Hayes, J.M. Proc. 15th Annual Computer Security Applications Conference, IEEE, 2001, Page(s): 386-390.
- REF: The TLS Protocol, Version 1.0, RFC 2246
  “The differences between this protocol and SSL 3.0 are not dramatic, but they are significant enough that TLS 1.0 and SSL 3.0 do not interoperate.”
2/27/2007: Examination 1 on Part I.

Part II: Cryptography (concluded). Access Control and Authorization.

Assignment for Part II is available here and due in class on 3/27/07.

3/6/2007: Cryptographic Protocols: Needham-Schroeder, Kerberos, EKE and IKE.
- My slides: Kerberos || EKE || IKE
- Bishop, Chapter 10 Key Management, Section 10.2.1 and 10.2.2. Bishop's slides: ppt, pdf (through slide 27).
- REF: The Kerberos Network Authentication Service (V5), RFC 1510
- REF: "Encrypted key exchange: password-based protocols secure against dictionary attacks." Bellovin, S.M. and Merritt, M. Proceedings IEEE Computer Society Symposium on Research in Security and Privacy, 4-6 May 1992 Page(s):72 - 84.
- REF: The Internet Key Exchange (IKE), RFC 2409

Spring Break 11 Mar - 18 Mar

3/20/2007: DAC, MAC, Covert Channels, Information Flow, Chinese Walls.
- My slides: Access Control || LBAC
- Bishop, Chapter 2 Access Control Matrix. Bishop's slides: ppt, pdf.
- Bishop, Chapter 5 Confidentiality Policies. Bishop's slides: ppt, pdf.
- Bishop, Chapter 6 Integrity Policies. Bishop's slides: ppt, pdf.
- Access Control: Principles and Practice, Ravi Sandhu and Pierangela Samarati, IEEE Communications, Volume 32, Number 9, September 1994, pages 40-48.
- Lattice-Based Access Control Models, Ravi Sandhu, IEEE Computer, Volume 26, Number 11, November 1993, pages 9-19.
3/27/2007: LBAC concluded. RBAC.
- My slides: RBAC96 model My past class slides
- Role-Based Access Control Models, Ravi Sandhu, Edward Coyne, Hal Feinstein and Charles Youman, IEEE Computer, Volume 29, Number 2, February 1996, pages 38-47.
- Proposed NIST Standard for Role-Based Access Control, David Ferraiolo, Ravi Sandhu, Serban Gavrila, D. Richard Kuhn and Ramaswamy Chandramouli, ACM Transactions on Information and System Security, Vol. 4, No. 3, August 2001, Pages 224-274.
4/3/2007: Relation of RBAC to DAC and MAC.
- My slides: RBAC subsumes MAC and DAC My past lecture slides
- Configuring Role-Based Access Control to Enforce Mandatory and Discretionary Access Control Policies, Sylvia Osborn, Ravi Sandhu and Qamar Munawer, ACM Transactions on Information and System Security, Vol. 3, No. 2, May 2000, Pages 85-106.
4/10/2007: Examination 2 on Part II .

Part III: System Security and Assurance

There is no assignment for Part III. It is replaced by examination 4.

4/17/2007: Orange Book, Common Criteria, FIPS 140-2
- My slides: Orange book || Common criteria
- Bishop, Chapter 21 Evaluating Systems. No slides.
- REF: Orange book
- Common Criteria: An Introduction
- REF: Common Criteria: User Guide
- REF: FIPS 140-2
- REF: NIST FIPS 140-2 page
4/24/2007:
Part 1: Authentication
- Bishop, Chapter 12 Authentication. Bishop's slides: ppt, pdf, My slides.
- Case study: online banking security by Hole, K.J., Moen, V. and Tjostheim, T. IEEE Security and Privacy, Volume 4, Issue 2, Mar.-Apr. 2006, Page(s): 14- 20.
- Secure Internet banking authentication by Hiltgen, A., Kramp, T. and Weigold, T. IEEE Security and Privacy, Volume 4, Issue 2, Mar.-Apr. 2006, Page(s): 21- 29.
Part 2: Intrusion Detection
- Bishop, Chapter 25 Intrusion Detection. Bishop's slides: ppt, pdf.
- Stefan Axelsson, "The Base-Rate Fallacy and the Difficulty of Intrusion Detection." ACM Transactions on Information and System Security, Vol. 3, No. 3, August 2000, Pages 186-205.
5/1/2007:
Part 1: Malware
- Bishop, Chapter 22 Malicious Logic. No slides.
- 20 Years of Computer Viruses, My slides Ross M. Greenberg and George Jones, TechWeb, Jul 5, 2006.
- Ken Thomson. "Reflections on trusting trust." Commun. ACM 27, 8 (Aug. 1984) 761-763.
Part 2: Usage Control
- UCON paper | with markup, My slides
5/8/2007: Examination 3 on Part III.

5/8/2007: Examination 4: take-home examination is posted here. Due by hard copy on 5/15/07 at regularly scheduled class time. Submit in Room 468, ST2 Building to Baoxian Zhao.

Textbook:

The course is based on Prof. Sandhu's slides, specified papers from the literature and portions of the following book.
Computer Security: Art and Science by Matt Bishop. Addison-Wesley Pub Co; 1st edition (December 2, 2002) ISBN: 0201440997
The course assumes that students have ready access to this book.

Grading:

Examinations 1-3: 20% each for a total of 60%
Examination 4: 13.33%
Assignments 1 and 2: 13.33% each for a total of 26.67%
Grades will be "curved" based on overall class performance.

Archives: Summer 2004