Syllabus #
Co-requisites #
Formal: CSC326.
Informal: You need to have a basic understanding of programming/the use of programming languages to build software systems. They should also be able to pick up a new programming language (e.g., Python) with relative ease. You need to understand the software engineering process including requirements, agile software development, use cases. If you do not have a basic understanding of these areas, you will have difficulty with the course. If you have questions regarding these prerequisites, please contact the instructor.
Technology Requirements #
Laptops (or a mobile device with internet access) are required in class to complete in-class lab activities. NC State’s Online and Distance Education provides technology requirements and recommendations for computer hardware.
Software that will be used in the class exercises includes the following (hosted on the NCSU Virtual Computing Laboratory and/or installed locally):
- SonarQube
- ZAP
- Seeker
- Contrast
Required Materials #
There are no required books to purchase for this class.
Recommended Materials #
We will use online resources as noted in the syllabus. You may find the following online resources helpful as well:
- Security Engineering, Ross Anderson
- Computer Security and the Internet: Tools and Jewels, Paul C. van Oorschot
- Software Security: Principles, Policies, and Protection, Payer
- The library has print and online copies of ‘The Web Application Hacker’s Handbook’. We recommend checking it out (first come, first served), or finding a copy of your own. The book presents a principled approach to discovering web application vulnerabilities, and a lot of detail on how to do so, things that will help you succeed at the project assignments.
- While the book is old, ‘The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities’, Dowd, McDonald and Schuh is the bible of conducting security audits. The book is available in print from the library. If you were going to build a library of security books, you should consider this one.
Course Details #
A detailed list of lecture by lecture contents, assignments, and due dates (subject to change as semester evolves) is available on the course schedule.
The semester’s submission lockers will be within the Gradescope system. No submissions will be accepted through email or message board posts!
Classroom attendance and activities will be managed through TopHat.
Course Assignments #
Count on last-minute system failures, power outages, laptop issues, internet connectivity issues, etc. Make sure you are backing up your work so that you are able to at least receive partial credit. A broken computer, power outage, etc. are not acceptable excuses for requesting extensions on assignment deadlines!
Do not wait until the last minute!
You must inform your instructor as soon as possible of anything that may prevent you from completing coursework and exams as well as any other concerns that you may have.
Workshops #
Description: During the “Common Vulnerabilities & Software Weaknesses” unit of the course, students will complete workshop assignments to practice exploiting vulnerabilities in software.
Collaboration Policy: Workshop assignments may be completed individually, but we strongly suggest working in study groups (no more than 3 people).
Late Submission Policy: Late workshop assignments will not be accepted without a documented excused absense.
Workshops are organized by topics – some workshops require less effort than others. Please plan ahead and use your time wisely. Do NOT wait until the last minute to complete workshops!!!
Project #
Description: you will complete a thorough security review of an open-source software system based on the topics and tools presented and discussed throughout the course.
Collaboration Policy: Projects must be completed in small teams of 3-4 students. You will have the opportunity to request your teams. Students who do not request teams will be assigned to random teams.
Late Submission Policy: Project materials will not be accepted late without a documented excused absence. All members of the team will be held responsible if a submission is not submitted on time or if academic misconduct is observed.
Lecture Exercises #
During each lecture, you will complete several small exercises through Moodle. These exercises will be applications and review of new course concepts. Exercises will be graded on participation and correctness. If you fail to complete more than 4 lectures without a documented excused absence, your exercise/participation grade used to calculate your course average will automatically be 0. At the end of the semester, your in-class exercise score must be at least 75% to earn full exercise/participation in your course average. Otherwise, if your in-class exercise score is less than 75%, the 4 points allotted for in-class exercises in your course average calculation will be multiplied by your in-class exercise score percentage. For example:
- if your in-class exercise score is between 75-100%, then the exercise/participation component used to calculate your course average will be 100% * 4 = 4 points
- if your in-class exercise score is 74%, then the exercise/participation component used to calculate your course average will be 74% * 4 = 2.96 points
- if your in-class exercise score is 61%, then the in-class exercise component used to calculate your course average will be 61% * 4 = 2.44 points.
- if your in-class exercise score is 30%, then the in-class exercise component used to calculate your course average will be 30% * 4 = 1.2 points.
Grading Information #
A weighted grade average will be calculated as follows:
- 30% (15% each) – Midterm Exams (2)
- 20% – Final Exam
- 30% (10% each) – Projects
- 16% – Workshops (#1-8)
- 4% – Exercises/participation
Excused absences are defined in the NC State Academic Policy on Attendance Regulations. Documentation of the absence is required to excuse an absence. DO NOT SCHEDULE AN INTERVIEW ON THE MIDTERM OR FINAL EXAM DATES! (You cannot get an excused absence for an interview on an exam date.)
Grade Scale #
Grade | Percentage (including) |
---|---|
A+ | 97 - 100 |
A | 93 - 96 |
A- | 90 - 92 |
B+ | 87 - 89 |
B | 83 - 86 |
B- | 80 - 82 |
C+ | 77 - 79 |
C | 73 - 76 |
C- | 70 - 72 |
D+ | 67 - 69 |
D | 63 - 66 |
D- | 60 - 62 |
F | Below 60 |
To pass CSC415, you must have a weighted average of 60% or higher on the following individual components: Midterm #1, Midterm #2, Final Exam.
Students are expected to conduct themselves in a respectful and professional manner at all times. Grades will be adjusted if students do not handle themselves in a respectful and professional manner with all members of the teaching staff and with others in the class, including emails, message board posts, in-person communication, and peer evaluations. Any threatening language or behaviors will be reported to the appropriate authorities.
Attendance #
Please contact the teaching staff to obtain an excused absence only in the case that you had adequate documentation, such as a doctor’s note or an interview invitation. All anticipated absences must be presented to the instructor no later than one week before the absence. All emergency absences must be turned in no later than one week after the student’s return date.
You are allowed to miss up to 4 lectures throughout the semester without penalty. Please do NOT contact the teaching staff if you feel sick but not sick enough to see a doctor or have something else going on in your life that prevents you from coming to class.
Regrading #
- Should you discover what you think is an error in grading, you must submit a request for regrade via Gradescope.
- You have only ONE WEEK after the grades are returned to you to request a re-grade. After that point, you cannot appeal your grade.
- Communicate with the TA (who did the grading) and see if you can get it resolved. If you are still unsatisfied, you should then contact Dr. Williams.
Class Communications and Course Evaluations #
The class will use Piazza for communication.
You can email Dr. Williams at laurie_williams@csc.ncsu.edu. When emailing, use “[CSC415]” in the subject.
Online class evaluations will be available for students to complete during the last two weeks of class. Students will receive an email message directing them to a website where they can log in using their Unity ID and complete evaluations. All evaluations are confidential; instructors will never know how any one student responded to any question, and students will never know the ratings for any particular instructors.
- Evaluation website: https://classeval.ncsu.edu
- Student help desk: classeval@ncsu.edu (for evaluations)
- More information about ClassEval: http://www2.acs.ncsu.edu/UPA/classeval/index.htm