Schedule #

Disclaimer: Note that the schedule is subject to change as the semester evolves.

Deadlines

Projects (~ every 2 weeks): P01 P02 P03 P04
Workshops (~ every class): W01 W02 W03 W04 W05 W06 W07 W08
Midterm exam: midterm (Wed, Feb 26 - 10:15am , in )
Final exam: final (Fri, Apr 25 - 8:30am , in )

Week 1 #

Monday, 2025-01-06 - Friday, 2025-01-10

Mon - Jan 06, 2025| First day of classes

Mon - Jan 06, 2025

10:15am-11:30am

Lecture 1: Course Introduction

Slides, Recording

Mentioned Resources:

🌐 National Vulnerability Database (NVD)
🌐 OSV Database
🌐 Snyk Database
🌐 Common Vulnerabilities and Exposures (CVE)
🌐 Common Weakness Enumeration (CWE)
🌐 Common Vulnerability Scoring System (CVSS)

Wed - Jan 08, 2025

10:15am-11:30am

Lecture 2: OWASP Top 10 (#1-5)

Slides, Recording

Mentioned Resources:

🌐 OWASP TOP 10 2021

Wed - Jan 08, 2025|

Workshop#01 - Injection W01 Deadline : Wed, Jan 22 - 10:00am (Raleigh time) via Gradescope
Workshop#02 - XSS W02 Deadline : Wed, Jan 22 - 10:00am (Raleigh time) via Gradescope

Week 2 #

Monday, 2025-01-13 - Friday, 2025-01-17

Mon - Jan 13, 2025

10:15am-11:30am

Lecture 3: OWASP Top 10 (#6-10)

Slides, Recording

Mentioned Resources:

Wed - Jan 15, 2025

10:15am-11:30am

Lecture 4: Misc. Vulnerabilities

Slides, Recording

Wed - Jan 15, 2025|

Workshop#03 - CSRF W03 Deadline : Wed, Jan 29 - 10:00am (Raleigh time) via Gradescope
Workshop#04 - Other Input Validation W04 Deadline : Wed, Jan 29 - 10:00am (Raleigh time) via Gradescope

Week 3 #

Monday, 2025-01-20 - Friday, 2025-01-24

Mon - Jan 20, 2025| Martin Luther King Jr. Day - No Classes, University Closed

Wed - Jan 22, 2025

10:15am-11:30am

Lecture 5: Security Testing

Slides, Recording

Additional Material:

🗎 Executive Order 14028 (May 2021)
🗎 Executive Order January 16, 2025
🗎 CISA Self-attestation form (March 2024)
🗎 OWASP ASVS v4.03
🌐 OWASP Top 10 Proactive Controls
🗎 OWASP Web Security Testing Guide

Wed - Jan 22, 2025|

Excercise#01 - Security Testing
Project 1 P01 Deadline : Wed, Feb 5 - 10:00am (Raleigh time) via Gradescope

Wed - Jan 22, 2025

10:00am

Deadlines:

Workshop#01 - Injection #W01 via Gradescope
Workshop#02 - XSS #W02 via Gradscope

Week 4 #

Monday, 2025-01-27 - Friday, 2025-01-31

Mon - Jan 27, 2025

10:15am-11:30am

Lecture 6: Introducing OpenEMR and Static Application Security Testing

Slides, Recording

Mon - Jan 27, 2025|

Excercise#02 - SonarQube for SAST

Wed - Jan 29, 2025

10:15am-11:30am

Lecture 7: Exploitability/Severity & Dynamic Application Security Testing (DAST)

Slides, Recording

Mentioned Resources:

Wed - Jan 29, 2025|

Workshop#05 - Insufficient Authentication and Access Control W05 Deadline : Wed, Feb 12 - 10:00am (Raleigh time) via Gradescope
Workshop#06 - Sensitive Data Exposure W06 Deadline : Wed, Feb 12 - 10:00am (Raleigh time) via Gradescope

Wed - Jan 29, 2025

10:00am

Deadlines:

Workshop#03 - CSRF #W03 via Gradscope
Workshop#04 - Other Input Validation #W04 via Gradscope

Week 5 #

Monday, 2025-02-03 - Friday, 2025-02-07

Mon - Feb 03, 2025

10:15am-11:30am

Lecture 8: Supply chain security: Vulnerable components

Slides, Recording

Mentioned Resources:

🌐 Sonatype State of Supply Chain Security 2023

Wed - Feb 05, 2025

10:15am-11:30am

Lecture 9: Checked In Credentials

Slides, Recording

Mentioned Resources:

🌐 GitGuardian Best Practices
🌐 DigitalOcean Best Practices
🌐 GitGuardian State of Secrets Sprawl 2024

Wed - Feb 05, 2025|

Excercise#03 - Secret Detection
Workshop#07 - ZAP W07 Deadline : Wed, Feb 19 - 10:00am (Raleigh time) via Gradescope
Workshop#08 - Dependency Checker W08 Deadline : Wed, Feb 19 - 10:00am (Raleigh time) via Gradescope
Project 2 P02 Deadline : Wed, Mar 5 - 10:00am (Raleigh time) via Gradescope

Wed - Feb 05, 2025

10:00am

Deadlines:

Project 1 #P01 via Gradscope

Week 6 #

Monday, 2025-02-10 - Friday, 2025-02-14

Mon - Feb 10, 2025

10:15am-11:30am

Lecture 10: Interactive Application Security Testing (IAST)

Slides, Recording

Mon - Feb 10, 2025|

Excercise#04 - Contrast for IAST

Tue - Feb 11, 2025| Wellness Day - No Classes

Wed - Feb 12, 2025

10:15am-11:30am

Lecture 11: Security Code Review; Logging

Slides, Recording

Mentioned Resources:

🌐 OWASP Proactive Controls: Implement Logging & Monitoring OWASP ASVS v4.03: V8 Logging and Monitoring

Wed - Feb 12, 2025|

Excercise#05 - Logging and Auditing

Wed - Feb 12, 2025

10:00am

Deadlines:

Project 1 Peer Eval via Gradscope
Workshop#05 - Insufficient Authentication and Access Control #W05 via Gradscope
Workshop#06 - Sensitive Data Exposure #W06 via Gradscope

Week 7 #

Monday, 2025-02-17 - Friday, 2025-02-21

Mon - Feb 17, 2025

10:15am-11:30am

Lecture 12: Software bill of materials

Slides, Recording

Mon - Feb 17, 2025|

Excercise#06 - SBOM

Wed - Feb 19, 2025

10:15am-11:30am

Lecture 13: Supply chain security: Secure build process

Slides, Recording

Mentioned Resources:

🌐 ACM/IEEE/AIS SIGSEC/IFIP WG 11.8 "Cybersecurity Curricular (CSED) 2017"
🌐 OWASP SCVS
🌐 OpenSSF SLSA

Wed - Feb 19, 2025|

Excercise#07 - Secure Build

Wed - Feb 19, 2025

10:00am

Deadlines:

Workshop#07 - ZAP #W07 via Gradscope
Workshop#08 - Dependency Checker #W08 via Gradscope

Week 8 #

Monday, 2025-02-24 - Friday, 2025-02-28

Mon - Feb 24, 2025

10:15am-11:30am

Lecture 14: Secure design principles

Slides, Recording

Mon - Feb 24, 2025|

Excercise#08 - Secure Design Principles

Wed - Feb 26, 2025

10:15am-11:30am

Midterm Exam (10:15am – 11:30am) #midterm #

Week 9 #

Monday, 2025-03-03 - Friday, 2025-03-07

Mon - Mar 03, 2025

10:15am-11:30am

Lecture 15: Adversarial behavior

Slides, Recording

Mentioned Resources:

🌐 MITRE ATT&CK
🌐 MITRE CAPEC Version 3.9
🌐 Comparison between ATT&CK and CAPEC
🌐 Open Source Supply Chain Attack Reference (OSCAR)

Mon - Mar 03, 2025|

Excercise#09 - Adversarial Behavior

Wed - Mar 05, 2025

10:15am-11:30am

Lecture 16: Attack trees

Slides, Recording

Wed - Mar 05, 2025|

Excercise#10 - Attack Trees

Wed - Mar 05, 2025

10:00am

Deadline:

Project 2 #P02 via Gradscope

Week 10 #

Monday, 2025-03-10 - Friday, 2025-03-14

Mon - Mar 10, 2025| Spring Break - No Classes, University Closed

Tue - Mar 11, 2025| Spring Break - No Classes, University Closed

Wed - Mar 12, 2025| Spring Break - No Classes, University Closed

Thu - Mar 13, 2025| Spring Break - No Classes, University Closed

Fri - Mar 14, 2025| Spring Break - No Classes, University Closed

Week 11 #

Monday, 2025-03-17 - Friday, 2025-03-21

Mon - Mar 17, 2025

10:15am-11:30am

Lecture 17: Threat modeling

Slides, Recording

Mentioned Resources:

Mon - Mar 17, 2025|

Excercise#11 - Threat Modeling

Wed - Mar 19, 2025

10:15am-11:30am

Lecture 18: Elevation of privilege threat modeling game

Slides, Recording

Mentioned Resources:

Wed - Mar 19, 2025|

Project 3 P03 Deadline : Mon, Mar 31 - 10:00am (Raleigh time) via Gradescope

Wed - Mar 19, 2025

10:00am

Deadline:

Project 2 Peer Eval via Gradscope

Week 12 #

Monday, 2025-03-24 - Friday, 2025-03-28

Mon - Mar 24, 2025

10:15am-11:30am

Lecture 19: Cornucopia Game

Slides, Recording

Mentioned Resources:

Wed - Mar 26, 2025

10:15am-11:30am

Lecture 20: Privacy

Slides, Recording

Mentioned Resources:

Week 13 #

Monday, 2025-03-31 - Friday, 2025-04-04

Mon - Mar 31, 2025

10:15am-11:30am

Lecture 21: Abuse and misuse cases

Slides, Recording

Mon - Mar 31, 2025|

Excercise#12 - Abuse and Misuse
Project 4 P04 Deadline : Wed, Apr 16 - 10:00am (Raleigh time) via Gradescope

Mon - Mar 31, 2025

10:00am

Deadline:

Project 3 #P03 via Gradscope

Wed - Apr 02, 2025

10:15am-11:30am

Lecture 22: LLM and Secuirty-1

Slides, Recording

Wed - Apr 02, 2025|

Excercise#13 - LLM Exercise 1

Week 14 #

Monday, 2025-04-07 - Friday, 2025-04-11

Mon - Apr 07, 2025

10:15am-11:30am

Lecture 23: LLM and Security-2

Slides, Recording

Mentioned Resources:

🗎 Paper: An Empirical Study on Using LMM to Analyze Software Supply Chain Security Failures

Mon - Apr 07, 2025|

Excercise#14 - LLM Exercise 2

Wed - Apr 09, 2025

10:15am-11:30am

Lecture 24: Security Maturity Models

Slides, Recording

Mentioned Resources:

Mon - Apr 07, 2025|

Wed - Apr 09, 2025

10:00am

Deadline:

Project 3 Peer Eval via Gradscope

Week 15 #

Monday, 2025-04-14 - Friday, 2025-04-18

Mon - Apr 14, 2025

10:15am-11:30am

Lecture 25: Secuirty Risk

Slides

Mentioned Resources:

🌐 NIST Cybersecurity Framework xz overview

Wed - Apr 16, 2025

10:15am-11:30am

Lecture 26: Protection Pocker

Slides

Wed - Apr 16, 2025|

Excercise#17 - Protection Pocker

Wed - Apr 16, 2025

10:00am

Deadline:

Project 4 #P04 via Gradscope

Week 16 #

Monday, 2025-04-21 - Friday, 2025-04-25

Mon - Apr 21, 2025

10:00am

Deadline:

Project 4 Peer Eval via Gradscope

Fri - Apr 25, 2025

10:15am-11:30am

CSC 515

This Site

Quick Links

Schedule #

Week 1 #

Week 2 #

Week 3 #

Week 4 #

Week 5 #

Week 6 #

Week 7 #

Week 8 #

Midterm Exam (10:15am – 11:30am) #midterm #

Week 9 #

Week 10 #

Week 11 #

Week 12 #

Week 13 #

Week 14 #

Week 15 #

Week 16 #

Final Exam (8:30am – 11:00am) #final #