Schedule #

Disclaimer: Note that the schedule is subject to change as the semester evolves.

Note: You should never need to pay to download an article from the reading (e.g., from the ACM Digital Library). If you are on campus, you won’t be prompted to purchase articles. If you are off campus, you can go through the University Library. Alternatively, you can use the library’s EZproxy. You can even define a Chrome bookmark in your bookmark bar to automatically redirect the current page through the EZProxy.

1
javascript:void(location.href='https://proxying.lib.ncsu.edu/index.php?url='+location.href)

Deadlines #

Intro: Fri, Aug 30 - 11:59pm (in )
Midterm: Wed, Oct 9 - 11:45am (in )
Final: Mon, Dec 9 - 12:00pm (in )
Mini-Projects:
- MP1: Fri, Sep 13 - 11:59pm (in )
- MP2: Fri, Oct 4 - 11:59pm (in )
- MP3: Fri, Nov 8 - 11:59pm (in )
- MP4: Tue, Dec 3 - 11:59pm (in )
Research Project:
- RM1: Fri, Sep 6 - 11:59pm (in )
- RM2: Fri, Sep 27 - 11:59pm (in )
- RM3: Fri, Oct 18 - 11:59pm (in )
- RM4: Fri, Nov 8 - 11:59pm (in )
- RM5: Mon, Dec 2 - 11:45am (in )
- RM6: Tue, Dec 3 - 11:59pm (in )

Week 1 #

Monday, 2024-08-19 - Friday, 2024-08-23

Mon - Aug 19, 2024| First day of classes

Mon - Aug 19, 2024

11:45am-1:00pm

Lecture 1: Course Introduction and Research Methods

Slides, Recording

Additional Material:

🗎 Ken Thompson, Reflections on Trusting Trust., Turing Award Lecture, 1983.
🗎 Michael J. Hanson, Efficient Reading of Papers in Science and Technology, University of Washington, 1989.

Wed - Aug 21, 2024

11:45am-1:00pm

Lecture 2: Security Fundamentals

Slides, Recording

Additional Material:

🕮 Tools and Jewels, Ch 1
🗎 Pfleeger and Cunningham, Why Measuring Security Is Hard, IEEE Security & Privacy Magazine, Volume 8, Issue 4, 2010.

Week 2 #

Monday, 2024-08-26 - Friday, 2024-08-30

Mon - Aug 26, 2024

11:45am-1:00pm

Lecture 3: Intro to Cryptography

Slides, Recording

Discussion:

🗎 Egele et al., An Empirical Study of Cryptographic Misuse in Android Applications, ACM CCS, 2013.

Additional Material:

🕮 Tools and Jewels, Ch 2.1-2.2
🗎 R. Anderson, Why cryptosystems fail, ACM CCS, 1993.

Wed - Aug 28, 2024

11:45am-1:00pm

Lecture 4: Hashes & Message Authentication

Slides, Recording

Discussion:

🗎 Namprempre et al., Reconsidering Generic Composition, EuroCrypt, 2014.

Additional Material:

🕮 Tools and Jewels, Ch 2.5-2.7

Fri - Aug 30, 2024

11:59pm

Deadline: Intro (via GradeScope)

Week 3 #

Monday, 2024-09-02 - Friday, 2024-09-06

Mon - Sep 02, 2024| Labor Day - No Classes, University Closed

Wed - Sep 04, 2024

11:45am-1:00pm

Lecture 5: Asymmetric Cryptography

Slides, Recording

Additional Material:

🕮 Tools and Jewels, Ch 2.3-2.4
🗎 Boneh, Twenty years of attacks on the RSA cryptosystem, Notices of AMS, 46(2), 1999.

Fri - Sep 06, 2024

11:59pm

Deadline: RM1

Week 4 #

Monday, 2024-09-09 - Friday, 2024-09-13

Mon - Sep 09, 2024

11:45am-1:00pm

Lecture 6: Key Management

Slides, Recording

Discussion:

🗎 Adrian et al., Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice, ACM CCS, 2015.

Additional Material:

🕮 Tools and Jewels, Ch 4.3, Ch 8
🗎 Stark et al., Does Certificate Transparency Break the Web? Measuring Adoption and Error Rate., IEEE S&P, 2019.

Wed - Sep 11, 2024

11:45am-1:00pm

Lecture 7: User Authentication

Slides, Recording

Discussion:

🗎 Li et al., The Emperor’s New Password Manager: Security Analysis of Web-based Password Managers., USENIX Security, 2014.

Additional Material:

🕮 Tools and Jewels, Ch 3
🗎 Kelley et al., Guess again (and again and again): Measuring password strength by simulating password-cracking algorithms., IEEE S&P, 2012.
🗎 Florencio et al., An Administrator's Guide to Internet Password Research., LISA, 2014.

Fri - Sep 13, 2024

Deadline: MP1 (11:59pm)

Week 5 #

Monday, 2024-09-16 - Friday, 2024-09-20

Mon - Sep 16, 2024

11:45am-1:00pm

Lecture 8: Authentication Protocols

Slides, Recording

Discussion:

🗎 Fett et al., A Comprehensive Formal Security Analysis of OAuth 2.0, ACM CCS, 2016.

Additional Material:

🕮 Tools and Jewels, Ch 4
🌐 Designing an Authentication System: A Dialogue in Four Scenes
🗎 Lowe, An attack on the Needham-Schroeder public-key authentication protocol, Information Processing Letters. 56(3), 1995.
🗎 Neuman and Ts'o, Kerberos: An Authentication Service for Computer Networks, IEEE Communications, 32(9), 1994.

Tue - Sep 17, 2024| Wellness Day - No Classes

Wed - Sep 18, 2024

11:45am-1:00pm

Lecture 9: Intro to Network Security

Slides, Recording

Discussion:

🗎 Jero et al., Identifier Binding Attacks and Defenses in Software-Defined Networks, USENIX Security, 2017.

Additional Material:

🕮 Tools and Jewels, Ch 11.3-11.7
🗎 Saltzer et al., End-to-end arguments in system design, ACM ToCS. 2(4), 1984.

Week 6 #

Monday, 2024-09-23 - Friday, 2024-09-27

Mon - Sep 23, 2024

11:45am-1:00pm

Lecture 10: Transport Layer Security

Slides, Recording

Discussion:

🗎 Cremers et al., A Comprehensive Symbolic Analysis of TLS 1.3, ACM CCS, 2017.

Additional Material:

🕮 Tools and Jewels, Ch 9.2
🌐 The Illustrated TLS Connection

Wed - Sep 25, 2024

11:45am-1:00pm

Lecture 11: Routing Security

Slides, Recording

Discussion:

🗎 Goldberg, Why is it Taking so Long to Secure Internet Routing?, Communications of the ACM. 57(10), 2014.

Fri - Sep 27, 2024

Deadline: RM2 (11:59pm)

Week 7 #

Monday, 2024-09-30 - Friday, 2024-10-04

Mon - Sep 30, 2024

11:45am-1:00pm

Lecture 12: DNS Security

Slides, Recording

Discussion:

🗎 Man et al., DNS Cache Poisoning Attack: Resurrections with Side Channels, ACM CCS, 2021.

Additional Material:

🌐 An Illustrated Guide to the Kaminsky DNS Vulnerability

Wed - Oct 02, 2024

11:45am-1:00pm

Lecture 13: VPN, Firewalls & Tunnels

Slides, Recording

Discussion:

🗎 Wool, A quantitative study of firewall configuration errors, IEEE Computer, 37(6), 2005.

Additional Material:

🕮 Tools and Jewels, Ch 10

Fri - Oct 04, 2024

Deadline: MP2 (11:59pm)

Week 8 #

Monday, 2024-10-07 - Friday, 2024-10-11

Mon - Oct 07, 2024

11:45am-1:00pm

Lecture 14: Intrusion Detection Systems

Slides, Recording

Discussion:

🗎 The Base-Rate Fallacy and Its Implications for the Difficulty of Intrusion Detection

Additional Material:

🕮 Tools and Jewels, Ch 11.1-11.2

Wed - Oct 09, 2024

6:00pm

Midterm Exam (11:45am) #

11:45am - 1:00pm (during class time)
Allowed resources:
- One hand-written, double sided, 8.5"x11" sized sheet with personal notes
- Calculator (no internet access!)

Week 9 #

Monday, 2024-10-14 - Friday, 2024-10-18

Mon - Oct 14, 2024| Fall Break - No Classes

Tue - Oct 15, 2024| Fall Break - No Classes

Wed - Oct 16, 2024

11:45am-1:00pm

Lecture 15: Software Supply Chain Security (Guest Lecture by Prof. Wermke)

Slides, Recording

Fri - Oct 18, 2024

Deadline: RM3 (11:59pm)

Week 10 #

Monday, 2024-10-21 - Friday, 2024-10-25

Mon - Oct 21, 2024

11:45am-1:00pm

Lecture 16: Research Methods 2

Slides, Recording

Wed - Oct 23, 2024

11:45am-1:00pm

Lecture 17: Software Vulnerabilities

Slides, Recording

Additional Material:

🕮 Tools and Jewels, Ch 6
🕮 Younan et al., [Chapter 2 and Section 3.6] Code Injection in C and C++: A Survey of Vulnerabilities and Countermeasures
🌐 NSF SEED Labs - Software Security Labs

Week 11 #

Monday, 2024-10-28 - Friday, 2024-11-01

Mon - Oct 28, 2024

11:45am-1:00pm

Lecture 18: Access Control

Slides, Recording

Discussion:

🗎 Krohn et al., Information Flow Control for Standard OS Abstractions, SOSP, 2007.

Additional Material:

🕮 Jaeger, Operating System Security, Chapters 1, 2, and 5.
🗎 Saltzer and Schroeder, [Part 1.A Only] The Protection of Information in Computer Systems., Proceedings of the IEEE, 63(9), 1975.

Wed - Oct 30, 2024

11:45am-1:00pm

Lecture 19: Operating Systems

Discussion:

🗎 Sun et al., Security Namespace: Making Linux Security Frameworks Available to Containers, USENIX Security, 2018.

Additional Material:

🕮 Tools and Jewels, Ch 5
🕮 Jaeger, Operating System Security, Chapters 3, 4, and 10
🗎 Karger and Schell, Thirty Years Later: Lessons from the Multics Security Evaluation, ACSAC, 2002.
🗎 Wulf et al., HYDRA: the kernel of a multiprocessor operating system, Communications of the ACM, 17(6), 1974.

Week 12 #

Monday, 2024-11-04 - Friday, 2024-11-08

Mon - Nov 04, 2024

11:45am-1:00pm

Lecture 20: Web Security

Discussion:

🗎 Azad et al., Less is More: Quantifying the Security Benefits of Debloating Web Applications, USENIX Security, 2019.

Additional Material:

🕮 Tools and Jewels, Ch 9

Wed - Nov 06, 2024

11:45am-1:00pm

Lecture 21: Mobile Security

Discussion:

🗎 Deshotels et al., SandScout: Automatic Detection of Flaws in iOS Sandbox Profiles, ACM CCS, 2016.

Additional Material:

🗎 Mayrhofer et al., The Android Platform Security Model, arXiv:1904.05572, 2023.

Fri - Nov 08, 2024

Deadline: RM4 (11:59pm)
Deadline: MP3 (11:59pm)

Week 13 #

Monday, 2024-11-11 - Friday, 2024-11-15

Mon - Nov 11, 2024

11:45am-1:00pm

Lecture 22: Cloud Security

Discussion:

🗎 Arnautov et al., SCONE: Secure Linux Containers with Intel SGX, USENIX OSDI, 2016.

Additional Material:

🕮 Jaeger, Operating System Security, Chapter 11

Wed - Nov 13, 2024

11:45am-1:00pm

Lecture 23: Web Privacy

Discussion:

🗎 Li, Shim Shimmeny: Evaluating the Security and Privacy Contributions of Link Shimming in the Modern Web, USENIX Security, 2020.

Additional Material:

🗎 EFF, [Part 1] Behind the One-Way Mirror: A Deep Dive Into the Technology of Corporate Surveillance, 2019.
🗎 Nikiforakis et al., Cookieless Monster: Exploring the Ecosystem of Web-Based Device Fingerprinting, IEEE S&P, 2013.
🗎 Roesner et al., ShareMeNot: Balancing Privacy and Functionality of Third-Party Social Widgets, ;login: Magazine, 2012.
🗎 Acar et al., The Web Never Forgets: Persistent Tracking Mechanisms in the Wild, ACM CCS, 2014.
🗎 Privacy Violations Using Microtargeted Ads: A Case Study, ICDMW, 2010.

Week 14 #

Monday, 2024-11-18 - Friday, 2024-11-22

Mon - Nov 18, 2024

11:45am-1:00pm

Lecture 24: Mobile Privacy

Discussion:

🗎 Reardon et al., 50 Ways to Leak Your Data: An Exploration of Apps' Circumvention of the Android Permissions System, USENIX Security, 2019.

Additional Material:

🌐 NY Times, Twelve Million Phones, One Dataset, Zero Privacy
🗎 Enck et al., TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones, OSDI, 2010.
🗎 Wei et al., Amandroid: A Precise and General Inter-component Data Flow Analysis Framework for Security Vetting of Android Apps., ACM TOPS, 2018.

Wed - Nov 20, 2024

11:45am-1:00pm

Lecture 25: Anonymous Communication

Discussion:

🗎 Perta et al., A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients., PETS, 2015.

Additional Material:

🗎 Dingledine et al., Tor: The second-generation onion router, USENIX Security, 2004.

Week 15 #

Monday, 2024-11-25 - Friday, 2024-11-29

Mon - Nov 25, 2024| No Class

Wed - Nov 27, 2024| Thanksgiving Break - No Classes

Thu - Nov 28, 2024| Thanksgiving Holiday - No Classes, University Closed

Fri - Nov 29, 2024| Thanksgiving Holiday - No Classes, University Closed

Week 16 #

Monday, 2024-12-02 - Friday, 2024-12-06

Mon - Dec 02, 2024

11:45am-1:00pm

Lecture 26: Research Project Presentations and Wrap-up

Mon - Dec 02, 2024

Deadline: RM5 (11:59pm)

Tue - Dec 03, 2024| Last day of classes

Tue - Dec 03, 2024

Deadline: MP4 (11:59pm)

Tue - Dec 03, 2024

Deadline: RM6 (11:59pm)

Wed - Dec 04, 2024| Reading Day

Week 17 #

Monday, 2024-12-09 - Friday, 2024-12-13

Mon - Dec 09, 2024

12:00pm

Final Exam (12:00n – 2:30pm) #

150 min exam duration
Final exam is cumulative
1230 Engineering Building 2 (same room as class)
Allowed resources:
- Two hand-written, double sided, 8.5"x11" sized sheet with personal notes
- Calculator (no internet access!)

Sat - Dec 14, 2024| Fall Commencement Exercises