1 / 14

CIS 4930/6930: Systems Security

This course provides a comprehensive treatment of computer system security, covering both defense and offense aspects. Topics include common attack techniques, OS protection mechanisms, mandatory access control, capability systems, trusted computing, device security, and cloud security.

bessiet
Télécharger la présentation

CIS 4930/6930: Systems Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. CIS 4930/6930:Systems Security Instructor: Xinming “Simon” Ou TAs: Xiaolong “Daniel” Wang Fengguo Wei Class time: MW 2-3:15

  2. Logistics • Course website: http://www.cse.usf.edu/~xou/sec/ where you can find • Lecture slides • Programming assignments and homework • Reading materials

  3. What is this course about? • Provide a comprehensive treatment of computer system security • Attackers do not play by any rules • How protection mechanisms in OS can help mitigate attacks • Different types of OS protections • Utilizing special hardware for security • Cover both defense and offense aspects • Cover both theory and practice

  4. Topics • Common attack techniques • OS protection mechanisms • Mandatory access control • Capability systems • Trusted computing • Device security • Cloud security

  5. Tasks • Lectures • Readings • Assignments (about one every two weeks) • Homework • Programming projects • Everyone in 6930 needs to submit an in-depth report on a topic within systems security and make a 30min presentation in class • Topic to be mutually determined between student and instructor • Exam • Midterm • Quizzes

  6. Grades Homework, projects, and report: 60% Exam and quizzes: 30% Class participation: 10% CIS4930 and CIS6930 graded separately

  7. Collaboration Policy • Exams: no collaboration • Homework and programming assignments: Do You Own Work. If you discuss with other students, you must indicate who you discussed with in your submission. • Copying of any sort is prohibited

  8. Class Participation • Everyone in 6930 must make a 30min presentation in class. • Towards the end of the semester • Students not presenting participate in the discussion (e.g., asking questions). • We will also ask you questions during the presentation

  9. What is Security? • Classical definition: • Confidentiality • Integrity • Availability • Security is the prevention of threats from causing undesired effects • Threat model is important: who are your adversaries? What is at stake?

  10. Can we have absolute security? • Security is always a trade off between cost and risks • Threat model: • Who are the adversaries? • What are their motivations? • How capable are they? • How much risk can they afford? • Effectiveness of countermeasures: • How much risk is reduced for users? • How much inconvenience is incurred on users? • How much risk is increased for adversaries?

  11. Example1: Spam Emails • Which one of C,I,A does this problem fall into? • What is the threat model? • What are possible counter measures?

  12. Example 2

  13. It is a Human Problem • Security is as much a social, organizational, and economic problem as it is a technical problem • Incentives for good behaviors vs. bad behaviors • Technologies contribute to/help address the problem

  14. What do you mean by “System Security” • “System” is a platform on which various applications function. • In most cases you can think of it as OS • A system provides various protection mechanisms for the applications within it. • Protection is closely related to security, although not the same.

More Related