Secure software design: erinevus redaktsioonide vahel
Mine navigeerimisribale
Mine otsikasti
Resümee puudub |
|||
| (ei näidata sama kasutaja 46 vahepealset redaktsiooni) | |||
| 1. rida: | 1. rida: | ||
MTAT.03.246 Secure software design | '''MTAT.03.246 Secure software design''' | ||
Lectures: | '''MTAT.03.247 Secure software design: Project work''' | ||
Lectures: Fridays 16:15, J. Liivi 2 - 404 | |||
Contact: margus at cyber.ee | Contact: margus at cyber.ee | ||
== Lecture slides == | == Lecture slides == | ||
* [[ | * [[Media:01-introduction.pdf|Introductory lecture]] | ||
* [[ | ** [[Media:01a-multilevel.pdf|Multilevel security]] | ||
* [[ | ** [[Media:01b-multilateral.pdf|Multilateral security]] | ||
* [[ | * [[Media:02-security-analysis.pdf|Security analysis]] | ||
* [[ | * [[Media:03-human-factors.pdf|Human factors and security]] | ||
* | * [http://keeks.cyber.ee/~margus/04-authentication.pdf Authenticating people and computers] | ||
* [[ | * [[Media:05-strategies.pdf|Strategies for secure software development]] | ||
* [[ | * [[Media:06-ivote2011.pdf|Internet voting in Estonia]] | ||
* [[ | * [[Media:07-strategies2.pdf|Strategies for secure software development; developing security protocols]] | ||
* [ | * [[Media:08-pki1.pdf|PKI and digital signatures]] | ||
* [ | * [[Media:09-pki2.pdf|PKI and digital signatures, part 2]] | ||
* [ | * [[Media:10-xroad.pdf|Case study: Estonian x-road]] | ||
* [ | * [[Media:11-games.pdf|Security of online games]] | ||
* [[Media:12-economics.pdf|Economics of Software Security]] | |||
* [ | * [[Media:13-process.pdf|Development Process for Secure Software]] | ||
* [ | |||
== | == Projects == | ||
[[Secure Software Design: Project|Requirements for the project]] | |||
=== Due dates === | |||
* '''May 27th''' -- project presentation (10-15 minutes) | |||
* '''June 20th''' -- written report | |||
== Exam == | == Exam == | ||
'''The exam''' is a written exam. The exam dates | '''The exam''' is a written exam. Use of written materials is allowed. The exam questions are based on lectures and mandatory reading material. The exam tries to measure knowledge about main principles/technologies/classes of attack and ability to apply these principles for specific examples. | ||
Exam dates: | |||
* '''May 30th''' 10:00, J. Liivi 2, room 122 | |||
* '''June 10th''' 10:00, J. Liivi 2, room 206 | |||
== Mandatory (examinable) reading == | == Mandatory (examinable) reading == | ||
* Ross Anderson, [http://www.cl.cam.ac.uk/~rja14/Papers/satan.pdf "Programming Satan's Computer"] | |||
* | * Ken Thompson, [http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf "Reflections on Trusting Trust"] | ||
* Peter Gutmann, [http://www.cs.auckland.ac.nz/~pgut001/pubs/usenix02.pdf "Lessons Learned in Implementing and Deploying Crypto Software"] | |||
* [http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf | * Ross Anderson, [http://www.cl.cam.ac.uk/~rja14/Papers/eternity.pdf "The Eternity Service"] -- a good example of security analysis of a system | ||
* [http://www.cs.auckland.ac.nz/~pgut001/pubs/usenix02.pdf | * [http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c10.pdf Chapter 10 from "Security Engineering"] | ||
* [http://www.cl.cam.ac.uk/~rja14/Papers/eternity.pdf | |||
* [http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c11.pdf Chapter 11 from "Security Engineering"] | * [http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c11.pdf Chapter 11 from "Security Engineering"] | ||
* K. Tsipenyuk, B. Chess, G. McGraw, [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.106.6376&rep=rep1&type=pdf Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors] | |||
== Recommended reading == | == Recommended reading == | ||
* [http://www. | * [http://www.csoonline.com/article/506309/lifestyle-hackers Lifestyle Hackers] | ||
* | * Alma Whitten, J.D. Tygar, [http://gaudior.net/alma/johnny.pdf "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0"] | ||
* Kevin Mitnick, "The Art of Deception: Controlling the Human Element of Security" | * Kevin Mitnick, "The Art of Deception: Controlling the Human Element of Security" | ||
* David Maurer, "The Big Con: The Story of the Confidence Man" | * David Maurer, "The Big Con: The Story of the Confidence Man" | ||
* | * Frank Stajano, Paul Wilson, [http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-754.html "Understanding scam victims: seven principles for systems security"] | ||
* Richards J. Heuer, Jr., [https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/books-and-monographs/psychology-of-intelligence-analysis/index.html "Psychology of Intelligence Analysis"] | |||
* Rachna Dhamija, Doug Tygar, Marti Hearst. [http://people.deas.harvard.edu/~rachna/papers/why_phishing_works.pdf "Why Phishing Works"] | |||
* Peter Gutmann, [http://www.cs.auckland.ac.nz/~pgut001/pubs/usability.pdf "Security Usability"] | |||
* Peter Gutmann, [http://www.cs.auckland.ac.nz/~pgut001/pubs/usenix99.pdf "The Design of a Cryptographic Security Architecture"] | |||
* [http://www.ietf.org/rfc/rfc2119.txt RFC 2119: Key words for use in RFCs to Indicate Requirement Levels] | |||
* Peter Gutmann, [http://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt "X.509 Style Guide"] | |||
* Ahto Buldas, Märt Saarepera. [http://middleware.internet2.edu/pki03/presentations/08.pdf "Electronic Signature System with Small Number of Private Keys"] | |||
* Arne Ansper, [http://www.cyber.ee/cms-et/firmainfo/infomaterjalid/failid-1/arne-msc.pdf "e-Riigist andmeturbe seisukohalt"] | * Arne Ansper, [http://www.cyber.ee/cms-et/firmainfo/infomaterjalid/failid-1/arne-msc.pdf "e-Riigist andmeturbe seisukohalt"] | ||
* Arne Ansper, Ahto Buldas, Margus Freudenthal, Jan Willemson [http://www.acsac.org/2003/papers/36.pdf "Scalable and Efficient PKI for Inter-Organizational Communication"] | * Arne Ansper, Ahto Buldas, Margus Freudenthal, Jan Willemson [http://www.acsac.org/2003/papers/36.pdf "Scalable and Efficient PKI for Inter-Organizational Communication"] | ||
* | * [http://www.your-call.com.au/information/documents/EY8thGlobalSurvey2003.pdf Fraud. The Unmanaged Risk, 8th Global Survey] | ||
* Cormac Herley, [http://research.microsoft.com/en-us/um/people/cormac/papers/2009/SoLongAndNoThanks.pdf "So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users"] | * Cormac Herley, [http://research.microsoft.com/en-us/um/people/cormac/papers/2009/SoLongAndNoThanks.pdf "So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users"] | ||
* Rick Wash, [http://www.rickwash.com/papers/rwash-homesec-soups10-final.pdf Folk Models of Home Computer Security] | |||
Viimane redaktsioon: 29. mai 2011, kell 21:54
MTAT.03.246 Secure software design
MTAT.03.247 Secure software design: Project work
Lectures: Fridays 16:15, J. Liivi 2 - 404
Contact: margus at cyber.ee
Lecture slides
- Introductory lecture
- Security analysis
- Human factors and security
- Authenticating people and computers
- Strategies for secure software development
- Internet voting in Estonia
- Strategies for secure software development; developing security protocols
- PKI and digital signatures
- PKI and digital signatures, part 2
- Case study: Estonian x-road
- Security of online games
- Economics of Software Security
- Development Process for Secure Software
Projects
Due dates
- May 27th -- project presentation (10-15 minutes)
- June 20th -- written report
Exam
The exam is a written exam. Use of written materials is allowed. The exam questions are based on lectures and mandatory reading material. The exam tries to measure knowledge about main principles/technologies/classes of attack and ability to apply these principles for specific examples.
Exam dates:
- May 30th 10:00, J. Liivi 2, room 122
- June 10th 10:00, J. Liivi 2, room 206
Mandatory (examinable) reading
- Ross Anderson, "Programming Satan's Computer"
- Ken Thompson, "Reflections on Trusting Trust"
- Peter Gutmann, "Lessons Learned in Implementing and Deploying Crypto Software"
- Ross Anderson, "The Eternity Service" -- a good example of security analysis of a system
- Chapter 10 from "Security Engineering"
- Chapter 11 from "Security Engineering"
- K. Tsipenyuk, B. Chess, G. McGraw, Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors
Recommended reading
- Lifestyle Hackers
- Alma Whitten, J.D. Tygar, "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0"
- Kevin Mitnick, "The Art of Deception: Controlling the Human Element of Security"
- David Maurer, "The Big Con: The Story of the Confidence Man"
- Frank Stajano, Paul Wilson, "Understanding scam victims: seven principles for systems security"
- Richards J. Heuer, Jr., "Psychology of Intelligence Analysis"
- Rachna Dhamija, Doug Tygar, Marti Hearst. "Why Phishing Works"
- Peter Gutmann, "Security Usability"
- Peter Gutmann, "The Design of a Cryptographic Security Architecture"
- RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
- Peter Gutmann, "X.509 Style Guide"
- Ahto Buldas, Märt Saarepera. "Electronic Signature System with Small Number of Private Keys"
- Arne Ansper, "e-Riigist andmeturbe seisukohalt"
- Arne Ansper, Ahto Buldas, Margus Freudenthal, Jan Willemson "Scalable and Efficient PKI for Inter-Organizational Communication"
- Fraud. The Unmanaged Risk, 8th Global Survey
- Cormac Herley, "So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users"
- Rick Wash, Folk Models of Home Computer Security