Secure software design: erinevus redaktsioonide vahel
Mine navigeerimisribale
Mine otsikasti
Resümee puudub |
Resümee puudub |
||
| 6. rida: | 6. rida: | ||
Contact: margus at cyber.ee | Contact: margus at cyber.ee | ||
Lecture slides | == Lecture slides == | ||
* [[media:Lecture1.pdf|Introduction]] | * [[media:Lecture1.pdf|Introduction]] | ||
* [[media:Lecture2-multilevel.pdf|Multilevel security]] | * [[media:Lecture2-multilevel.pdf|Multilevel security]] | ||
| 24. rida: | 24. rida: | ||
* [http://keeks.cyber.ee/~margus/lecture16-economy.pdf Economics of secure software] | * [http://keeks.cyber.ee/~margus/lecture16-economy.pdf Economics of secure software] | ||
* [http://keeks.cyber.ee/~margus/lecture17-process.pdf Development process for secure software] | * [http://keeks.cyber.ee/~margus/lecture17-process.pdf Development process for secure software] | ||
== Project presentations == | |||
'''Project presentations''' will be on 16.12.2009. Each project has 15 minutes (10 minutes of presentation + 5 min questions). The presentation should give overview of the system, discuss possible attacks and countermeasures (basically an overview of the project report). | '''Project presentations''' will be on 16.12.2009. Each project has 15 minutes (10 minutes of presentation + 5 min questions). The presentation should give overview of the system, discuss possible attacks and countermeasures (basically an overview of the project report). | ||
== Exam == | |||
'''The exam''' is a written exam. The exam dates will be announced later. | '''The exam''' is a written exam. The exam dates will be announced later. | ||
Mandatory (examinable) reading | == Mandatory (examinable) reading == | ||
The exam may contain questions from these papers. | |||
* [http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c10.pdf Chapter 10 from "Security Engineering"], starting from section 10.4 | * [http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c10.pdf Chapter 10 from "Security Engineering"], starting from section 10.4 | ||
* [http://www.cl.cam.ac.uk/~rja14/Papers/satan.pdf Ross Anderson, "Programming Satan's Computer"] | * [http://www.cl.cam.ac.uk/~rja14/Papers/satan.pdf Ross Anderson, "Programming Satan's Computer"] | ||
| 37. rida: | 43. rida: | ||
* [http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c11.pdf Chapter 11 from "Security Engineering"] | * [http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c11.pdf Chapter 11 from "Security Engineering"] | ||
Recommended reading | == Recommended reading == | ||
* Ross Anderson, "Security Engineering. A Guide to Building Dependable Distributed Systems" | * Ross Anderson, "Security Engineering. A Guide to Building Dependable Distributed Systems" | ||
* [http://www.your-call.com.au/information/documents/EY8thGlobalSurvey2003.pdf Fraud. The Unmanaged Risk, 8th Global Survey] | * [http://www.your-call.com.au/information/documents/EY8thGlobalSurvey2003.pdf Fraud. The Unmanaged Risk, 8th Global Survey] | ||
Redaktsioon: 9. detsember 2009, kell 15:42
MTAT.03.246 Secure software design MTAT.03.247 Secure software design: Project work
Lectures: Wednesdays 10:00 Cyber-126.
Contact: margus at cyber.ee
Lecture slides
- Introduction
- Multilevel security
- Multilateral security
- Estonian Health Information System
- Inference control in medicine
- Banking and bookkeeping, Home reading, starting from section 10.4
- Introduction to cryptography
- Coding Centre, Additional reading (in Estonian): description of coding centre, security analysis
- Strategies for developing secure software, Home reading
- Guidelines for developing secure software, part 2
- Human factors and security, Interesting reading
- X-Road, Additional reading
- Security of online games
- PKI and digital signatures, part 1
- PKI and digital signatures, part 2
- Economics of secure software
- Development process for secure software
Project presentations
Project presentations will be on 16.12.2009. Each project has 15 minutes (10 minutes of presentation + 5 min questions). The presentation should give overview of the system, discuss possible attacks and countermeasures (basically an overview of the project report).
Exam
The exam is a written exam. The exam dates will be announced later.
Mandatory (examinable) reading
The exam may contain questions from these papers.
- Chapter 10 from "Security Engineering", starting from section 10.4
- Ross Anderson, "Programming Satan's Computer"
- Ken Thompson, "Reflections on Trusting Trust"
- Peter Gutmann, "Lessons Learned in Implementing and Deploying Crypto Software"
- Ross Anderson, "The Eternity Service" -- a good example of security analysis of a system
- Chapter 11 from "Security Engineering"
Recommended reading
- Ross Anderson, "Security Engineering. A Guide to Building Dependable Distributed Systems"
- Fraud. The Unmanaged Risk, 8th Global Survey
- Peter Gutmann, "The Design of a Cryptographic Security Architecture"
- RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
- Alma Whitten, J.D. Tygar, "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0"
- Kevin Mitnick, "The Art of Deception: Controlling the Human Element of Security"
- David Maurer, "The Big Con: The Story of the Confidence Man"
- Jim Routh, Gary McGraw, "Lifestyle Hackers"
- Arne Ansper, "e-Riigist andmeturbe seisukohalt"
- Arne Ansper, Ahto Buldas, Margus Freudenthal, Jan Willemson "Scalable and Efficient PKI for Inter-Organizational Communication"
- Peter Gutmann, "X.509 Style Guide"
- Ahto Buldas, Märt Saarepera. "Electronic Signature System with Small Number of Private Keys"