Secure software design: erinevus redaktsioonide vahel
| 40. rida: | 40. rida: | ||
* January 12th, 10:00 B-101 | * January 12th, 10:00 B-101 | ||
* January 19th, 10:00 B-101 | * January 19th, 10:00 B-101 | ||
There is no need to register for exams. Just come to the exam. | |||
== Mandatory (examinable) reading == | == Mandatory (examinable) reading == | ||
Redaktsioon: 4. jaanuar 2010, kell 14:19
MTAT.03.246 Secure software design MTAT.03.247 Secure software design: Project work
Lectures: Wednesdays 10:00 Cyber-126.
Contact: margus at cyber.ee
Lecture slides
- Introduction
- Multilevel security
- Multilateral security
- Estonian Health Information System
- Inference control in medicine
- Banking and bookkeeping, Home reading, starting from section 10.4
- Introduction to cryptography
- Coding Centre, Additional reading (in Estonian): description of coding centre, security analysis
- Strategies for developing secure software, Home reading
- Guidelines for developing secure software, part 2
- Human factors and security, Interesting reading
- X-Road, Additional reading
- Security of online games
- PKI and digital signatures, part 1
- PKI and digital signatures, part 2
- Economics of secure software
- Development process for secure software
Projects
Project presentations will be on 16.12.2009. Each project has 15 minutes (10 minutes of presentation + 5 min questions). The presentation should give overview of the system, discuss possible attacks and countermeasures (basically an overview of the project report).
Project presentation must be done in English. Project report can be written in English or Estonian.
Due date for Project reports is 17.01.2010.
Exam
The exam is a written exam. Use of written materials is allowed. The exam questions are based on lectures and mandatory reading material. The exam tries to measure knowledge about main principles/technologies/classes of attack and ability to apply these principles for specific examples.
Exam dates:
- January 12th, 10:00 B-101
- January 19th, 10:00 B-101
There is no need to register for exams. Just come to the exam.
Mandatory (examinable) reading
The exam may contain questions from these papers.
- Chapter 10 from "Security Engineering", starting from section 10.4
- Ross Anderson, "Programming Satan's Computer"
- Ken Thompson, "Reflections on Trusting Trust"
- Peter Gutmann, "Lessons Learned in Implementing and Deploying Crypto Software"
- Ross Anderson, "The Eternity Service" -- a good example of security analysis of a system
- Chapter 11 from "Security Engineering"
Recommended reading
- Ross Anderson, "Security Engineering. A Guide to Building Dependable Distributed Systems"
- Fraud. The Unmanaged Risk, 8th Global Survey
- Peter Gutmann, "The Design of a Cryptographic Security Architecture"
- RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
- Alma Whitten, J.D. Tygar, "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0"
- Kevin Mitnick, "The Art of Deception: Controlling the Human Element of Security"
- David Maurer, "The Big Con: The Story of the Confidence Man"
- Jim Routh, Gary McGraw, "Lifestyle Hackers"
- Arne Ansper, "e-Riigist andmeturbe seisukohalt"
- Arne Ansper, Ahto Buldas, Margus Freudenthal, Jan Willemson "Scalable and Efficient PKI for Inter-Organizational Communication"
- Peter Gutmann, "X.509 Style Guide"
- Ahto Buldas, Märt Saarepera. "Electronic Signature System with Small Number of Private Keys"
- Cormac Herley, "So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users"
- Frank Stajano, Paul Wilson, "Understanding scam victims: seven principles for systems security"