Secure software design

MTAT.03.246 Secure software design MTAT.03.247 Secure software design: Project work

Lectures: Wednesdays 10:00 Cyber-126.

Contact: margus at cyber.ee

Lecture slides:

• Introduction
• Multilevel security
• Multilateral security
• Estonian Health Information System
• Inference control in medicine
• Banking and bookkeeping, Home reading, starting from section 10.4
• Introduction to cryptography
• Coding Centre, Additional reading (in Estonian): description of coding centre, security analysis
• Strategies for developing secure software, Home reading
• Guidelines for developing secure software, part 2
• Human factors and security, Interesting reading
• X-Road, Additional reading
• Security of online games
• PKI and digital signatures, part 1
• PKI and digital signatures, part 2
• Economics of secure software
• Development process for secure software

Project presentations will be on 16.12.2009. Each project has 15 minutes (10 minutes of presentation + 5 min questions). The presentation should give overview of the system, discuss possible attacks and countermeasures (basically an overview of the project report).

The exam is a written exam. The exam dates will be announced later.

Mandatory (examinable) reading. The exam may contain questions from these papers.

• Chapter 10 from "Security Engineering", starting from section 10.4
• Ross Anderson, "Programming Satan's Computer"
• Ken Thompson, "Reflections on Trusting Trust"
• Peter Gutmann, "Lessons Learned in Implementing and Deploying Crypto Software"
• Ross Anderson, "The Eternity Service" -- a good example of security analysis of a system
• Chapter 11 from "Security Engineering"

Recommended reading:

• Ross Anderson, "Security Engineering. A Guide to Building Dependable Distributed Systems"
• Fraud. The Unmanaged Risk, 8th Global Survey
• Peter Gutmann, "The Design of a Cryptographic Security Architecture"
• RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
• Alma Whitten, J.D. Tygar, "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0"
• Kevin Mitnick, "The Art of Deception: Controlling the Human Element of Security"
• David Maurer, "The Big Con: The Story of the Confidence Man"
• Jim Routh, Gary McGraw, "Lifestyle Hackers"
• Arne Ansper, "e-Riigist andmeturbe seisukohalt"
• Arne Ansper, Ahto Buldas, Margus Freudenthal, Jan Willemson "Scalable and Efficient PKI for Inter-Organizational Communication"
• Peter Gutmann, "X.509 Style Guide"
• Ahto Buldas, Märt Saarepera. "Electronic Signature System with Small Number of Private Keys"