The Introduction to Information Security course surveys central concepts in applied information security and cyber security, and offers a hands-on introduction to secure programming and vulnerability analysis.

High-level goals:
- Make students aware of the major security risks and attack vectors
- Gain concrete hands-on experience with prominent tools and technologies
- Teach about good tools and practices for building secure systems
- Instill the state of mind and conceptual vocabulary for reasoning about systems security
A student who has taken the class and then got programming project should know when he's doing something dangerous, what are the standard solutions, and be able to to productively communicate with vendors and experts.
 

Scope:
1. Programming vulnerabilities (buffer/stack/integer overflow, format strings, privilege escalation)
2. Secure platforms and programming (OS, TPM, languages, libraries, good practices, analysis tools)
3. Network vulnerabilities (impersonation, DoS, application-level) and defense (SSL, IPsec, firewalls, anomaly detection)
4. Exploitation techniques and the low-level details underlying them (reverse engineering x86 assembly, shell code, packet injection
5. Cryptography basics (encryption, digital signatures, certificates)
6. Authentication (passwords, biometrics, tokens, certificates)
7. Authorization policies (access control, information flow control, logging, detection)
8. Physical and psychological elements (tamperproofing, user interfaces, social engineering)
9. Study cases (e.g., banks, mobile phones, cars)

Course requirements:

• Final exam
  • Examples from past years:
    [2014 Moed Aleph questions] [2014 Moed Aleph solutions] [2013 Moed Aleph questions] [2013 Moed Aleph solution] [example questions]
• Homework exercises every week. Many homework will be “wet” exercises on attacking and defending mock systems. There will be plenty of work using low-level tools such as x86 assembly, network monitoring/injection tools, and mock attack targets.
• Final grade: 65% exam, 35% exercises

Requisite courses:

• Operating Systems (0368-2162) or Introduction to Systems Programming (0512-4402) or equivalent

Recommended (not mandatory) courses:

• Introduction to Modern Cryptography (0368-3049) or Cryptography and Computer Security (0510-7401) or Foundations of Cryptography (0368-4162) or equivalent