Tentative Syllabus

These topics are tentative and subject to change without warning. In particular, if I don’t discuss something you’re interested in, ask about it! I may very well add it or modify what I'm covering to include it.

Week 1:

    Dates: Jan. 7, Jan. 9; no class on Jan. 9
    Topics: Guest lecture on Jan. 7: Correctness, Conflicts, and Automatic Generation of IPsec/VPN Security Policies (Prof. Felix Wu)

Week 2:

    Dates: Jan. 14, Jan. 16
    Topics: Access control matrix, safety question
    Reading: text, §2, 3.1–3.4; paper [Bi96]
    Due: paper selection (due Jan. 17)

Week 3:

    Dates: Jan. 21, Jan. 23
    Topics: Expressive power of models, security policies
    Reading: text, §3.5 4; papers [SJ07, TL13]
    Due: project selection (due Jan. 21); homework 1 (due Jan. 23)

Week 4:

    Dates: Jan. 28, Jan. 30; discussion section held this week
    Topics: Confidentiality policies, assurance
    Reading: text, §5, 18, 30; paper [LT05, Sa93, VC94]

Week 5:

    Dates: Feb. 4, Feb. 6; discussion section held this week (project presentations)
    Topics: More assurance, integrity and hybrid policies
    Reading: text, § 6–6.2, 6.4, 7, 19; paper [E+03]
    Due: project progress report (due Feb. 4)
    Presentations: Siyuan Gu, paper [Z+05]; Zhicheng Yang, paper [LO10]

Week 6:

    Dates: Feb. 11, Feb. 13
    Topics: Other policy models
    Reading: text, §7; papers [Li89, WB04]
    Due: homework 2 (due Feb. 11)
    Presentations: Pengfei Hu, paper [J+11]

Week 7:

    Dates: Feb. 18, Feb. 20; no class on Feb. 18
    Topics: Guest lecture on Feb. 20: Verifying operating system security (Prof. Karl Levitt)
    Reading: paper [Mi79]

Week 8:

    Dates: Feb. 25, Feb. 27
    Topics: Other policy models, information flow policies
    Reading: text, §16, 32; paper [HS97, WB04]
    Presentations: Yixin Zhao, paper [B+07]

Week 9:

    Dates: Mar. 4, Mar. 6; discussion section held this week
    Topics: Information flow mechanisms, covert channels
    Reading: text, §16, 17
    Due: homework 3 (due Mar. 4)
    Presentations: Daniel DeFreez, papers [S+06]; Kevin Griffin, paper [SA06]; Chao Xu, paper [KR02]

Week 10:

    Dates: Mar. 11, Mar. 13; no class on Mar. 11; discussion section held this week
    Topics: Special topics: elections and voting
    Reading: [S+09]
    Due: homework 4 (due Mar. 14)
    Presentations: Georgia Koutsandria, paper [B+09]; Rakhee Tiwari, paper [HP11]

Mar. 21:

    Due: completed project due at 8:00pm

Readings

[B+07]

M. Backes, M. Dümuth, and D. Unruh, “Information Flow in the Peer-Reviewing Process (Extended Abstract),” Proceedings of the 2007 IEEE Symposium on Security and Privacy pp. 187–191 (May 2007). doi: 10.1109/SP.2007.24

[B+09]

B. Bowen, M. Ben Salem, S. Hershkop, A. Keromytis, and S. Stolfo, “Designing Host and Network Sensors to Mitigate the Insider Threat,” IEEE Security & Privacy 7(6) pp. 22–29 (Nov. 2009). doi: 10.1109/MSP.2009.109

[Bi96]

M. Bishop, “Conspiracy and Information Flow in the Take-Grant Protection Model,” Journal of Computer Security 4(4) pp. 331–359 (1996). doi: 10.3233/JCS-1996-4404

[E+03]

A. El Kalam, R. El Baida, P. Balbiani, S. Benferhat, F. Cuppens, Y. Deswarte, A. Miège, C. Saurel, and G. Trouessin, “Organization Based Access Control,” Proceedings of the IEEE 4th International Workshop on Policies for Distributed Systems and Networks pp. 120–131 (June 2003). doi: 10.1109/POLICY.2003.1206966

[HP11]

J. Hunker and C. Probst, “Insiders and Insider Threats—An Overview of Definitions and Mitigation Techniques,” Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications 2(1) pp. 4–27 (2011). url: http://isyou.info/jowua/papers/jowua-v2n1-1.pdf

[HS97]

T. Himdi and R. Sandhu, “Lattice-Based Models for Controlled Sharing of Confidential Information in the Saudi Hajj System,” Proceedings of the 13th Annual Computer Security Applications Conference pp. 164–174 (Dec. 1997). doi: 10.1109/CSAC.1997.646186

[J+11]

B. Javadi, D. Kondo, J.-M. Vincent, and D. Anderson, “Discovering Statistical Models of Availability in Large Distributed Systems: An Empirical Study of SETI@home,” IEEE Transactions on Parallel and Distributed Systems 22(11) pp. 1896–1903 (Nov. 2011). doi: 10.1109/TPDS.2011.50

[KR02]

C. Ko and T. Redmond, “Noninterference and Intrusion Detection,” Proceedings of the 2002 IEEE Symposium on Security and Privacy pp. 177–187 (May 2002). doi: 10.1109/SECPRI.2002.1004370

[Li89]

T. Lin, “Chinese Wall Security Policy—An Aggressive Model,” Proceedings of the 5th Annual Computer Security Applications Conference pp. 282–289 (Dec. 1989). doi: 10.1109/CSAC.1989.81064

[LO10]

G. Loukas and G. Öke, “Protection Against Denial of Service Attacks: A Survey,” The Computer Journal 53(7) pp. 1020–1037 (2010). doi: 10.1093/comjnl/bxp078

[LT05]

N. Li and M. Tripunitara, “On Safety in Discretionary Access Control,” Proceedings of the 2005 IEEE Symposium on Security and Privacy pp. 96–109 (May 2005). doi: 10.1109/SP.2005.14

[Ma02]

H. Mantel, “On the Composition of Secure Systems,” Proceedings of the 2002 IEEE Symposium on Security and Privacy pp. 88–101 (May 2002). doi: 10.1109/SECPRI.2002.1004364

[S+06]

G. Shah, A. Molna, and M. Blaze, “Keyboards and Covert Channels,” Proceedings of the 15th USENIX Security Symposium pp. 59–78 (Aug. 2006). url: https://www.usenix.org/legacy/event/sec06/tech/shah/shah.pdf}

[S+09]

B. Simidchieva, S. Engle, M. Clifford, A. Jones, S. Peisert, M. Bishop, L. Clarke, and L. Osterweil, “Modeling and Analyzing Faults to Improve Election Process Robustness.” Proceedings of the 2010 Electronic Voting Technology Workshop/Workshop on Trustworthy Elections (Aug. 2010). url: https://www.usenix.org/legacy/events/evtwote10/tech/full\_papers/Simidchieva.pdf

[Sa93]

R. Sandhu, “Lattice-Based Access Control Models,” IEEE Computer 26(11) pp. 9–19 (Nov. 1993). doi: 10.1109/2.241422

[SA06]

J. Soon and J. Alves-Foss, “Covert Timing Channel Analysis of Rate Monotonic Real-Time Scheduling Algorithm in MLS Systems,” Proceedings of the 2006 IEEE Information Assurance Workshop pp. 361–368 (June 2006). doi: 10.1109/IAW.2006.1652117

[SJ07]

H. Shahriari and R. Jalili, “Vulnerability Take Grant (VTG): An Efficient Approach to Analyze Network Vulnerabilities,” Computers & Security 26(5) pp. 349–360 (Aug. 2007). doi: 10.1016/j.cose.2007.03.002

[TL13]

M. Tripunitara and N. Li, “The Foundational Work of Harrison-Ruzzo-Ullman Revisited,” IEEE Transactions on Dependable and Secure Computing 10(1) pp. 28–39 (Jan. 2011). doi: 10.1109/TDSC.2012.77

[VC94]

V. Varadharajan and C. Calvelli, “Extending the Schematic Protection Model. I. Conditional Tickets and Authentication,” Proceedings of the 1994 IEEE Symposium on Research in Security and Privacy pp. 213–229 (May 1994). doi: 10.1109/RISP.1994.296579

[WB04]

T. Walcott and M. Bishop, “Traducement: A Model for Record Security,” ACM Transactions on Information and System Security 7(4) pp. 576–590 (Nov. 2004). doi: 10.1145/1042031.1042035

[Z+05]

X. Zhang, Y. Li, and D. Nalla, “An Attribute-Based Access Matrix Model,” Proceedings of the 2005 ACM Symposium on Applied Computing pp. 359–363 (Mar. 2005). doi: 10.1145/1066677.1066760