Course Information

CS 4404: Tools and Techniques - Computer Network Security
Term: B Term, 2020
Time: 9:00am to 11:50am
Days: Tuesdays and Fridays
Location: Fuller Labs 320

Course Catalog Description

This course introduces students to modern network security concepts, tools, and techniques. The course covers security threats, attacks and mitigations at the operating system and network levels (as opposed to the software level). Topics include: authentication, authorization, confidentiality, integrity, anonymity, privacy, intrusion detection and response, and cryptographic applications. Students will become familiar with modern security protocols and tools. Assignments will involve using security testing software to uncover vulnerabilities, network packet analyzers, and existing security applications to create secure network implementations. The course requires enough programming and systems background to understand attacks and use systems tools, but does not involve significant programming projects. Assignments and projects will use a Linux base for implementation. Students who have credit for CS 558 may not earn subsequent credit for this course. Recommended Background: Knowledge of operating systems (CS3013 or equivalent) and computer networks (CS3516 or equivalent). Familiarity with Linux or Unix is essential.

Teaching Staff

Course Instructor: Craig Shue
Email: please post via the class discussion board
Office: Use Zoom link available via InstructAssist
Office Hours: Tuesdays, 3pm-4pm; Fridays, 1pm-2pm.
     Exception: On Friday, Nov. 27, hours will be cancelled.

Teaching Assistant: Heshan Perera
Office: Use Zoom link available via InstructAssist
Office Hours: Wednesdays, 1pm-3pm; Thursdays, 3pm-5pm

Schedule and Readings

Below is a list of readings for the class, along with deadlines for the Missions and Projects. All students are expected to have read the readings prior to arriving for class on the indicated date. Students can access the readings by clicking on the link associated with the reading assignment or by going to the InstructAssist Resources page to access a .zip archive of the readings.

Date	Description	Reading
Friday, Oct. 23, 2020	Class: Introduction, Security Overview	Chapter 1.1 to 1.5: Pfleeger and Pfleeger, "Is there a security problem in computing?", Security in Computing, 4th edition.
Friday, Oct. 23, 2020	MISSION	Mission 1 Launched
Tuesday, Oct. 27, 2020	Class: Legality and Ethics	David Dittrich, Michael Bailey, Sven Dietrich. "Towards Community Standards for Ethical Behavior in Computer Security Research." Stevens CS Technical Report 2009-1, 20 April 2009.   A. Burstein, "Conducting cybersecurity research legally and ethically," in USENIX Workshop on Large- Scale Exploits and Emergent Threats (LEET), 2008.
Friday, Oct. 30, 2020	Class: Authenticity: TLS	T. Chung, J. Lok, B. Chandrasekaran, D. Choffnes, D. Levin, B. Maggs, A. Mislove, J. Rula, N. Sullivan, C. Wilson, "Is the Web Ready for OCSP Must-Staple?," ACM Internet Measurement Conference, 2018.
Tuesday, Nov. 3, 2020	Class: Cryptography	Chapter 1.1, 1.2, 1.4, 1.5, 1.6-1.9: A. Menezes, P. Van Oorschot, S. Vanstone. "Handbook of Applied Cryptography," CRC Press ISBN: 0-8493-8523-7, October 1996.
Friday, Nov. 6, 2020	Class: Integrity	Robert Topolski. "NebuAd and partner ISPs: Wiretapping, forgery and browser hijacking," Washington DC: FreePress, 2008.   Giuseppe Ateniese and Stefan Mangard. "A new approach to DNS security (DNSSEC)," ACM Conference on Computer and Communications Security, 2001.
Friday, Nov. 6, 2020	MISSION	Mission 1 Debriefing Due, Mission 2 Launched
Tuesday, Nov. 10, 2020	Class: Authentication: Passwords	Sanam Ghorbani Lyastani, Michael Schilling, Sascha Fahl, Michael Backes, Sven Bugiel, "Better managed than memorized? Studying the Impact of Managers on Password Strength and Reuse," USENIX Security, 2018.
Friday, Nov. 13, 2020	Class: Authentication: Identity and SSO	Mohammad Ghasemisharif, Amruta Ramesh, Stephen Checkoway, Chris Kanich, Jason Polakis, "O Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-On Account Hijacking and Session Management on the Web," USENIX Security, 2018.
Tuesday, Nov. 17, 2020	Class: Authentication: Routing	Henry Birge-Lee, Yixin Sun, Anne Edmundson, Jennifer Rexford, Prateek Mittal, "Bamboozling Certificate Authorities with BGP," USENIX Security, 2018.
Friday, Nov. 20, 2020	Class: Authorization: Intrusion Detection	V. Paxson, "Bro: A system for detecting network intruders in real-time," Computer Networks, vol. 31, no. 23-24, pp. 2435 - 2463, 1999.
Friday, Nov. 20, 2020	MISSION	Mission 2 Debriefing Due, Mission 3 Launched
Tuesday, Nov. 24, 2020	Class: Availability: Botnets	S. Staniford, V. Paxson, and N. Weaver, "How to 0wn the Internet in your spare time," in Proceedings of the 11th USENIX Security Symposium, vol. 8, 2002, pp. 149 - 167.
Tuesday, Dec. 1, 2020	Class: VPNs: IPSec	C. Shue, Y. Shin, M. Gupta, J. Choi, "Analysis of IPSec Overheads for VPN Servers," IEEE International Conference on Network Protocols (ICNP) Network Protocol Security (NPSec) Workshop, Boston, MA, Nov. 2005.
Friday, Dec. 4, 2020	Class: Privacy	Antoine Vastel, Pierre Laperdrix, Walter Rudametkin, Romain Rouvoy, "FP-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies," USENIX Security, 2018.
Sunday, Dec. 6, 2020	MISSION	Mission 3 Debriefing Due
Tuesday, Dec. 8, 2020	Class: Phishing	C. Herley and D. Florencio, "A profitless endeavor: phishing as tragedy of the commons," in Proceedings of the 2008 ACM Workshop on New Security Paradigms, 2009, pp. 59 - 70.
Friday, Dec. 11, 2020	Class: Web Security	S. Stamm, Z. Ramzan, M. Jakobsson, "Drive-by Pharming," in Information and Communications Security, 2007.

Course Policies and Procedures

The following represent the official policies and procedures for the course. Please review this information and, if you have questions, discuss them with the professor as soon as possible.

Ethical Hacking Agreement

In this course, students will learn about security, both from a defender and an attacker's perspective. If these tools or techniques were misued, it could have negative ramifications for the student and university. To avoid any potential misunderstanding, students must submit an electronically signed Ethical Hacking Agreement form in the first week of class.

Students that do not sign an Ethical Hacking Agreement in the first week of class will effectively be dismissed from the class. These students will receive an NR grade for the course and will be unable to participate in the practical activities.

Official Communication

Class discussion, class hand-outs, emails to the student's WPI email account, the class discussion board, and the course Web pages are avenues for official course communication. Students are responsible for any information posted through these venues.

Textbooks

We will not be using an assigned textbook in this course. Students will be responsible for obtaining the reading from the links provided by the instructor and, if needed, printing it out for reading.

InstructAssist

This course will use the InstructAssist system which has been developed for interactive instruction. This system features in-class components, including Quiz Bowls and Activities, as well as out-of-class components, such as assignment submission and grading feedback.

This course will use the ScoreKeeper module in InstructAssist. This module allows automatic evaluation and testing of student work, allowing students to rapidly learn about and address any errors.

You can access the InstructAssist system for this class at https://ia.wpi.edu/cs4404/. You will be required to log in through WPI's Central Authentication Service with your WPI credentials to access the system.

Missions

This course will make extensive use of out-of-class assignments called "Missions." Each mission will have a series of objectives that must be met by students in order to earn credit. There will be three missions, each with smaller phases.

All missions must be performed in small teams, unless otherwise indicated. Students may discuss high-level ideas and provide advice to each other to help each other. However, all submitted work must be the result of the student team's own efforts and should not include files or systems used by other students. If students have questions about the appropriate about of collaboration, they should contact their instructor.

These missions are designed to allow students to apply the network security concepts learned in class. Many, if not all, of these missions will make use of an isolated computer network to allow students to experiment without introducing risk to the WPI network. Students will be required to use this physically isolated network using a portable computer in which they have administrative access. A set of virtual machines will be available on this network to help students with their experiments.

Each mission may have a different score weight associated with it. Students should not assume that all missions are of equal weight.

Programming Languages

In this course, the relevant tools students use may impose programming languages constraints. Since this is a 4000-level Computer Science, students are expected to learn a new programming language on-the-fly as needed to complete their tasks. However, students often may select the tool they use, often allowing them to work with tools that use languages the students have mastered.

Since this course is focused on tools and techniques, we recommend students use higher-level languages, such as scripting languages, where possible, so long as the projects meet the underlying performance goals.

Course Participation and Professionalism

During lectures, students are to be focused on the course. Students should not use materials or electronic devices that would inhibit their attention to the course lecture and discussion. Laptops may only be used for note-taking purposes; transmission capabilities on these devices must be disabled and only appropriate note-taking applications may be used in class.

Students must treat each other and the teaching staff with respect at all times. Disagreement, debates, and criticism of ideas are healthy aspects of academic environments; however, students be careful to avoid demeaning language or comments which can be taken personally. The ability to handle conflict professionally and work with a variety of people is an acquired skill, yet it is increasingly important in technical careers.

Late Submission

No quizzes may be submitted late. No make-up quizzes will be available.

Missions may be submitted late, but with significant penalties. Missions that are late, where t represents the amount of time late, will have the following penalties:

Missions and projects are due at the exact minute specified, with all times rounded down to the nearest minute. The submission system is synchronized via NTP with the CS department servers. This time will be considered official.

Any missions submitted after 4pm on Tuesday, December 8, 2020 will not be graded.

Course Grading

A description of each of the class components is as follows:

• Video Responses (40%): Ahead of each class meeting, students will be asked to read relevant research papers and view pre-recorded lecture segments. Students will then be asked to record video responses to five questions/prompts and submit them for grading. Each response may be no more than 60 seconds and should answer the question/prompt as thoroughly (yet concisely) as possible. Each response will be graded on technical accuracy, completeness, display of mastery of the material, and presentation effectiveness. After the submission deadline, the teaching staff will choose specific questions/prompts and grade all student submission for those questions/prompts. Other responses will not be graded. Students will not be informed in advance as to which prompts will be selected for grading and are thus expected to submit high-quality responses to all prompts/questions.
   
  While the video responses will be used for assesment, they also intended to serve as a learning opportunity since it requires students to contemplate and distill the material. Students must create their video responses on their own. They may consult research papers, the instructor's videos, and textbooks in preparing their materials. However, they must not consult other individuals, including other students in the class or via Internet forums, while completing the assignment. Students must determine how best to present the materials, including metaphors/analogies or visual aids, independently.
   
• Missions (55%): There will be three missions in the course where students will learn and apply concepts in a practical setting. These missions may be completed in small groups. These missions may have different point values and may have "checkpoint" deliverables in which students must show substantial progress towards completing the assignment.
   
• Participation and Professionalism (5%): Students are expected to be engaged in class, answering questions from the instructor and asking questions when needed. Students must regularly attend classes and show up to demonstration times they schedule. Disregard for course policies or unprofessional conduct with students or the teaching staff will be penalized. This grading component is a signed value, allowing students to earn a negative score for abusive behavior. Students that simply attend class each day and participate adequately in Quiz Bowls and Activities should expect to earn around an 85% in participation. Voluntary participation in discussion or the discussion board, via questions or comments, is required to earn full credit in this category.
   

BS/MS Graduate Credit

Students may take this course for graduate credit by students in the BS/MS Computer Science program. Students that are interested in obtaining graduate credit will need to make the appropriate arrangements with the professor at the beginning of the class. For two graduate credits, students will need to earn a high grade in the course. For three graduate credits, students will need to make an in-class presentation and paper critique, as well as achieve a minimum final course grade, to obtain such credit.

Student Accessibility Services

Students with approved academic accommodations should plan to submit their accommodation letters through the Office of Accessibility Services Student Portal. Should you have any questions about how accommodations can be implemented in this particular course, please contact me as soon as possible. Students who are not currently registered with the Office of Accessibility Services (OAS) but who would like to find out more information regarding requesting accommodations and what that entails should plan to contact them via email: AccessibilityServices@wpi.edu and/or via phone: (508) 831-4908.

Academic Integrity

The WPI Academic Integrity Policy describes types of academic dishonesty and requirements in documentation. In the case of academic dishonesty, I am required to report the incident to the Dean of Student Affairs. Further, my penalty for academic dishonesty is to assign a NR grade for the course.

In this class, students may not look at any previous versions of a course assignment or project, regardless of how it is posted. If a student accidentally discovers such a posting, they must report it to the instructor immediately, avoid the resource in the future, and delete any copies that are cached on their computer.

Students are likewise forbidden from facilitating other students, current or future, in plaigarism or cheating. Students may not distribute their code publicly on the Internet, or in other means, during the term or even after the class has concluded. Students may share their code with potential employers or other individuals privately, so long as the code would not become available to other WPI students.