CS440X D09: Software Security Engineering Assignments

CS 440X (D09): Software Security Engineering
Assignments and Grading

Course grades will be based on homeworks, projects, and class participation using the following weights. There will be no exams.

Assignments: 50%
Course Project: 25%
Class Presentation: 10%
Student-driven Participation: 15%

Assignments

Project 1: Turnout-Web -- Three due dates starting Monday, March 23

Project 2: Threat Modeling and Mitigation -- due Monday, April 6

Project 3: Turnout-C -- Three due dates starting Friday, April 10

Course Project

The class project is to implement a web-based social network.

Class Presentation

Each student is required to take charge of at least one discussion item for at least one lecture during the course. Discussion slots are listed on the syllabus page. See the presentation guidelines for expectations on your presentations.

There is still time in the schedule for additional tool demos or mini presentations. If you want to do something towards your participation credits, let me know.

Student-driven Participation

This is a very hands-on class, with less formal lecturing than you are probably used to. You will be experimenting with breaking and patching code, learning about best practices in security, and exploring security-related questions and tools. I expect you to actively participate in learning and sharing material with other students though in-class presentations, in-class discussions, wiki postings, and the discussion board.

Sample actions you can take to earn participation credit (feel free to propose others):

Post a review of a security-related current event to the wiki.
Engage in discussion of other students' reviews on the wiki/DB.
Learn how to use some security-bug analysis tool and give a demo to the class
Post links to interesting new content to the wiki/DB
Volunteer to cover one of the discussion topics for class

Participation credit will be earned based on both the effort required and the quality of your work. For example, commenting on someone else's review is worth more than writing the original review. A poorly-written review, or a review that you essentially copied from the web is worth less than a thoughtful review that frames the issue against the themes raised in the course (a review plagiarized from the web runs you afoul of the academic honesty policy).

The participation system is designed to let you focus on topics within software security and communication styles that are most important to you. Overall, I want you to demonstrate self-driven learning and conveying material to others. Both are essential when you work as part of a team learning a new area.