5.44. Computer Security (Mandatory)

5.44. Computer Security (Mandatory)

Figure 5.44: Connection Map. CS3I1 Computer Security

5.44.1. Justification ↑ Back to top

In an increasingly digital world, security is no longer an optional feature but a fundamental requirement. This course provides a comprehensive introduction to the principles and practices of cybersecurity, covering everything from theoretical foundations to secure coding and digital forensics. Students will gain the skills necessary to design, implement, and govern secure systems while understanding the ethical and professional responsibilities involved in protecting information and infrastructure.

5.44.2. Generales Goals ↑ Back to top

  1. Understand the fundamental principles and mathematical bases of security.
  2. Apply secure coding techniques and cryptographic methods to software.
  3. Analyze system vulnerabilities and perform forensic investigations.
  4. Evaluate security governance and professional ethics in cybersecurity.

5.44.3. Contribution to Outcomes ↑ Back to top

AG-C11) Use of Tools: Applies modern computing tools in problem solving. (Usage)
AG-C09) Design and Development of Solutions: Designs, implements, and evaluates solutions for complex computing problems. (Usage)

5.44.4. Content ↑ Back to top

5.44.4.1. Security Mindset and Principles (6 hours) [Skills AG-C09,AG-C11] ↑ Back to top

Bibliography: (Pfleeger et al., 2015; Stallings, 2017)

Topics

  1. Developing a security mindset incorporating crosscutting concepts: confidentiality, integrity, availability, risk assessment, systems thinking, adversarial thinking, human-centered thinking.
  2. Vulnerabilities, threats, attack surfaces, and attack vectors Protection and Safety .
  3. Denial of Service (DoS) and Distributed Denial of Service (DDoS) Protection and Safety .
  4. Principles and practices of protection, e.g., least privilege, open design, fail-safe defaults, defense in depth, and zero trust; and how they can be implemented Principles of Operating System , Protection and Safety , Coding Practices , Large-Scale Construction and Process , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
  5. Optimization considerations between security, privacy, performance, and other design goals System Design , Software Development Practices , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
  6. Concepts of trust and trustworthiness.

Learning Outcomes

  1. Evaluate a system for possible attacks that can be launched by an adversary [Evaluate]
  2. Design and develop approaches to protect a system from a set of identified threats [Design]
  3. Describe how harm to user privacy can be avoided [Describe]
  4. Develop a system that incorporates various principles of security and privacy [Create]
5.44.4.2. Cryptography Fundamentals (8 hours) [Skills AG-C09,AG-C11] ↑ Back to top

Bibliography: (Stallings, 2017)

Topics

  1. Differences between algorithmic, applied, and mathematical views of cryptography.
  2. Mathematical preliminaries: modular arithmetic, Euclidean algorithm, probabilistic independence, linear algebra basics, number theory, finite fields, complexity, asymptotic analysis Discrete Mathematics , Linear Algebra .
  3. Basic cryptography: symmetric key and public key cryptography Foundational Data Structures , Foundational Algorithms , Advanced Algorithms , Discrete Mathematics .
  4. Classical cryptosystems, such as shift, substitution, transposition ciphers, code books, and machines Discrete Mathematics .
  5. Kerckhoff's principle and use of vetted libraries Coding Practices , Large-Scale Construction and Process .

Learning Outcomes

  1. Explain the role of cryptography in supporting security and privacy [Explain]
  2. Discuss the risks of inventing one's own cryptographic methods [Debate]
  3. Discuss the importance of prime numbers in cryptography and explain their use in cryptographic algorithms [Debate]
  4. Implement and cryptanalyze classical ciphers [Implement]
5.44.4.3. Injection and Input Validation (8 hours) [Skills AG-C09,AG-C11] ↑ Back to top

Bibliography: (Pfleeger et al., 2015)

Topics

  1. Common vulnerabilities and weaknesses.
  2. SQL injection and other injection attacks.
  3. Cross-site scripting techniques and mitigations.
  4. Input validation and data sanitization Protection and Safety , Basic Programming Concepts and Constructs , Programming Practices: Testing, Debugging, and Documentation , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .

Learning Outcomes

  1. Identify underlying problems in given examples of an enumeration of common weaknesses and explain how they can be circumvented [Analyze]
  2. Apply input validation and data sanitization techniques to enhance security of a program [Apply]
  3. Evaluate and prevent SQL injections attacks on a database application [Evaluate]
  4. Evaluate and prevent cross-site scripting attacks against a website [Evaluate]
  5. Construct a program that tests for all input handling errors [Create]
5.44.4.4. Malware Analysis and Advanced Security (6 hours) [Skills AG-C09] ↑ Back to top

Bibliography: (Sikorski and Honig, 2012; Eilam, 2005; National Institute of Standards and Technology, 2020)

Topics

  1. Offensive security techniques as a defense.
  2. AI-assisted malware detection techniques.
  3. Ransomware: creation, prevention, and mitigation.
  4. Secure use of third-party components Coding Practices , Large-Scale Construction and Process , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
  5. Malware: varieties, creation, reverse engineering, and defense against them Language Translation and Execution , Systems Execution and Memory Model .
  6. Assurance: testing (including fuzzing and penetration testing), verification, and validation Protection and Safety , Basic Programming Concepts and Constructs , Programming Practices: Testing, Debugging, and Documentation , Coding Practices , Large-Scale Construction and Process , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
  7. Static and dynamic analyses Program Analysis and Analyzers , Protection and Safety , Evaluation , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
  8. Secure compilers and secure code generation Language Translation and Execution , Run-time Behavior and Systems .

Learning Outcomes

  1. Describe different kinds of malicious software [Describe]
  2. Explain the risks of misusing interfaces with third-party code and how to correctly use third-party code [Explain]
  3. Discuss the need to update software to fix security vulnerabilities and the lifecycle management of the fix [Debate]
  4. Apply static and dynamic tools to identify programming faults [Apply]
  5. Evaluate a system for the existence of malware and remove it [Evaluate]
  6. Implement preventive techniques to reduce the occurrence of ransomware [Implement]
5.44.4.5. Threat Analysis and Security Engineering (8 hours) [Skills AG-C09,AG-C11] ↑ Back to top

Bibliography: (Anderson, 2020)

Topics

  1. Security engineering goals: building systems that remain dependable despite errors, accidents, or malicious adversaries Coding Practices , Large-Scale Construction and Process , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
  2. Problem analysis and situational analysis to address system security Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
  3. Security analysis, covering security requirements analysis; security controls analysis; threat analysis; and vulnerability analysis Program Analysis and Analyzers , Evaluation .
  4. Security attack domains and attack surfaces, e.g., communications and networking, hardware, physical, social engineering, software, and supply chain Network Security .
  5. Security attack modes, techniques, and tactics, e.g., authentication abuse; brute force; buffer manipulation; code injection; content insertion; denial of service; eavesdropping; function bypass; impersonation; integrity attack; interception; phishing; protocol analysis; privilege abuse; spoofing; and traffic injection Network Security , Protection and Safety , Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .

Learning Outcomes

  1. Create a threat model for a system or system design [Create]
  2. Apply situational analysis to develop secure solutions under a specified scenario [Apply]
  3. Identify and mitigate security vulnerabilities and weaknesses in a system [Analyze]
5.44.4.6. Digital Forensics Techniques (6 hours) [Skills AG-C09,AG-C11] ↑ Back to top

Bibliography: (Pfleeger et al., 2015)

Topics

  1. Basic principles and methodologies for digital forensics.
  2. System design for forensics.
  3. Forensics in different situations: operating systems, file systems, application forensics, web forensics, network forensics, mobile device forensics, use of database auditing Network Security .
  4. Attacks on forensics and preventing such attacks.

Learning Outcomes

  1. Explain what a digital investigation is and how it can be implemented Computer Crimes and Attacks , Security Laws, Policies and Responsibility [Explain]
  2. Design and implement software to support forensics [Design]
  3. Extract data from a hard drive to comply with the law Computer Crimes and Attacks , Security Laws, Policies and Responsibility [Extract]
  4. Recover data based on a given search term from an imaged system [Analyze]
  5. Reconstruct data and events from an application history, or a web artifact, or a cloud database, or a mobile device. Mobile Platforms: Capabilities and Asynchronous Computing , Mobile Platforms: Architecture and Constraints , Mobile Platforms: Development Fundamentals , Cloud Architecture and Data Management , Frontend, Frameworks and Web Standards [Apply]
  6. Capture and analyze network traffic. Network Security [Analyze]
  7. Develop approaches to address the challenges associated with mobile device forensics [Create]
  8. Apply forensics tools to investigate security breaches [Apply]
  9. Identify and mitigate anti-forensic methods [Analyze]
5.44.4.7. Security Governance, Management and Policy (6 hours) [Skills AG-C09,AG-C11] ↑ Back to top

Bibliography: (Anderson, 2020)

Topics

  1. Protecting critical assets from threats.
  2. Security governance: organizational objectives and general risk assessment.
  3. Security management: achieve and maintain appropriate levels of confidentiality, integrity, availability, accountability, authenticity, and reliability Performance Testing and Benchmarking , Testing Tools and Analysis , Verification and validation Concepts , Test Planning and Types , Advanced Testing Practices .
  4. Security policy: organizational policies, issue-specific policies, system-specific policies.

Learning Outcomes

  1. Describe critical assets and how they can be protected [Describe]
  2. Differentiate between security governance, management, and controls, giving examples of each [Differentiate]
  3. Describe a technical control and implement it to mitigate specific threats [Describe]
5.44.4.8. Security Ethics, Law and Society (6 hours) [Skills AG-C09,AG-C11] ↑ Back to top

Bibliography: (Anderson, 2020; Pfleeger et al., 2015)

Topics

  1. Societal impacts on breakdowns in security and privacy Digital Equity and Accessibility , Social Impact and AI , Civil Liberties and Expression , Data, Surveillance and Privacy Technology , Privacy Philosophical Foundations and Legislation , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
  2. Applicability of laws and regulations on security and privacy Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
  3. Professional ethical considerations when designing secure systems and maintaining privacy; ethical hacking Civil Liberties and Expression , Data, Surveillance and Privacy Technology , Privacy Philosophical Foundations and Legislation , Ethics Codes and Legal Accountability , Professional Responsibility and Public Policy , Professional Values, Nature and Continuing Development , Ethical Dissent and Cultural Context , Workplace Ethics , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
  4. Security and privacy implications of malicious AI/machine learning actors, e.g., identifying deep fakes Machine Learning Formulation and Evaluation , Deep Learning, RL and Ethics , Introduction to AI: Concepts and Intelligent Behavior , Problem Characteristics and Agent Nature , Machine Learning Fundamentals , Machine Learning Data, Representations and Evaluation , Neural Networks and Ethics , Civil Liberties and Expression , Data, Surveillance and Privacy Technology , Privacy Philosophical Foundations and Legislation , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .
  5. Societal impacts of Internet of Things (IoT) devices and other emerging technologies on security and privacy Civil Liberties and Expression , Data, Surveillance and Privacy Technology , Privacy Philosophical Foundations and Legislation , Computer Crimes and Attacks , Security Laws, Policies and Responsibility .

Learning Outcomes

  1. Calculate the impact of a breakdown in security of a given system [Calculate]
  2. Construct a system that conforms to security laws [Create]
  3. Apply a set of privacy regulations to design a system that protects privacy [Apply]
  4. Evaluate the legal ramifications of a system not corresponding to applicable laws and regulations [Evaluate]

5.44.5. Bibliography ↑ Back to top

Pfleeger, C. P., Pfleeger, S. L., and Margulies, J. (2015). Security in Computing. Prentice Hall, 5th edition.

Stallings, W. (2017). Operating Systems: Internals and Design Principles. Pearson, 9th edition.

Sikorski, M. and Honig, A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press, San Francisco, CA.

Eilam, E. (2005). Reversing: Secrets of Reverse Engineering. Wiley, Indianapolis, IN.

National Institute of Standards and Technology (2020). Security and privacy controls for information systems and organizations. Technical Report NIST SP 800-53 Rev. 5, National Institute of Standards and Technology, Gaithersburg, MD. Disponible en: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final.

Anderson, R. J. (2020). Security Engineering: A Guide to Building Dependable Distributed Systems. Wiley, 3rd edition.

Spotted a typo, an outdated course, a broken link, or have a suggestion? Let us know.

Scan to open on your phone