SEN2008 · Yazılım Güvenliği

Software Security

Network layers, TCP/IP, security basics, cryptography and secure software development.

Textbook: Computer Networking: A Top Down Approach Featuring the Internet”, 2005, 3th edition, Jim Kurose, Keith Ross, Addison-Wesley. ""Network Security"", Second Edition, Kaufman, Perlman, and Speciner

  1. Week 1
    Course Outline
    • Networks and security: the big pictureWhat the Internet is, the difference between packet switching and circuit switching, and the four kinds of delay (transmission, propagation, queuing, processing). Every calculation in the rest of the course builds on these formulas.
  2. Week 2
    Introduction : Overview of computer networks, Networking Basics, Protocol Layering, Physical Layer
    • Protocol layers and the physical layerThe OSI and TCP/IP layer models, encapsulation and overhead calculation, and bandwidth, bit rate and baud with the Nyquist and Shannon limits at the physical layer.
  3. Week 3
    Data Link Layer Concepts (I) : error detection and correction, elementary protocols, sliding window protocols
  4. Week 4
    Data Link Layer Concepts (II) : Channel allocation problem, multiple Access, Ethernet
    • Channel allocation and multiple access: ALOHA, CSMA, CSMA/CDWhen many nodes share a single broadcast channel, who talks when? The flaw of static allocation, pure and slotted ALOHA efficiency, CSMA/CD, minimum frame size, and binary exponential backoff.
    • Ethernet, MAC addresses, switches and ARPThe fields of an Ethernet frame, minimum and maximum size, the structure of the 48-bit MAC address, the switch learning table, going from IP to MAC with ARP, and attacks on these such as ARP spoofing and MAC flooding.
  5. Week 5
    Network Layer Concepts (I): , internetworking, Internet Protocol (IP, IPv6)
    • IPv4 addressing, subnets and CIDRFinding the network address, broadcast, host range and number of hosts from an IP address bit by bit; subnetting, VLSM and longest prefix match. A guaranteed calculation question on the midterm.
    • The IPv4 header, fragmentation, NAT and IPv6The fields of the IPv4 datagram header, fragmentation and offset calculation caused by the MTU, how the NAT table works, and how IPv6 differs from IPv4. The fragmentation calculation is a classic hard midterm question.
  6. Week 6
    Network Layer Concepts (II): Routing Protocols OSPF, BGP, multicasting
    • Routing algorithms: Dijkstra and Bellman-FordFilling in the link-state (Dijkstra) table step by step, updating distance-vector (Bellman-Ford) vectors round by round, count-to-infinity and poisoned reverse. The table-filling question on the midterm comes from here.
    • OSPF, BGP and multicastOSPF inside an AS (cost calculation, areas), BGP between ASes (eBGP/iBGP, AS-PATH, NEXT-HOP, route selection, hot potato) and multicast (IGMP, trees, multicast MAC mapping). The page for concept questions and small calculations.
  7. Week 7
    Transport Layer Concepts (I): Services, elements of a transport protocol, TCP, UDP
  8. Week 8
    Transport Layer Concepts (II): Congestion Control, Flow Control
  9. Week 9
    Midterm
    • Midterm review: from network basics to TCPAll the formulas of weeks 2-8 in one table, which exam question fits which pattern, and a mixed 12-question practice test: Shannon, CRC, sliding window, subnetting, fragmentation, Dijkstra, Bellman-Ford, handshake, cwnd, RTT estimation.
  10. Week 10
    Security Fundamentals (I): Security Concepts, Vulnerabilities, Threats and Attacks
    • Security fundamentals: CIA, threats and attacksThe concepts of asset, vulnerability, threat, attack and risk; the CIA triad; DoS/DDoS, MITM, spoofing, phishing and types of malware. The definition and risk calculation questions of the final exam come from here.
  11. Week 11
    Security Fundamentals (II): Software Security, Information Assurance, Sources of Software Nontechnical security issues, Example Security Technologies
  12. Week 12
    Computer and Network Security: Security Techniques (Encryption, digital signatures, message authentication, and hash functions, Use of cryptography for network security, Protection and defense mechanisms and tools
    • Symmetric encryption: from Caesar to AES, modes of operationThe basic language of encryption, hand encryption with Caesar and Vigenère, XOR and the one-time pad, the idea of DES/AES, the ECB/CBC/CTR modes and the key distribution problem. Hand encryption and mode questions are here.
    • Public key, hash, MAC, signature, PKI and TLSRSA and Diffie-Hellman by hand with small numbers, SHA-256 and the birthday bound, MAC/HMAC, digital signatures, certificate chains and the TLS handshake. The RSA and DH calculation questions of the exam are on this page.
  13. Week 13
    Software Security (I): Developing Secure Software, Secure design principles and patterns, Building security into the software development life cycle, Security in requirements
  14. Week 14
    Software Security (II): Secure software construction techniques, Security-related verification and validation
    • Secure coding: input validation, SQL injection, XSS, buffer overflow, CSRFYou learn the five most common coding vulnerabilities by seeing vulnerable and fixed code side by side. The exam questions 'what is wrong in this code, how do you fix it' and 'what does the query become with this input' come from here.
    • Security testing and the OWASP Top 10You learn what static analysis, dynamic scanning, fuzzing, penetration testing and code review find and when, plus the OWASP Top 10 (2021) list. The exam asks 'which category is this scenario' and tool metrics (precision, recall).