COMP 4/6420 Network and Mobile Security - Fall2022

Teaching Team

Lecturer: Kan Yang. Email: kan.yang AT memphis.edu

TA: TBA

Course Description

This course will discuss security issues and solutions in computer and mobile networks. Topics include Web Security (web security mode, web application security), Cryptography (symmetric cryptography, public-key cryptography, SSL/TLS, and other crypto tools), Network Security (security issues in network protocols, network defense tools, DoS attacks, etc.), Mobile Security (mobile platform security models, mobile threats and malware), and Cloud Security. (The content and syllabus are subject to adjustment during the semester.)

Lecture

Tuesday/Thursday, 1:00 pm - 2:25 pm, Fogelman Classroom Building 127

Office Hours

With TA: TBA

With Lecturer: By appointment only (Please arrange by email 2-3 days in advance)

Textbook

Internet Security: A Hands-on Approach 3rd Edition (ISBN: 978-17330039-6-4), by Wenliang Du. Purchase on Amazon

Evaluation

Grading: Final Grades = Homework (20%) + Quizzes(10%) + Lab (25%) + Midterm (20%) + Final Exam (25%).

Grading Scale: A: 85 – 100, B: 70 – 84, C: 60 – 69, D: 50 – 59, F: 49 and below. (Plus/minus grading will be used).

Course Policy

Late Policy: Without prior request, no late work will be accepted. All late submission maybe accepted at a penalty of 15% per day for no more than THREE days.
Testing Policy: The exam given is closed book/note/laptop/neighbor. But students are allowed to bring one cheat sheet (letter-sized 8.5-by-11) for quick reference. There will NOT be any makeup exams unless there is a documented emergency.
Homework Assignment and Project Report Policy: It is recommended that students use a word processing software (e.g., Word or LaTeX) to type their homework solutions or project report, then submit well-formatted PDF files.

Course Schedule

Part I: Introduction

Week 1:
- Aug 23 - Lecture 1: Course Intro
- Aug 25 - Lecture 2: Security Intro

Part II: Web Security

Week 2:
- Aug 30 - Lecture 3: Web Security Overview
  Optional Reading:
  - Same-origin Policy, Browser Security Handbook, part 2, by Michal Zalewski.
  - Securing Frame Communication in Browsers, by Adam Barth, Collin Jackson, and John C. Mitchell.
  - The Security Architecture of the Chromium Browser, by Adam Barth, Collin Jackson, Charles Reis, and Google Chrome Team.
- Sep 1 - Lecture 4: Web Security - SQL Injection
  Optional Reading:
  - Advanced SQL Injection in SQL Server Applications, by Chris Anley.
  - SQL Injection Attacks by Example, by Steve Friedl's Unixwiz.net Tech Tips.
  - SQL Injection Cheat Sheet, OWASP.
Week 3:
- Sep 6 - Lecture 5: Web Security - Cross-Site Scripting
  Optional Reading:
  - Cross Site Scripting Explained, by Amit Klein.
  - XSS Attack Examples, by Lakshmanan Ganapathy.
  - XSS Filter Evasion Cheat Sheet, OWASP.
- Sep 8 - Lecture 6: Web Security - Cross-Site Request Forgery
  Optional Reading:
  - Cross-Site Request Forgeries: Exploitation and Prevention, by William Zeller and Edward W. Felten.
  - Robust Defenses for Cross-Site Request Forgery, by Adam Barth, Collin Jackson, and John C. Mitchell.
  - CSRF Prevention Cheat Sheet, OWASP.
Week 4:
- Sep 13 - Lecture 7: Web Security - Session Management
  Optional Reading:
  - Secure Session Management With Cookies for Web Applications, by Chris Palmer.
  - Origin Cookies: Session Integrity for Web Applications, by Bortz et al.

Part III: Cryptography

Week 4:
- Sep 15 - Lecture 8: Cryptography - Symmetric Cryptography I
  Optional Reading:
  - Symmetric Cryptography Optional Notes
Week 5:
- Sep 20 - Lecture 9: Cryptography - Symmetric Cryptography II
- Sep 22 - Lecture 10: Cryptography - Symmetric Cryptography III
Week 6:
- Sep 27 - Lecture 11: Cryptography - Public Key Cryptography I
  Optional Reading:
  - Asymmetric Cryptography Optional Notes
- Sep 29 - Lecture 12: Cryptography - Public Key Cryptography II
Week 7:
- Oct 4 - Lecture 13: HTTPS
- Oct 6 - Lecture 14: Midterm Review
Week 8:
- Oct 11 - Fall Break
- Oct 13 - Lecture 15: Midterm

Part IV: Network Security

Week 9:
- Oct 18 - Lecture 16: Networking Overview
- Oct 20 - Lecture 17: Network Security Issues
Week 10:
- Oct 25 - Lecture 18: Network Defense Tools: Firewalls, VPN and Intrusion Detection
- Oct 27 - Lecture 19: DNS Security
Week 11:
- Nov 1 - Lecture 20: Denial of Service (DoS) Attacks
- Nov 3 - Lecture 21: Wireless Network Security Overview

Part V: Mobile Security

Week 12:
- Nov 8 - Lecture 22: iOS Security
- Nov 10 - Lecture 23: Android Security
Week 13:
- Nov 15 - Lecture 24: Malware Overview
- Nov 17 - Lecture 25: Final Review
Week 14:
- Nov 22 - Lecture 26: Final Exam

Course Labs

SEED Lab VM Setup

Many thanks to the SEED Lab developed by Dr. Wenliang Du! Follow the instructions to setup the lab environment.