Secure Systems Engineering

Fall 2024

A first course in the design and implementation of secure and private systems. Attacks against low-level programming, secure software engineering practices, and the use of Rust to develop secure systems. Detailed study of important secure systems such as TLS, messaging, and anonymity networks. Side channels and back doors in security-sensitive systems. Advanced topics and case studies in secure systems engineering. The course will culminate in a final project where students will engineer a secure system for a chosen application. (3 credits)

Prerequisites: EE 34400 Digital Computer Systems or CSC 33200 Operating Systems or Program Director Approval.

Course instructor: Tushar Jois (Office hours: Thu 4:30 - 5p in Steinman 638)

Course text: None (zero textbook cost). We will be using publicly available materials.

Course Schedule

This course schedule is subject to change at any time. The course staff will notify students of any schedule changes as they occur. Assignment submission and grades will be on Blackboard.

Take note of the midterm exam dates. I expect all students to take these exams in person; please let the course staff know of any issues at least two weeks before any potential absences.

If you are unable to keep up with the course, or expect to miss class due to extenuating circumstances, please inform the course staff as soon as possible.

Take my advice: don't fall behind!

Course Goals

1. Know the core concepts of computer security, both in theory and practice
2. Apply the proper defenses to common attacks on systems
3. Understand the societal, cultural, and political implications of the field
4. Be prepared for research in computer security, if they so choose

Coursework and Grading

Formative assignments are designed to get you familiar with the material and try out concepts. As they are for practicing, formative assignments are graded only to ensure completion of assigned tasks. However, content from these assignments will appear on the exams. It is important to complete these assignments with full effort to truly comprehend all of the material; simply attending lectures is insufficient. The following are this course's formative assignments:

• Assignments. These are hands-on introductions to computer security attacks and defenses, completed during the activity portion of class time. Note that some labs are longer than others, and may require additional work outside of class to complete.
• Reading quizzes. These are short quizzes to check completion and understanding of the required reading assigned for a class. Partial credit will be awarded to those who attend class but did not do the reading.
• Project check-ins. These are simple activities designed to ensure your progress on the course project, allowing you to request assistance if necessary.

Summative assessments on the other hand, are designed to evaluate your progress in the course. These form the majority of your final grade in the course. Content on these assessments will be derived from course material. The following summative assessments will be utilized in the course:

• Midterm exams. There will be two non-cumulative exams during the semester, to be completed synchronously in-class. You may have a hand-written, double-sided, 8.5” x 11” note sheet for the exam.
• Course project. There will be a group course project that synthesizes the skills developed in the course. The first part will involve coding and a demonstration of your code to the instructor. The second part will involve a security analysis of another group's code and a final presentation.

The course will be weighted as follows:

The following grade scales will apply to weighted scores, at a minimum:

The instructor may choose to curve all class grades up at the end of the course, and the above cutoffs could shift, which might improve your grade. Note that this is not guaranteed, and would occur at the instructor's sole discretion.

Extra credit will be awarded to the reading quizzes grade for each attendance at a Cybersecurity Seminar. Details on this opportunity will be posted later.

Warning

This course will include topics related computer security and privacy. As part of this investigation we may cover technologies whose abuse could infringe on the rights of others. As computer scientists and engineers, we rely on the ethical use of these technologies. Unethical use includes circumvention of an existing security or privacy mechanism for any purpose, or the dissemination, promotion, or exploitation of vulnerabilities of these services. Any activity outside the letter or spirit of these guidelines will be reported to the proper authorities and may result in dismissal from the class and possibly more severe academic and legal sanctions.

Acting lawfully and ethically is your responsibility. Carefully read the Computer Fraud and Abuse Act (CFAA), a federal statute that broadly criminalizes computer intrusion. This is one of several laws that govern "hacking." Understand what the law prohibits. If in doubt, we can refer you to an attorney.

In addition to the law, as members of the City College of New York and users of its computer systems, you are also bound by its policies on computer use.

Class Climate

If you ever have concerns in this course about harassment, discrimination, or any unequal treatment, or if you seek accommodations or resources, I invite you to share directly with me, the department, or university administration. We promise that we will take your communication seriously and seek mutually acceptable resolutions and accommodations. Reporting will never impact your course grade. In handling reports, people will protect your privacy as much as possible, but faculty and staff are required to officially report information for some cases (e.g. sexual harassment).

Accessibility

If you are struggling with anxiety, stress, depression, or other mental health-related concerns, please consider visiting the CCNY Counseling Center. If you are concerned about a friend, please encourage that person to seek out their services.

You are welcome to bring a family member to class on occasional days when your responsibilities require it (for example, if emergency childcare is unavailable, or for the health needs of a relative). Please be sensitive to the classroom environment, and if your family member becomes uncomfortably disruptive, you may leave the classroom and return as needed.

Academic Integrity

Academic dishonesty is prohibited in The City University of New York. Penalties for academic dishonesty include academic sanctions, such as failing or otherwise reduced grades, and/or disciplinary sanctions, including suspension or expulsion.

Academic integrity is at the core of a college or university education. Faculty assign essays, exams, quizzes, projects, and so on both to extend the learning done in the classroom and as a means of assessing that learning. When students violate the academic integrity policy (i.e., “cheat”), they are committing an act of theft that can cause real harm to themselves and others including, but not limited to, their classmates, their faculty, and the caregivers who may be funding their education. Academic dishonesty confers an unfair advantage over others, which undermines educational equity and fairness. Students who cheat place their college's accreditation and their own future prospects in jeopardy.

On every exam, you will sign the following pledge: “I agree to complete this exam without unauthorized assistance from any person, materials or device.”

Note on Generative AI: This course assumes that all work (i.e., formative assignments and summative assessments) and communications (i.e., messages and emails) have been created by the student or the student's group. The use of generative AI tools (such as ChatGPT, Copilot, Gemini, and others) to complete this course is strictly prohibited, and will be treated as academic dishonesty. Please contact the instructor if you have questions.