This lecture provides an overview of the module.

• Here are 3 cipher texts, the plain texts are all in English and encrypted using a simple substitution cipher. The 3rd one is hard, let me know if you can break it.
• Mark Ryan's Lecture notes on Symmetric Key Crypto.
• Chapter 11 of Computer Security, Gollmann
• Chapter 5 of Security Engineering, Anderson
• Volker Sorge's Cryptography module
• Tools for encryption:
  • Truecrypt
• Further/Background reading:
  • Applied Cryptography, Bruce Schneier.
  • The Code Book, by Simon Singh (a good pop science history of encryption).

This lecture will cover what you need to know about cryptography for this module, including:

• Symmetric Key Encryption
  • DES, 3-DES
  • AES
  • Block cipher modes
  • Probabilistic and Padded Encryption

• Mark Ryan's Lecture notes on Public Key Crypto.
• Chapter 11 of Computer Security, Gollmann
• Chapter 5 of Security Engineering, Anderson
• Volker Sorge's Cryptography module
• Tools for encryption:
  • GPG, a public key encryption suite.
• Further/Background reading:
  • Why Johnny Can't Encrypt This paper gives some of the reasons why PGP never really became popular.
  • Applied Cryptography, Bruce Schneier.

Part 2 of the last lecture including:

• The Diffie-Hellman protocol
• Public Key Encryption
  • RSA
  • The key distribution problem
  • Encryption in practice

An overview of Java and the Crypto APIs, (needed for Exercise 1), including:

• Mark Ryan's Lecture notes on Access Control.
• A list of common Linux/Unix access control commands here.
• The Chapter 4: Access Control of Security Engineering by Ross Anderson
• Chapters 4, 6 & 7 of Computer Security by Dieter Gollmann

This lecture will look at ways in which access to files and resources is controlled, once you have logged onto a computer.

• Access Control Models:
  • Access Control Matrices
  • Access Control Lists
  • Capability Lists
  • Role Based Access Control
  • Lattice of Security Levels
• Access Control in Linux
• Access Control in Windows

• Java code to hash strings can be found here
• Mark Ryan's Lecture notes on Hashes.
• Password Protection for Modern Operating Systems by Steven Alexander
• Tools for password cracking
  • John The Ripper
  • Ophcrack
• Further reading:
  • Applied Cryptography, Bruce Schneier.

• Hashes:
  • Properties of hash functions
  • MD5
  • SHA1, SHA2, SHA3
  • Collision attacks
• Message Authentication Codes
• Cracking password files
  • Guessing attacks
  • Time space tradeoff
  • Rainbow tables
  • Protection via salt

• Example Socket code can be found here.
• Tools:
  • nmap
  • Wireshark

• Sockets
• TCP/IP
• Network address translation
• URLs

• The lecture handout, with example SSL code.
• Chapter 12 of Computer Security by Dieter Gollmann.
• Mark Ryan's Lecture notes on Certificates.
• Lecture 6 on Secure Sockets (TLS/SSL) from the ICW module.

• Authentication and Key Establishment Protocols
  • Alice and Bob notation
  • Needham-Schroeder Public Key Protocol
  • Needham-Schroeder Symmetric Key Protocol
  • Kerberos
  • TLS/SSL
• Certificates

• The lecture handout with JavaScript and JSP code can be follow here.
• The w3schools website provides some good tutorials on these basic concepts, include:
  • HTML
  • JavaScript
  • SQL
• Last years ICW module covered some of these topics, the lectures for this module can be found here

This gives an overview of how basic webpages work. Including:

• HTML
• URLs and HTTP
• JavaScript
• PHP
• JSP
• SQL

• The Burp Proxy
• More on SQL attacks can be found in (more) Advanced SQL Injection a pdf from NGS software.

Common attacks on websites, including:

• SQL injection
• Cross site scripting (XSS)
• Cookie attacks
• Cross request forgery (CSRF)

• The Gruyere Website which was used to demostrate these attacks.
• A story about the Twitter "mouseover" XSS attack.
• More on CSRF attacks can be found in the paper Robust Defenses for Cross-Site Request Forgery (pdf).

Common attacks on websites, including:

• SQL injection
• Cross site scripting (XSS)
• Cookie attacks
• Cross request forgery (CSRF)

This lecture gaves an introduction to the theory and practice of computer, including:

• A Traceability Attack Against e-Passports, Tom Chothia and Vitaliy Smirnov, Conference on Financial Cryptography and Data Security 2010
• A Statistical Test for Information Leaks Using Continuous Mutual Information, with Apratim Guha. Computer Security Foundations Symposium (CSF 2011).

This lecture gave an overview of some of the computer research being done in the School of Computer Science. The contents of this lecture will not be examinable. I described some recent research on e-passports, including a traceability attack against e-passports and how information theory can be used to analysis this flaw.

This lecture described how stack and heap buffer overflow attacks work. These are some of the most common form of attacks and can sometimes be used to take complete control of a system.

This lecture gave an overview of some of the computer research being done in the School of Computer Science. The contents of this lecture will not be examinable. Prof. Mark Ryan will present some of his Computer Security research.

Once you distribute software, an attacker can do anything they like with it, including removing any protection. This lecture covers some of the most common ways to attack software.

Buffer overflow attacks, and the like, are the most commonly exploited system weakness. However, it can take months of work to turn the discovery of a buffer overflow into a "weaponised" exploit, therefore these attacks are best investigated using standard tools. This lecture will show you how you can use these tools to test the security of your own system.

Trusted Computing uses hardware to provide cryptographic guarantees about remote systems. It can be a very powerful technique but has become controversial, because it removes complete control of a computer from it owner.

It is important to balance security and usability. It can often be cheaper to pay to repare the damage caused by a security breach than it would be to pay for the security needed to stop the breach. This lecture looks at the economic trade offs in computer security and describes some of the common problems of usability problems.

A guest Lecture by Ian Batten, ex-head of Information Assurence at Fujitsu.

More on computer security policy, management and certification.