Secure software design: erinevus redaktsioonide vahel
Mine navigeerimisribale
Mine otsikasti
| 40. rida: | 40. rida: | ||
* [http://www.csoonline.com/article/506309/lifestyle-hackers Lifestyle Hackers] | * [http://www.csoonline.com/article/506309/lifestyle-hackers Lifestyle Hackers] | ||
* [http://gaudior.net/alma/johnny.pdf | * Alma Whitten, J.D. Tygar, [http://gaudior.net/alma/johnny.pdf "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0"] | ||
* Kevin Mitnick, "The Art of Deception: Controlling the Human Element of Security" | * Kevin Mitnick, "The Art of Deception: Controlling the Human Element of Security" | ||
* David Maurer, "The Big Con: The Story of the Confidence Man" | * David Maurer, "The Big Con: The Story of the Confidence Man" | ||
| 46. rida: | 46. rida: | ||
* [https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/books-and-monographs/psychology-of-intelligence-analysis/index.html Psychology of Intelligence Analysis, Richards J. Heuer, Jr.] | * [https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/books-and-monographs/psychology-of-intelligence-analysis/index.html Psychology of Intelligence Analysis, Richards J. Heuer, Jr.] | ||
* Rachna Dhamija, Doug Tygar, Marti Hearst. [http://people.deas.harvard.edu/~rachna/papers/why_phishing_works.pdf "Why Phishing Works"] | * Rachna Dhamija, Doug Tygar, Marti Hearst. [http://people.deas.harvard.edu/~rachna/papers/why_phishing_works.pdf "Why Phishing Works"] | ||
* Peter Gutmann, [http://www.cs.auckland.ac.nz/~pgut001/pubs/usenix99.pdf "The Design of a Cryptographic Security Architecture"] | |||
* [http://www.ietf.org/rfc/rfc2119.txt RFC 2119: Key words for use in RFCs to Indicate Requirement Levels] | |||
Redaktsioon: 8. aprill 2011, kell 01:14
MTAT.03.246 Secure software design
MTAT.03.247 Secure software design: Project work
Lectures: Fridays 16:15, J. Liivi 2 - 404
Contact: margus at cyber.ee
Lecture slides
- Introductory lecture
- Security analysis
- Human factors and security
- Authenticating people and computers
- Strategies for secure software development
- Internet voting in Estonia
- Strategies for secure software development; developing security protocols
Projects
Exam
The exam is a written exam. Use of written materials is allowed. The exam questions are based on lectures and mandatory reading material. The exam tries to measure knowledge about main principles/technologies/classes of attack and ability to apply these principles for specific examples.
Exam dates:
- TBA
Mandatory (examinable) reading
- Ross Anderson, "Programming Satan's Computer"
- Ken Thompson, "Reflections on Trusting Trust"
- Peter Gutmann, "Lessons Learned in Implementing and Deploying Crypto Software"
- Ross Anderson, "The Eternity Service" -- a good example of security analysis of a system
- Chapter 11 from "Security Engineering"
Recommended reading
- Lifestyle Hackers
- Alma Whitten, J.D. Tygar, "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0"
- Kevin Mitnick, "The Art of Deception: Controlling the Human Element of Security"
- David Maurer, "The Big Con: The Story of the Confidence Man"
- Frank Stajano, Paul Wilson, "Understanding scam victims: seven principles for systems security"
- Psychology of Intelligence Analysis, Richards J. Heuer, Jr.
- Rachna Dhamija, Doug Tygar, Marti Hearst. "Why Phishing Works"
- Peter Gutmann, "The Design of a Cryptographic Security Architecture"
- RFC 2119: Key words for use in RFCs to Indicate Requirement Levels