Secure software design

MTAT.03.246 Secure software design

MTAT.03.247 Secure software design: Project work

Lectures: Fridays 16:15, J. Liivi 2 - 404

Contact: margus at cyber.ee

Lecture slides

• Introductory lecture
  • Multilevel security
  • Multilateral security
• Security analysis
• Human factors and security
• Authenticating people and computers
• Strategies for secure software development
• Internet voting in Estonia
• Strategies for secure software development; developing security protocols
• PKI and digital signatures
• PKI and digital signatures, part 2
• Case study: Estonian x-road

Projects

Requirements for the project

Exam

The exam is a written exam. Use of written materials is allowed. The exam questions are based on lectures and mandatory reading material. The exam tries to measure knowledge about main principles/technologies/classes of attack and ability to apply these principles for specific examples.

Exam dates:

• TBA

Mandatory (examinable) reading

• Ross Anderson, "Programming Satan's Computer"
• Ken Thompson, "Reflections on Trusting Trust"
• Peter Gutmann, "Lessons Learned in Implementing and Deploying Crypto Software"
• Ross Anderson, "The Eternity Service" -- a good example of security analysis of a system
• Chapter 11 from "Security Engineering"

Recommended reading

• Lifestyle Hackers
• Alma Whitten, J.D. Tygar, "Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0"
• Kevin Mitnick, "The Art of Deception: Controlling the Human Element of Security"
• David Maurer, "The Big Con: The Story of the Confidence Man"
• Frank Stajano, Paul Wilson, "Understanding scam victims: seven principles for systems security"
• Richards J. Heuer, Jr., "Psychology of Intelligence Analysis"
• Rachna Dhamija, Doug Tygar, Marti Hearst. "Why Phishing Works"
• Peter Gutmann, "Security Usability"
• Peter Gutmann, "The Design of a Cryptographic Security Architecture"
• RFC 2119: Key words for use in RFCs to Indicate Requirement Levels