T110 4206 Information Security Technology Tuomas Aura Aalto

T-110. 4206 Information Security Technology Tuomas Aura Aalto University, autumn 2011

My background § Lecturer: Tuomas Aura – Ph. D from Helsinki University of Technology in 2000 – Microsoft Research, UK, 2001– 2009 – Professor at Aalto 2008– § Research areas: – Network security – Do. S resistance – Security protocol engineering – Security of mobility protocols (Mobile IPv 6, SEND, etc. ) – Privacy of mobile users 2

Lectures § Lecturer: Tuomas Aura § 12 lectures in Sep-Oct 2011 – Wednesdays 14: 15 -16 T 1 – Thursdays 14: 15 -16 TU 1 – No lecture tomorrow (8 September) – 20 October is a backup date § Attendance not mandatory but some material will only be covered in the lectures § No tutorial or exercise sessions 3

Exercises § 6 exercise rounds, starting next week § Exercise problems in Noppa by Sunday each week (first round on 11 September) § Deadline on the following Sunday 23: 59; reports to be returned to Rubyric § Course assistants – Aapo Kalliola and Jaakko Salo – email: t-110. 4206@tkk. fi § Course assistants available on in the Playroom for advice and equipment: – Tuesdays 16: 15 -18 room A 120 – Thursdays 16: 15 -18 room A 120 4

Advice for exercises § Try to solve all problems at least partly § Individual work: It is ok to discuss with other students but do not copy or even read the written solutions of other students. Do all practical experiments independently § If you quote any text written by someone else, mark it clearly as a ”quotation” and give the source, e. g. [RFC 1234, section 5. 6. 7] 5

Assessment § First examination 27 Oct 2011 9 -12 in T 1 § Examination scope: lectures, recommended reading material, exercises, good general knowledge of the topic area § Exercises are not mandatory but strongly recommended § Marking: – exam max. 30 points – exercises max 6 x 10 = 60 points – grading based on total points = exam + (exercises / 10) (total max 30+6=36 points) § Course feedback is mandatory 6

Goals § You are familiar with the fundamental concepts and models of information security. You can analyze threats, know common security technologies, and understand how they can be applied to protect against the threats. You are able to participate in practical security work § Understand the limitations of security technologies to use them right § Be aware of the pitfalls in security engineering: security is not just mathematics or just code § Starting point for learning more § Learn the adversarial mindset of security engineering 7

Approximate course contents 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. Computer security overview Access control models and policies User authentication Operating system security Applied cryptography Certificates and network security Encrypting stored data Software security Identity management Threat modeling Security regulation and management Payment systems 8

Recommended reading § Dieter Gollmann, Computer Security, 3 rd ed. , 2011 § Ross Anderson, Security Engineering: A Guide to Building Dependable Distributed Systems, 2 nd ed. , 2008 § Matt Bishop, Introduction to computer security, 2005 9

Course development § What has or has not changed based on student feedback from last year? – Students liked hands-on exercises. This year, all exercises will be practical – Some students found the exercises too time-consuming, some too easy. We have kept them easy and simplified the reporting to limit the study time taken by the exercises – Many students felt the examination was not challenging enough. True, some questions were very basic. This year, the exam will require more thinking – Some slides were not covered in lectures but distributed for reading. This is intentional. Please read them – Students liked discussions in the lectures. I invite this year’s class to be equally active 10