Introduction to Computer Security Winter 2015

This course teaches the security mindset and introduces the principles and practices of computer security as applied to software, host systems, and networks. It covers the foundations of building, using, and managing secure systems. Topics include standard cryptographic functions and protocols, threats and defenses for real-world systems, incident response, and computer forensics. See the schedule for details.

Professor Z. Morley Mao,   Eric Wustrow
Office hours: Mon 1:00–2:00, Wed 4:00–5:00, (Morley: 4629 Beyster, Eric: 4828 Beyster) or by appointment
Prerequisites EECS 281; EECS 370 recommended
Lectures Mon./Wed. 9:00–10:30, 10:30–noon, 1670 Beyster
Section 11: Fri. 1:30–2:30, 1620 Beyster
Section 12: Mon. 1:30–2:30, 1620 Beyster
Section 13: Wed. 3:30–4:30, 1620 Beyster
Section 14: Tue. 4:00–5:00, 1620 Beyster
Section 15: Thu. 3:00–4:00, 1620 Beyster
Section 16: Tue. 3:00–4:00, 1620 Beyster
TAs See calendar below for office hour times and locations.
Andrew Lee, GSI
Luis Molina, GSI
Peter Xie, GSI
Alishah Chator, IA
Dylan Hurd, IA
Zane Salem, IA
Brad Warren, IA
Communication We'll use Piazza for general discussion and questions about course material.
For administrative issues, email to contact the course staff.
This is a paperless course. Assignments will be distributed here and collected via CTools.
Reference Books No textbook is required, but if you would like additional references, we recommend:
Security Engineering by Ross Anderson
Cryptography Engineering by Ferguson, Schneier, and Kohno
Resources Security Research at Michigan
Security Reading Group (SECRIT)
EECS 588 (graduate-level security class)

This week


We'll calculate your course grade based on these components:
Homework Exercises 25% Five homework exercises, completed on your own
Programming Projects 40% Five programming projects, completed in teams of two
Class Participation 5% Attendance, alertness, questions, intellectual contributions
Final Exam 30% One exam covering all material from the course

Ethics, Law, and University Policies Warning

To defend a system you need to be able to think like an attacker, and that includes understanding techniques that can be used to compromise security. However, using those techniques in the real world may violate the law or the university’s rules, and it may be unethical. Under some circumstances, even probing for weaknesses may result in severe penalties, up to and including expulsion, civil fines, and jail time. Our policy in EECS 388 is that you must respect the privacy and property rights of others at all times, or else you will fail the course.

Acting lawfully and ethically is your responsibility. Carefully read the Computer Fraud and Abuse Act (CFAA), a federal statute that broadly criminalizes computer intrusion. This is one of several laws that govern “hacking.” Understand what the law prohibits — you don’t want to end up like this guy. If in doubt, we can refer you to an attorney.

Please review ITS‘s policies on responsible use of technology resources and CAEN’s policy documents for guidelines concerning proper use of information technology at U-M, as well as the Engineering Honor Code. As members of the university, you are required to abide by these policies.