Lukyanov Schedule

Due by class means due at the time class starts. For example, if your section’s class starts at 1:00pm, then “Monday by class” means 1pm on Monday. This gives our TA an opportunity to spot-check the submissions and fix any submission issues when everyone’s together.

Schedule

    • Week
    • Dates
    • Lecture & Activities
    • Vulnerability of the Day
    • Due or Released
    • Reading
    • 1
    • Aug 24 - Aug 28
    • Introduction: Security Principles. Security Lifecycle. Course Overview. Design a Bad System activity
    • Integer Overflow. Buffer Overflow
    •  
    • CWE-190 CWE-120
    • 2
    • Aug 31 - Sep 4
    • DVWA activity. Requirements: Misuse & Abuse Cases.
    • SQL injection. Cross-Site Scripting (XSS). OS command injection.
    • Fuzzer released.
    • CWE-89 CWE-79 CWE-78
    • 3
    • Sep 7 - Sep 11
    • No class on Wednesday (Sep 9) Planning: risk assessment. Misuse & abuse cases activity.
    • Cross-site request forgery (CSRF)
    • Fuzzer iteration 0 due Friday by class
    • CWE-352 CSRF Description
    • 4
    • Sep 14 - Sep 18
    • Environment: file system permissions. File system permissions activity. Penetration testing. Design: threat modeling.
    • Path traversal. Log overflow
    • Fuzzer iteration 1 due Friday by class
    • CWE-22 CWE-400 CWE-779 CWE-770
    • 5
    • Sep 21 - Sep 25
    • Career Fair Sep 23: in-class project work, no new material that day. Threat modeling activity. Distrustful decomposition.
    • XML embedded DTDs
    • Fuzzer iteration 2 due Friday by class.
    • CWE-827 CWE-776 CWE-611
    • 6
    • Sep 28 - Oct 2
    • Implementation: defensive coding practices. Exam review. Catch up.
    • Hardcoded credentials
    • File Permissions myCourses Quiz AND Practice Quiz due Friday by class.
    • CWE-798
    • 7
    • Oct 5 - Oct 9
    • In-Class Exam 1 Monday (Takehome portion of exam due Friday by class). Takehome exam released with in-class exam (due Friday). Vulnerability assessment: CVSS.
    • Time of Check Time of Use (TOCTOU). Log neutralization
    • Input handling project released.
    • CVSS v3 Spec CWE-367 CWE-117 CWE-93 CAPEC-93
    • 8
    • Oct 12 - Oct 16
    • No class on Monday (Oct 12) CVSS activity. Cryptography: authentication, public & symmetric keys, SSH, SSL, PGP.
    • Hashing without salt
    • Input handling project parts 0, 1, 2 due Wednesday by class.
    • CWE-759 Salting Guide
    • 9
    • Oct 19 - Oct 23
    • Cryptography (cont). Side-channel attacks.
    • Poor PRNG seed protection. Insecure PRNG algorithms. Regex DOS.
    • Input handling all parts due Wednesday by class. IPC Project released
    • CWE-338
    • 10
    • Oct 26 - Oct 30
    • Usability and Security. OAuth activity. Supply-chain attacks.
    • Java reflection abuse.
    •  
    • CWE-470 OAuth Spec
    • 11
    • Nov 2 - Nov 6
    • Insider Threat. Insider Threat Activity. Insider Threat Presentation.
    • Uncontrolled format string
    • IPC project due Friday by class
    • CWE-134
    • 12
    • Nov 9 - Nov 13
    • Deployment & Distribution: patching. Exam Review. Exam 2 Friday
    • Compression bombs
    • Case Study project released
    • CWE-409 Compression Bombs
    • 13
    • Nov 16 - Nov 20
    • Networking: OSI model. MitM attacks, poisoning. Project work.
    • Cache poisoning. Open redirect.
    • Case Study Proposal due Monday
    • CAPEC-141 Video: DNS Cache Poisoning
    • 14
    • Apr 13 - Apr 17
    • No classes on Wendesday and Friday. Cybersecurity policy and law
    • Dynamic library side-loading
    • Case Study Part 1 due Monday by class
    •  
    • 15
    • Nov 30 - Dec 4
    • Code Inspection. Project work. Case Study presentation
    •  
    • Case Study Peer Review due Monday by class. Case Study Part 2 due Friday by class
    •  
    • 16
    • Dec 17
    • Final Exam review
    •  
    •  
    •