Progress

01Security engineering0 of 5

• What security engineering is
• Policy, mechanism, assurance and incentives
• Security goals
• Fundamental design principles
• Attacks, attackers and attack surfaces

02Human factors0 of 7

• Psychological acceptability
• Human error and cognitive bias
• Defaults, nudges and influence
• Social engineering and phishing
• Password usability and outdated advice
• Password strength and generation
• Mental models and interface design

03Access control0 of 9

• Access control fundamentals
• Discretionary and mandatory access control
• Access matrices, ACLs and capabilities
• Unix and Linux permissions
• macOS, Windows, iOS and Android
• Middleware, databases and browsers
• Sandboxing, virtualisation and containers
• Hardware protection and privilege rings
• Bell-LaPadula, Biba and MLS

04Mathematics for cryptography0 of 7

• Divisibility and the greatest common divisor
• Modular arithmetic and residue classes
• The extended Euclidean algorithm and modular inverses
• Primes, Fermat, Euler and fast modular exponentiation
• Discrete logarithms and primitive roots
• Groups, rings and fields
• Finite fields, GF(p) and GF(2^n)

05Symmetric cryptography0 of 10

• Cryptography basics and Kerckhoffs's principle
• Substitution, transposition and frequency analysis
• The Vigenère cipher and the Kasiski examination
• Confusion, diffusion and attack models
• Stream ciphers and the one-time pad
• Block ciphers, S-boxes, P-boxes and Feistel
• DES and 3DES
• AES
• Modes of operation
• Random numbers and CSPRNGs

06Asymmetric cryptography0 of 6

• Public-key cryptography and trapdoor functions
• RSA
• RSA security, attacks, padding and hybrid encryption
• Diffie-Hellman key exchange
• Elliptic curve cryptography
• Post-quantum cryptography

08Hashes and MACs0 of 7

• Hash functions and what they are for
• Preimage, second preimage and collision resistance
• The birthday attack and output length
• SHA-2 and SHA-3
• Message authentication codes and HMAC
• Authenticated encryption, GCM and CCM
• Digital signatures, DSA and RSA

09Authentication and key distribution0 of 9

• The key distribution problem
• Key distribution centres and the key hierarchy
• Distributing symmetric keys with public-key encryption
• Public-key certificates and X.509
• Public key infrastructure and revocation
• Authentication, factors and one-time passwords
• Authentication protocols and challenge-response
• Authenticated key establishment
• Needham-Schroeder and Kerberos

10Network security: protocols0 of 11

• The Internet, protocols and the TCP/IP model
• Application and transport layers
• Network layer: IP addressing, subnets, NAT and IPv6
• The link layer and MAC addresses
• What an attack on a network is
• Cryptographic protocols, layer by layer
• Application layer: OAuth and OpenID
• TLS: design rationale and the socket abstraction
• The TLS handshake, 1.2 and 1.3
• IPSec: architecture, security associations and policy
• IPSec: AH, ESP, IKEv2 and the two modes

11Network security: firewalls0 of 6

• What a network firewall does, and what it cannot stop
• Rule tables, first match and default policy
• Stateful matching
• Stateless matching
• Spoofing protection and rule shadowing
• Dual-homed firewalls and bastion hosts

12Software security0 of 6

• Flaws, vulnerabilities, and language safety
• Memory segments, the stack and function calls
• Exploiting a stack-based buffer overflow
• Defences against buffer overflows
• Null termination, integer overflow, format strings, use after free
• The software supply chain and zero days

07Course material0 of 2

• Assignment 1: what it tests
• The unit VM, DVWA and Jupyter