Security engineering
What the discipline is, the policy/mechanism/assurance/incentives framework, security goals, design principles, and how attacks are classified.
Revision site — 7 modules, 45 topics
CSEC3616 Cybersecurity Engineering
A study site for CSEC3616 / CSEC5616 / INFO3616, generated from the unit's own decks, notes and tutorials. The lecture is the authority throughout — where a page draws on anything outside it, the page says so.
BeginCASE 01-01What security engineering isHuman factors
Psychological acceptability, cognitive bias, influence techniques, social engineering, and the usability and strength of passwords.
Access control
Access matrices, DAC and MAC, ACLs and capabilities, Unix permissions, platform and hardware isolation, Bell-LaPadula and Biba.
- Access control fundamentals
- Discretionary and mandatory access control
- Access matrices, ACLs and capabilities
- Unix and Linux permissions
- macOS, Windows, iOS and Android
- Middleware, databases and browsers
- Sandboxing, virtualisation and containers
- Hardware protection and privilege rings
- Bell-LaPadula, Biba and MLS
Mathematics for cryptography
Divisibility, modular arithmetic, extended Euclid, Fermat and Euler, discrete logarithms, groups, rings, fields and GF(2^n).
Symmetric cryptography
Classical ciphers, confusion and diffusion, stream ciphers and the one-time pad, Feistel structures, DES, AES, modes of operation and CSPRNGs.
- Cryptography basics and Kerckhoffs's principle
- Substitution, transposition and frequency analysis
- The Vigenère cipher and the Kasiski examination
- Confusion, diffusion and attack models
- Stream ciphers and the one-time pad
- Block ciphers, S-boxes, P-boxes and Feistel
- DES and 3DES
- AES
- Modes of operation
- Random numbers and CSPRNGs
Asymmetric cryptography
Trapdoor functions, RSA and its attacks, hybrid encryption, Diffie-Hellman, elliptic curves and post-quantum cryptography.
Hashes and MACs
Hash resistance properties and the birthday attack, SHA-2 and SHA-3, message authentication codes and HMAC, authenticated encryption with GCM and CCM, and digital signatures.
Authentication and key distribution
Entity authentication, challenge-response, replay and freshness, session key establishment, key distribution centres, Needham-Schroeder and Kerberos.
- The key distribution problem
- Key distribution centres and the key hierarchy
- Distributing symmetric keys with public-key encryption
- Public-key certificates and X.509
- Public key infrastructure and revocation
- Authentication, factors and one-time passwords
- Authentication protocols and challenge-response
- Authenticated key establishment
- Needham-Schroeder and Kerberos
Network security: protocols
A networking refresher through the TCP/IP layers, what an attack on a network looks like, and then the cryptographic protocols layer by layer: OAuth and OpenID, TLS 1.2 and 1.3, and IPSec with its security associations, AH, ESP, IKEv2 and the two modes.
- The Internet, protocols and the TCP/IP model
- Application and transport layers
- Network layer: IP addressing, subnets, NAT and IPv6
- The link layer and MAC addresses
- What an attack on a network is
- Cryptographic protocols, layer by layer
- Application layer: OAuth and OpenID
- TLS: design rationale and the socket abstraction
- The TLS handshake, 1.2 and 1.3
- IPSec: architecture, security associations and policy
- IPSec: AH, ESP, IKEv2 and the two modes
Network security: firewalls
What a network firewall can and cannot stop, rule tables and default policy, stateful against stateless matching, spoofing protection and rule shadowing, and the dual-homed and bastion-host setups.
Software security
Language and memory safety, the stack and how a function call uses it, the stack-based buffer overflow and its defences, the other C programming errors that become vulnerabilities, and the software supply chain.
Course material
What Assignment 1 tests, and the unit virtual machine.