East Carolina University
Department of Computer Science

CSCI 4160
Cybersecurity: Theory and Practice
Standard Syllabus

Catalog entry

P: CSCI 3000, CSCI 3010. Computing systems security principles and models. Vulnerability assessment and prevention measures. Authentication and access control in distributed systems. Operating system, network, and database security.

Course summary

The advent of the global Internet has brought about a significant change in the way people communicate and do business. Yet as this global village expands, so does the number of less than honest citizens. Furthermore, much of the hardware and software that constitutes the computer systems and the Internet was designed with only the trustworthy user in mind. As a result, intruders can invade the privacy of network communications as well as read or alter stored information.

This course is meant to be a first course on cybersecurity for computer science students. Cybersecurity is a vast area. To have some focus, in this course we will concentrate on the following select topics: Cryptographic Tools, Authentication, Access Control, Denial of Service Attacks, Intrusion Detection and Prevention, Network Security Protocols such as SSL and Kerberos .

Course topics

• Introduction: Basic Computer Security Concepts - Confidentiality, Integrity and Availability, Threats, Attacks and Vulnerabilities, Security Design Principles.
• Cryptographic Tools: Private Key Encryption, Message Authentication, Hash Functions, Public Key Encryption, Digital Signatures, Key Management, Pseudorandom Number Generation.
• User Authentication: User Authentication Principles, Password-Based Authentication, Token-based Authentication, Biometric Authentication, Multi-factor Authentication, Protocols for remote user authentication,
• Access Control: Access Control Principles, Discretionary Access Control, Role-based Access Control and Attribute-Based Access Control.
• Denial of Service Attacks: Flooding Attacks, SYN spoofing attacks, Reflector and Amplifier attacks, Distributed denial of service attacks.
• Intrusion Detection and Prevention: Intrusion Detection, Intrusion Prevention, Honeypots, Firewalls
• Internet Security Protocols: Secure Socket Layer (SSL), Transport Layer Security (TLS), Secure E-Mail (S/MIME), Kerberos.

Student learning outcomes

• State and explain different security design principles.
• Compare and contrast private-key and public-key cryptosystems.
• Use GNU Privacy Guard (GPG) Software Suite to accomplish different cryptographic tasks.
• Discuss the pros and cons of different user authentication systems.
• Discuss the pros and cons of different access control mechanisms.
• Mount attacks that exploit vulnerabilities in TCP/IP protocols and DNS protocols.
• Articulate the working of a firewall using insight gained from experimenting with firewall software.
• Use packet sniffing and spoofing tools such as Wireshark, Tcpdump, Netwox.

Textbook

COMPUTER SECURITY: Principles and Practice by William Stallings and Lawrie Brown, Pearson Education Inc., Third Edition, 2019.

Other required material

Grading

Your grade in this course will be based on your performance in assignments, quizzes and examinations. There will be a mid-term exam and a final exam. The weights assigned to different components are given below.

Grade meanings