openseced/compsec

Course material for a course on Computer Security

A Course on Computer Security (compsec)

This is an introductory course on computer security. It's aim is to provide the student with an overview of the security required within a computer system.

It is part of the Open Security Education project and the maintainer is Daniel Bosk. The latest release can be found under releases. You can safely link directly to the PDFs found there.

This course consists of several learning modules that are linked in this repo.
However, all required PDFs can be found under releases

File Structure and Building

The main document of this repo is the study guide, for which the source code can be found in studyguide. The other directories are submodules needed to build the study guide.

The study guide ties together a set of learning modules. Each learning module contains lectures, assignments etc. Currently the course comprises the following topics:

• Foundations of Security (foundations)
• Security Usability (usability)
• Information Theory (infotheory)
• Cryptography (appliedcrypto)
• Identification and Authentication (auth)
• Access Control (ac)
• Reference Monitors (refmon)
• Accountability (accountability)
• Trusted Computing (trustcomp)
• Side-Channels (sidechannels)
• Software Security (software)

These topics are examined using the following assignments. The assignments prefixed with L are individual laboratory assignments, H are hackathon labs (done full-day in class), prefixed with M are memos, S for seminars.

• L0: Brute Forcing (appliedcrypto/spuriouslab)
• L1: Password Cracking and Social Engineering (passwd/pwdguess)
• S2: Password Policies (passwd/pwdpolicies)
• L3: Privacy of Communication (pricomlab)
• L4: Tools of the Trade (toolslab)
• H5: Digital Rights Management (trustcomp/drmlab)
• H6: Smashing the Stack (software/stacksmashlab)
• H7: Malware (software/malwarelab)
• S8: The Computer Engineer's Code of Ethics (ethics/profession)

Building

To build the PDFs, after cloning the repository you must clone its required submodules:

$ git submodule update --recursive --init

Then you can go into the directory of the desired document and run make. If you run make in the root directory you will recursively transcend the directory hierarchy and build everything included in the course.

To contribute, please fork the repository, make your changes, commit them and then create a [pull request][PullRequest] in the original repository.

[PullRequest]: https://help.github.com/articles/using-pull-requests/File structure

compsec's Issues

More hands-on labs

The current labs/seminars can be too abstract. Would be nice with something more hands-on, e.g. the old GPG lab.

Update `late.tex`: we no longer deregister them if they're inactive

Currently most difficult material

Currently the following material is the most challenging for the students:

• [appliedcrypto]
• [fverif]
• [software]

Capture the Flag

Maybe a Capture the Flag (CTF) would be an interesting exercise in the course.

Hacking-lab.com has interesting training modules.

Useful resources

hackthebox.eu

More emphasis on ILOs in assignments

The labs/seminars/assignments must be better aligned with the ILOs. The ILOs should be more towards software security.

Remove spuriouslab or do something more useful of it

Incorporate relevant parts of KaU PbD course

KaU has a nice course here: https://www.kau.se/cs/pbd

We can incorporate parts of the material.