Call him Doctor Xiang ( pronounced shaang )
or just professor yeah im gonna call this guy professor
not an intro level course he says some “hardcore materials”
SIS → dept. of cybersecurity
SIS “Software Information Systems”
i am never going to talk to any of these TAs
objectives: understand fundamental concepts of security
preferred lang is PYTHON, holy baller. i do NOT wanna do ts in c, which is what id expect for a infosec course
understand security vulnerabilities, threats and their significance understand how attacks work in practice understand security properties, and build computer systems with robust security properties. learn how to use security tools and build basic systems
GROUP PROJECTS !!!!
what mistakes not to make: be careful when choosing security library
- dude was vague about this no clue what he means
infosec → what are some general philosophies when thinking about security cryptography → how do we securely send information over an insecure channel web security → what are some attacks on the web, and how do we defend against them network security → how do we communicate between 2 endpoints. What are some attacks on the network, and how do we defend against them?
web → interactions between your browser and webservers when this guy says web he just means browser
network → network security, communications between 1 laptop and another device
fuck he is not very precise i lowkey am already mad
dude is trying his best w english and i can understand him perfectly fine so its gonna be chill.
System security → what are some attacks on computer systems, and how do we defend against them we need to know what is a computer system before we can talk about attacks fuck this shit IS fundamental
AI Security
he is not an expert on AI security sometimes industry speakers do ai security talks
non security related skills you can take away from this class: cryptography, need to understand the mathematics behind cryptography web security, software engineering: understand howwebsites are built and how your web browser interacts with remote web servers network security: various network protocols system security → architecture and os, understand how the memory works and how your software applications interact with OS and hardware.
no prior course requirement but the following skills are needed: programming languages / coding
familiarity with mathematical notation: relevant for cryptography talk to TAs if you struggle with mathematical notation first half of semester is rough with mathematical notation how do we do encryption / write encryption in the midterm exam, he will test everything about cryptography familiarity with memory layouts and assembly relevant for system security good to know things about stack and heap and how cpu interacts w memory
DOES NOT ENFORCE ATTENDANCE
he has quizzes in class, he expects you to take the quiz here, and be in most of the classes, but he doesnt strictly enforce attendance.
you are not supposed to use cell phones to do anything other than study. you can use laptop for notes / learning, and reading pdfs, but not like playing gta
this course is organized in a systematic way where you dont really need to go outside of course materials to pass. it will be clear where you need to if you need to learn more about system security.
there is a midterm and final open book exams lockdown browser no cell phone, no internet, no chatgpt open book exam, you can use handwritten notes / printouts HOLY SHIT HANDWRITTEN NOTES / PRINTOUTS ON EACH EXAM BRO THIS CLASS IS GONNA BE LIGHT AS FUCK
midterm sep 28 10-11:15 final dec 9 8 - 10:30 am
midterm 20% of grade final 25% of grade homework is 35% of grade course project 10% of grade in class quizzes 10% 3% extra credit cap
even though you technically could use ai tools to do the assignment for you he recommends against it
in class quizzes start next class, wednesday, you do a quiz at 10:02 lasting 2-3 minutes.
no late submissions allowed on in class quizzes
late homework is accepted for up to 48 hours with a 10% per day penalty based on the assignment’s total possible points, as enforced by canvas.
it is unethical to hack into someone else’s systems without their permission
- whaaaaaaat????? no way dude thats crazy
any student who does not behave in a respectful manner may be asked to leave the classroom
- whaaaaaaat????? no way dude thats crazy
you can use ai for: generating ideas and insights gaining alternative perspectives enhancing creativity you must always verify the answers you must understand it’s limitations you must disclose how you used ai in each submission
lowest assignment score is dropped at end of semester
in class quizzes last 2 dropped at end of semester
quizzes can be done at home, he wont check whether you are here or not - holy goated bro.
confidentiality - when you hear data breaches, that is a breach of confidentiality - attackers should not be able to read the data you encrypted
integrity - stop your attackers from writing untrusted information into trusted sources
availability -when aws has an outage, that is a breach of availability
security is important for our: physical safety confidentiality / privacy functionality protecting our assets successful business a country’s economy and safety and so on
what is hackable? everything!
“i thought about going to a forest and living there with no technology when i was younger, i have a family now though”
security principles: know your threat model
- know what kinds of things attackers of your systems will do consider human factors security is economics detect if you cant prevent defense in depth least privilege
- dont give the program more than the program needs separation of responsibility
- prevent one thing from having control over the entire network ensure complete mediation dont rely on security through obscurity use fail safe defaults design in security from the start
- when you start building systems you should have security as part of your philosophy
write down your assumptions in your projects / assignments when you do analysis