OFFICE HOURS DURING SEMESTER

• TBA

Most recent announcements are at top, older ones are further down the page.

• 3 Nov 2008: RFC 2196: Site Security Handbook [1997]
  • ABSTRACT: This handbook is a guide to developing computer security policies and procedures for sites that have systems on the Internet. The purpose of this handbook is to provide practical guidance to administrators trying to secure their information and services. The subjects covered include policy content and formation, a broad range of technical system and network security topics, and security incident response.
  See also the corresponding wikipedia page.
• 30 Oct 2008: The bookstore example
  • Duncan's Bookstore: Connecting Real Property and Business Valuation (Journal of Real Estate Literature, July 1997).
  • So You Want to Open Your Own Used Bookstore? (discussion of experience of an ex-journalism student who decided to go into the used books business)
• 17 Oct 2008: IRS rolls out tax processing systems despite known security risks (includes link to pdf of report from Treasury Inspector General identifying the problem) brought to you by NextGov: Technology and the Business of Government
• 10 Oct 2008: Another fun browse is to search for Canada on Scheier's security blog as this link does
• 10 Sep 2008: As mentioned on the course web page, security items on slashdot are tagged and can be found sorted by date here. Some of the more interesting recent ones:
  • Ongoing problems with computer security at the World Bank
  • 7 node network run using quantum cryptography
  • recent release of development software from NSA to promote creation of more secure programs
  • A new attack for determining content of encrypted (even AES) images
  • PDF files increasing used as computer virus medium
  • businesses in Nevada required by law to encrypt their email
  • claims of producing `unclonable' RFID chip
  • in last three months number of PCs in botnets has increased 4x
  • over 15 months $300k `leaked' out of bank account (holder normally wrote 1000 checks per month so didn't notice the problem for a while, bank only covered $50k of it).
  • device for dumping data from cell phones
  • review of book Zero Day Threat: The Shocking Truth of How Banks and Credit Bureaus Help Cyber Crooks Steal Your Money and Indentity
  • stolen SSH keys used to attack linux systems
  • DEFCON demo of hijacking the border gateway protocol to eavesdrop on net traffic. (man in middle attack)
  • the market in security cracking tools
  • development of new commercial survellance systems
  • new attack by Shamir on MD5, SHA-256, RC4, DES, Triple-DES, and AES (Crypto 2008 conference paper)
  • new attacks on SSL, VPN, and DNS (weakness in one-time passwords)
  • Sonoma State University in California teaching virus writing
  • bank web site problems discussed in study: Analyzing Web Sites For User-Visible Security Design Flaws
  • DNS cache poisoning code published
  • flaw found in TrueCrypt 5.1a hard disk encryption system (Usenix HotSec 08 paper)
  • hierarchy of cybercrime organizations
  • Mozilla's security metrics project
  • each week 12,000 laptops left (lost) at airports
  • remotely disabling automobiles and buses
  • spambots
• 3 Sep 2008: By the way, the encryption key forms can be found at: plain text, postscript, or PDF.
• 3 Sep 2008: Current course outline due dates now finalized. Also minor update to medical policy material and cleaning up some stuff that had been carried forward from past years but no longer relevant.
• 2 Sep 2008: Current course outline now available. Note that due dates are still pending departmental approval. This basically adapts last year's course outline along the lines of the 18 Aug note below.
• 18 Aug 2008: Course outline is still in progress. Probably the biggest change is that I have replaced the course readings with a textbook

      Security in Computing -- Fourth Edition
      by Charles P. Pfleeger and Shari Lawrence Pfleeger
      Prentice Hall, 2007
  

  You can find the Amazon writeup on it here. I am thinking in terms of a two approach marking scheme. In both approaches there will be 5 security problem solving tasks each worth 10% of the mark, establishing the core 50% of the mark.
  • Approach 1: There are a bunch of exercises at the end of the chapters. So, one way through the course will be to do selected questions at the end of 11 of the chapters for 33% of the mark. An additional 17% will be available to the mathematically inclined who would work some problems from the end of Chapter 12 (which gets into more advanced details of cryptography) as well as work a more advanced cryptography task.
  • Approach 2: Alternatively, 50% will be available to people who want to do an individual project (proposals, writeups, and presentations) in the manner described in last year's course outline.
  People taking the course as a graduate course will be restricted to the individual project option.
• 18 Aug 2007: Created announcements page.

I can be contacted by email at webber@csd.uwo.ca . Be sure and include course number in subject line of your email.