Course

COM-301: Computer security and privacy

Lectures in this course (60)

Covers the concept of biometrics, the process of enrolling and verifying biometrics, and the importance of balancing false positives and false negatives.

Authentication - Tokens

Covers the concept of tokens, how they work, and the implementation of two-factor authentication.

Adversarial Thinking: Reasoning as an Adversary

Explores the importance of understanding attacks and the reasoning behind adversarial thinking in developing security mechanisms.

Sudo Bug Exploitation: Demo

Demonstrates exploiting a bug in Sudo to run commands as root when restricted.

Adversarial Thinking: Defender - Threat Modelling

Delves into adversarial thinking and threat modeling methodologies to enhance defense strategies.

Adversarial Thinking: Common Weaknesses Enumeration

Explores adversarial thinking, common weaknesses, and ineffective defenses in software systems, emphasizing the importance of mitigating prevalent vulnerabilities.

Software security - Memory safety

Covers the basics of software security, focusing on memory safety and mitigation strategies against code execution attacks.

Software Security: Execution Attacks and Defenses

Covers code injection and control-flow hijack attacks, and defenses like Data Execution Prevention and Stack Canaries.

Software security - Security testing

Covers software security testing approaches and coverage metrics.

Software Security: Fuzzing

Explores fuzzing as an automated technique to improve program coverage in security testing.

Software Security: Security Testing - Sanitizers

Explores the use of sanitizers in software security testing to detect bugs early and improve testing effectiveness.

Network Security: Desired Properties and Solutions

Discusses the importance of network security properties and solutions to enhance overall security.

Network Security: ARP Spoofing

Delves into routing in LAN, ARP spoofing attacks, and defense strategies against them, emphasizing the risks of network vulnerabilities.

Network Security - DNS spoofing

Covers DNS spoofing attacks, defenses using DNSSEC, and the importance of origin authentication.

Network Security: BGP Spoofing

Explores BGP security weaknesses, real-world incidents, and defenses against BGP hijacking, emphasizing the importance of cryptography in securing routing information.

Network Security: IP Security

Covers IP basics, vulnerabilities like IP spoofing, and the use of IPSec for Virtual Private Networks.

Network Security - TCP security

Covers the limitations of IP and the Transmission Control Protocol (TCP), including security considerations.

Network Security - Transport Layer Security

Discusses the limitations of TCP, the TLS Handshake, and the vulnerabilities in TLS protocols, emphasizing the importance of provable security in TLS 1.3.

Network Security: Denial of Service

Explores Denial of Service attacks, prevention techniques, and various attack examples in network security.

Network Security: Other Protections

Explores network security through NAT, firewalls, and deep packet inspection, emphasizing the importance of robust host-level defenses and the limitations of protection techniques.