Course Description

How to secure computing systems, communications, and users. Basic cryptography; private and authenticated communication; software security; malware; operating system protection; network security; web security; physical security; cryptocurrencies and blockchains; privacy and anonymity; usable security; economics of security; ethics of security; legal and policy issues.

Waitlist: Please email Prof. Apostolaki if you would like to be added to the waitlist for the course.

Staff and office hours

Calendar

Textbook

There is no required or suggested textbook in this course, because there is no one book that covers the right material in an up-to-date fashion. Some good books about security, in case you are interested, are listed on the Resources page.

Lectures

Lectures meet on Mondays and Wednesdays, 9:30 am – 10:50 am in ComSciBldg 104.

Assignments Policy

Some assignments are individual assignments while other assignments must be done in groups (of two or three partners).

Assignments that are submitted after the specified due date will lose 10% of the full assignment grade for every day (or partial day) of lateness.

However, you do have three (3) late days, and you may use one or more of these late days on an assignment. Each late day taken will extend the due date of the submission by 24 hours. For group assignments, you may use X late days if and only if all group members can use X late days on the assignment. You may not use partial late days, and we will not apply late days automatically in this course since not all assignments are individual assignments. If you wish to use late days on a submission, you must explicitly note that with your submission. Please submit a LATEDAY.txt file with your submission and state "I/We would like to use X late day(s) on this assignment."

We won't accept homework more than seven days late, and we will grant extensions only in the case of unforeseeable circumstances like medical emergencies, as documented by your Dean or Director of Studies and our approval.

Grading

The grade breakdown is 65% assignments (equally weighted) + 25% final exam + 10% class participation. There is no midterm exam.

Collaboration Policy

This course permits many forms of collaboration, including help from course staff, classmates, and lab TAs. However, you must be careful to collaborate only as authorized below. Here is a summary, where ✔ means YES and ❌ means NO. If you have any questions, please contact the course staff.

activity	your group	course staff	COS 432/ ECE 432 grads	classmates	AI chatbots	other
discuss concepts with ...	✔	✔	✔	✔	✔	✔
acknowledge collaboration with ...	✔	✔	✔	✔	✔	✔
expose solutions to ...	✔	✔	❌	❌	❌	❌
view solutions from ...	✔	❌	❌	❌	❌	❌
plagiarize code from ...	❌	❌	❌	❌	❌	❌

Your solutions. On individual assignments, you must individually compose all of your solutions. The term solutions refers to any of the products created when completing a programming assignment, such as source code (including comments) and any text files. It includes both finished and unfinished products, regardless of correctness or completeness.

• You must never expose solutions to anyone who is taking COS 432/ECE 432 now or who might take COS 432/ECE 432 in the future. Do not post solutions in public code repositories.
• If you leave your computer unattended, be sure to protect it with a password.
• You must never receive or view someone else's solutions to a programming assignment (or variant of an assignment).
• You may not use AI composition software (such as ChatGPT or GitHub Copilot) to create or debug code.
• Attempting to decompile or otherwise gain information about the implementation of any provided solution archives or binaries is an explicit violation of this policy.

Working Groups. Some assignments require you to work in groups. Here are the rules regarding group work.

• A group must consist of either two or three people. Solutions turned in by a group of one person, or by a group of four or more people, will receive no credit.
• You can work in different groups on different assignments.
• Each group should submit a single solution, which should be clearly labeled with the names of the group's members. Only one member of the group needs to submit the group's solution. There is no need to submit redundant copies for the other members.
• The members of a group will all receive the same grade on an assignment, reflecting the quality of the group's collective solution to the assignment.
• It is up to you to divide up the work within your group, and to make sure that the other members of your group meet their commitments. (If a member of your group is consistently irresponsible, let us know and we'll take appropriate action.)
• If you have trouble finding a group, let us know and we will help you.

Why Work in Groups? There are several reasons for our decision to make you work in groups.

• In the real world, people work in groups. We want you to learn how.
• We think that students learn more by doing hard assignments than by doing easy ones. Giving group assignments lets us give harder assignments without overworking you.
• Security problems require you to deal with engineering tradeoffs and make difficult design decisions. We hope that you'll debate these decisions within your group, and that the debates will be educational.

A note about StackExchange, Wikipedia, and online forums. Many of the topics in this course require self-teaching. This includes a lot of searching online for documentation and information about algorithms, technologies, and techniques. Unfortunately, this includes a wide gray area between learning and plagiarism. Don't be afraid of searching for and using online resources that teach you how to do something that is not a direct requirement of an assignment.

For example, you are free to find and implement a method that converts integers to byte arrays in an assignment about cryptography; just make sure to cite your source and thoroughly understand the implementation, as your graders will not be lenient with copied code that is buggy. If you find yourself searching for implementations of a security-related algorithm, then you are likely violating the collaboration policy. When you are unsure, ask one of the staff members.

Plagiarism. As members of the University community, students are bound by the rules and procedures described in Rights, Rules, Responsibilities.

All the rules above continue to apply after assignments are graded and after the end of the semester.