CMSC 23200/33250: Introduction to Computer Security

Week	Date	Topics	Instructor	Assignments & Reading Responses (Everyone)	Readings (Everyone)	Research Papers (CMSC 33250 only)
Week 1	Wed 1/4	Course Introduction and the Security Mindset [slides]	Blase & David	--	Textbook Chapter 1. Gallagher. Securing Your Digital Life, Part One: The Basics, Ars Technica, October 25, 2021. Gallagher. Securing Your Digital Life, Part Two: The Bigger Picture—and Special Circumstances, Ars Technica, October 27, 2021.	None
Week 1	Fri 1/6	Basic Security Concepts and Threat Modeling [slides]	David	--		None
Week 2	Mon 1/9	OS Security [slides]	David	Reading Response 1 due Tues 1/10	Textbook Sections 5.1-5.7 and Chapter 6.	Due Mon 1/9: Cha et al. Unleashing MAYHEM on Binary Code, In Proc. IEEE Symposium on Security & Privacy, 2012.
	Wed 1/11	Memory Vulnerabilities [slides]	David	Assignment 1 due Thurs 1/12
	Fri 1/13	Memory Protection [slides]	David	--
Week 3	Mon 1/16	No class in observance of MLK Day	--	Reading Response 2 due Tues 1/17	Textbook Chapter 3. Dan Goodin. Anatomy of a Hack: How Crackers Ransack Passwords Like "qeadzcwrsfxv1331", Ars Technica, May 27, 2013. Apple. Password Monitoring, Apple Platform Security, February 18, 2021. James Mickens. This World of Ours, USENIX ;login:, January 2014.	Due Tues 1/17 (a day later due to the holiday): Liu et al. Reasoning Analytically About Password-Cracking Software. In Proc. IEEE Symposium on Security & Privacy, 2019.
	Wed 1/18	Authentication I (Approaches to Authentication, Password Storage) [slides]	Blase	Assignment 2 due Thurs 1/19
	Fri 1/18	Authentication II (Password Cracking) [slides]	Blase	--
Week 4	Mon 1/23	Authentication III (Password Replacements and Supplements) [slides]	Blase	Reading Response 3 due Tues 1/24	Textbook Chapter 2. CVE-2020-11500 and CVE-2018-9195.	Due Mon 1/23: Heninger and Durumeric et al. Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices, In Proc. USENIX Security, 2012.
	Wed 1/25	Crypto Tools I [slides]	David	Assignment 3 due Thurs 1/26
	Fri 1/27	Crypto Tools II [slides]	David	--
Week 5	Mon 1/30	Software Security Techniques, Fuzzing [slides]	David	Reading Response 4 due Tues 1/31	Textbook Sections 10.6 and 9.1-9.2. Martinho. Understanding How Facebook Disappeared from the Internet The Cloudflare Blog, October 4, 2021. Aas et al. Let's Encrypt: An Automated Certificate Authority to Encrypt the Entire Web, In Proc. CCS, 2019. Bode. Apple, Cloudflare Join Forces To Encrypt DNS, TechDirt, December 11, 2020.	Due Mon 1/30: Lauinger et al. Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web, In Proc. NDSS, 2017.
	Wed 2/1	How the Internet Works [slides]	Blase	Assignment 4 due Thurs 2/2
	Fri 2/3	TLS and X.509 Certificates [slides]	David	--
Week 6	Mon 2/6	In-class Midterm Exam (covering Weeks 1-4)	--	Reading Response 5 due Tues 2/7	Textbook Chapter 11 and Sections 9.3-9.4 and 9.8 Portis. I Learned to Love the Same-Origin Policy, CSS Tricks, 2021. McMillan. How Heartbleed Broke the Internet — And Why It Can Happen Again, Wired, April 11, 2014. James Mickens. To Wash It All Away, USENIX ;login:, March 2014.	Due Mon 2/6: Bock et al. Weaponizing Middleboxes for TCP Reflected Amplification, In Proc. USENIX Security, 2021.
	Wed 2/8	Network Attacks and Defenses [slides]	Blase	Assignment 5 due Thurs 2/9
	Fri 2/10	How the Web Works Part I [slides]	Blase	--
Week 7	Mon 2/13	How the Web Works Part II [continued the slides from 2/10]	Blase	Reading Response 6 due Tues 2/14	Textbook Sections 9.5-9.7. Manjoo and Bremer. I Visited 47 Sites. Hundreds of Trackers Followed Me., New York Times, August 23, 2019.	Due Mon 2/13: Smith et al. SugarCoat: Programmatically Generating Privacy-Preserving, Web-Compatible Resource Replacements for Content Blocking, In Proc. CCS, 2021.
	Wed 2/15	Web Attacks and Defenses I [slides]	Blase	Assignment 6 due Thurs 2/16
	Fri 2/17	Web Attacks and Defenses II, Web Tracking [slides]	Blase	--
Week 8	Mon 2/20	Data Privacy and Deanonymization [slides]	David	Reading Response 7 due Tues 2/21	Dwork-Roth Textbook pages 3-33. Mervis. Can a Set of Equations Keep U.S. Census Data Private? Science Magazine, January 4, 2019. Textbook Chapter 13	Due Mon 2/20: Kosba et al. Hawk: The Blockchain Model of Cryptography and Privacy-Preserving Smart Contracts, In Proc. IEEE Symposium on Security & Privacy, 2016.
	Wed 2/22	Differential Privacy [slides]	David	Assignment 7 due Thurs 2/23
	Fri 2/24	Blockchain and Cryptocurrencies [slides]	David	--
Week 9	Mon 2/27	Hardware Security, Machine Learning Security [slides]	Blase	Reading Response 8 due Tues 2/28	Krebs. Scary Chip Flaws Raise Spectre of Meltdown, Krebs on Security, January 5, 2018. Wallace et al. Does GPT-2 Know Your Phone Number?, BAIR Blog, December 20, 2020. Robertson. Apple's Controversial New Child Protection Features, Explained, The Verge, August 10, 2021.	Due Mon 2/27: Sharif et al. Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition, In Proc. CCS, 2016.
	Wed 3/1	E2E Encryption, Usable Encryption [slides]	Blase & David	Assignment 8 due Thurs 3/2
	Fri 3/3	Security in Practice	Special Guests	There will be a closed-book final exam during exam period as scheduled by the registrar.

Schedule and Assignments (Winter 2023)