1. Yan Chen Dept. of Computer Science Northwestern University http://list.cs.northwestern.edu Information Security Curriculum Development in Northwestern University

2. Security Curriculum in Northwestern Traditional gap till 2004 Offered the first “Internet Security” research course in Spring 2004 Offered the first “Introduction to Computer Security” in Winter 2005 Will offer the first non-major security course in Fall 2005 –Under collaboration with Andrea M. Matwyshy, professor of the Law School –Thanks to MS Trustworthy Computing Curriculum grant –Tentatively title: “Basic Information Security: Technology, Business and Law”

3. Cryptography –Secret key algorithms: DES/AES –Public key algorithms: RSA –One-way hash functions & message digests: MD5, SHA2 Software security –Software security principles: least privilege, defense in depth, keep it simple, etc. Examples: send mail vs. qmail –Buffer overflow and the defense schemes Type safe languages Static source code analysis Run time checking: StackGuard, etc. Intro to Computer Security Course

4. Intro to Computer Security Course (II) Operating system security techniques –Access control: ACL and capabilities –Dealing with bad (legacy) codes: sandboxing Internet vulnerability –Denial-of-service attacks, viruses, worms, Trojan horses Securing the Internet –Intrusion detection systems (IDSs): host- vs. network- based, signature vs. statistical detection Case study: Snort –Firewalls and IPsec –Wireless and cellular network security

5. Class Projects Project 1: GNU Privacy Guard, an open-PGP tool –Encryption, decryption –Signature generation, verification and revocation Project 2: software security –Try exploit of buffer overflow and format string bugs –C-based, needs a little bit knowledge on X86 assembly language, but should be easy to pick up for CS students –Thanks to Prof. Dan Boneh of Stanford University for sharing this project

6. Class Projects (II) Project 3: Intrusion Detection Systems (IDS) –Signature-based IDS: snort Test on real traffic Add rules to snort for detection –Statistical IDS Use DARPA 98 data Provide two learning models: HMM and Gaussian mixture Select/design metrics to detect SYN flooding and port scans –We held a competition for statistical IDS of project 3. The winner earned extra bonus points plus some real gift awards Projects open to release

7. Incorporate Research Lab for Internet and Security Technology (LIST) Http://list.cs.northwestern.edu Hire students for Internet security research –Sponsored by Microsoft Research and Northwestern Murphy Society Most students (including undergrads) move on to research