EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing

EEC 693/793EEC 693/793Special Topics in Electrical EngineeringSpecial Topics in Electrical Engineering

Secure and Dependable ComputingSecure and Dependable Computing

Lecture 1Lecture 1

Wenbing ZhaoWenbing ZhaoDepartment of Electrical and Computer EngineeringDepartment of Electrical and Computer Engineering

Cleveland State UniversityCleveland State University

[email protected]@ieee.org

22

Thursday, April 20, 2023Thursday, April 20, 2023 Wenbing ZhaoWenbing Zhao

OutlineOutline

• Motivation

• Syllabus

33


MotivationMotivation

• Why secure and dependable computing is important?*– Increased reliance on software to optimize everything from

business processes to engine fuel economy – Relentlessly growing scale and complexity of systems and

systems-of-systems – Near-universal reliance on a commodity technology base that is

not specifically designed for dependability – Growing stress on legacy architectures (both hardware and

software) due to ever-increasing performance demands – Worldwide interconnectivity of systems – Continual threats of malicious attacks on critical systems

*Taken from “A high dependability computing consortium”, James H. Morris, CSMU, http://www.cs.cmu.edu/%7Ejhm/hdcc.htm

44


More MotivationMore Motivation

• The cost of poor software is very high– Annual cost to US economy of poor quality software: $60B– source: US NIST Report 7007.011, May 2002.

• Industry needs greater dependability and security– Improved quality of products– Improved quality of development processes– Better system and network security, to avoid:

• viruses, trojans, denial of service, ...• network penetration, loss of confidential data, ...

• Improved customer satisfaction

55


(1996 Cost of Downtime Study – by Contingency Planning Research)

66


2001 Cost of Downtime per Hour – by 2001 Cost of Downtime per Hour – by Contingency Planning ResearchContingency Planning Research

77


More Motivation – An ExampleMore Motivation – An Example

• Amazon 2001: Revenue $3.1B, 7744 employees • Revenue (24x7): $350k per hour• Employee productivity costs: $250k per hour

– Assuming average annual salary and benefits is $85,000 and 50 working hours week

• Total Downtime Costs: $600,000 per hour • Note: Employee cost/hour comparable to

revenue, even for an Internet companySource: D. Patterson A simple way to estimate the cost of downtime. 16th Systems Administration Conference, November 2002.

88


Problem of Data BreachProblem of Data Breach

• Compromised computer systems• Lost laptop, backup tapes• Well-known incidents

– Massive confidential data loss in a UC Berkley system (1.4 million people are affected)

• http://www.securityfocus.com/news/9758

– Potential revealing of personal data of 26.5 million veterans due to loss of laptops

• http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1189759,00.html

99


Cost of Data BreachCost of Data Breach

• Data loss costs U.S. businesses more than $18 billion a year (according to a 2003 study)– http://www.usatoday.com/tech/news/

computersecurity/2006-06-11-lost-data_x.htm?csp=2

• Data breaches cost companies an average of $182 per compromised record => typically several million dollars per incident– http://searchsecurity.techtarget.com/originalContent/

0,289142,sid14_gci1227119,00.html

1010


Industry is Embracing Industry is Embracing Secure and Dependable ComputingSecure and Dependable Computing

• The hardware platforms are changing:– Smartcards– Pervasive computing / embedded systems

• IBM, Sun “autonomic computing”• Major PC dependability and security initiatives

under way:– Trusted Computing Group

• Promoters: Intel, HP, Compaq, IBM, Microsoft

– Microsoft’s trustworthy computing push– Intel’s LaGrande dependable hardware

1111


Course ObjectivesCourse Objectives• Have solid understanding of the basic theory of

secure and dependable computing• Getting familiar with some basic building blocks

(tools and APIs) needed to build secure and dependable systems

• No attempt to be comprehensive: topics covered are what I am interested in and what I think important

• Focus on basic knowledge and skills, rather than cutting edge state of the art

1212


PrerequisitePrerequisite

• Operating system principles– Processes, scheduling, file systems, etc.

• Computer networks– TCP, UDP, IP, Ethernet, etc.

• Java programming language– At least you should know how to write a Hello

World program– You don’t have to be a Java expert

1313


Grading PolicyGrading Policy

• Class participation (10%)

• Two midterms (40%)

• 5 labs (20%)– Mandatory attendance

• Course project (30%)

1414


Grading PolicyGrading Policy

• A: 90-100%

• A-: 85-89%

• B+: 75-84%

• B: 65-74%

• B-: 55-64%

• C: 50-54%

• F: <50%

1515


Class ParticipationClass Participation• 10% of the course credit• In general, there is a mock quiz in the beginning

of each lecture, so that– I know who is here & I get feedback for my teaching

• To obtain the full credit for class participation, you must satisfy ALL of the following conditions:– You do not miss more than 2 lectures – You do not miss any exam and lab sessions – You asked at least 10 questions during the semester

• You will lose all 10% credit if you miss more than 6 lectures/labs

1616


Class ParticipationClass Participation

• Send me an email with the following information for each question you have asked within 24 hours after each lecture:– The question you asked – My response – Your comment on my response and suggestion for

improvement, if any

1717


Class ParticipationClass Participation

• You are also encouraged to give me comments/suggestions on how you would like me to improve my teaching to make it more conducive

• For each piece of comment/suggestion, it will be counted as 2 questions

1818


Outline of LecturesOutline of Lectures

• Dependability concepts• Security and cryptography• Secure communication• Intrusion detection and prevention• Faults and their manifestation• Dependability techniques• Byzantine fault tolerance

1919


Outline of LabsOutline of Labs• Lab 0 – Getting familiar with Linux • Lab 1 – Secure shell • Lab 2 – Secure computing in Java • Lab 3 – Traffic analysis and intrusion detection• Lab 4 – Group communication with Spread

toolkit

2020


Course Project Course Project • Build an interesting secure and/or dependable

system/application• Course project must be original. You cannot use

research project to substitute the course project

• Example course project topics– Gmail secure data backup and recovery – Causally ordered reliable multicast – Token-based totally ordered reliable multicast– Public-key based authentication service– Traffic analysis of Telnet traffic

2121


Course ProjectCourse Project• Team of up to two (2) persons• You define the project you want to work on

– A secure Java application– A dependable Java service based on replication

• Deliverables– Project proposal: must have my approval– Progress report to help you keep good pace– Final project report

• Design documentation• Source code of your system/application• Performance measurement and analysis

– Demonstration and presentation

2222


What You Should Not DoWhat You Should Not Do

• Steal other’s project and use it as yours• Join a team but do not work on it at all• Why it is not a good idea to do so?

– If you can find it from the Internet, I can find it too => You get F grade

– During presentation, I will ask you questions=> Your grade on the project will be reduced significantly if I determine you don’t know what you are talking about

– You lose the chance of learning something practical and useful for your future career

2323


What You Should DoWhat You Should Do• Make your own design, code your own system• Write in your own words and create your own

power point slides– Don’t copy and paste => I can detect it easily

• If you are on a team, make your best contribution to the project– Different grade might be assigned to different team

members• Start early and don’t wait until the last week of

the semester to start• Communicate with me often and ask for help

2424


Project PresentationProject Presentation

• Each team is required to give an oral presentation in class (10-15min)– Describe briefly your design, implementation,

correctness and performance evaluation– Don’t spend too much time on background info– Don’t mention something you don’t know: I will ask

you questions– It is best to show a demo of your work

• Top 3 projects voted by students will get full credit automatically

2525


Project Report RequirementProject Report Requirement• Introduction: define the problem domain and your

implementation. Provide motivation on your system• System model: assumption, restrictions, models• Design: component diagram, class diagram, pseudo

code, algorithms, header explanation• Implementation: what language, tools, libraries did you

use, a simple user guide on how to user your system• Performance and testing: throughput, latency, test

cases• Related work• Conclusion and future work

2626


Project Report RequirementProject Report Requirement

• Report format: IEEE Transactions format. 4-10 pages– MS Word Template

• http://www.ieee.org/portal/cms_docs/pubs/transactions/TRANS-JOUR.DOC

– LaTex Template • http://www.ieee.org/portal/cms_docs/pubs/transactions/

IEEEtran.zip (main text)

• http://www.ieee.org/portal/cms_docs/pubs/transactions/IEEEtranBST.zip (bibliography)

• Report due: May 7 midnight (no extensions!)– Electronic copy of the report & source code is required

2727


ExamsExams

• Two midterms• Exams are closed book and closed notes,

except that you are allowed to bring with you a one-page cheat sheet no larger than the US letter size (double-sided allowed)

• There is no makeup exam!

2828


Do not cheat!Do not cheat!

• Do not copy other student’s lab report, exams or projects

• Do not copy someone else’s work found on the Internet– Including project implementation and report– You can quote a sentence or two, but put those in

quote and give reference– You can build your projects on top of open source

libraries, but again, you need to explicitly give acknowledgement and state clearly which parts are implemented by you

2929


Consequences for CheatingConsequences for Cheating

• You get 0 credit for the project/lab/exam that you have cheated

• If the task is worth more than 25% of the course, it is considered a major infraction

• Otherwise, it is considered a minor infraction

3030


Consequences for CheatingConsequences for Cheating

• For major infraction and repeated minor infractions– You will get an F grade, and – You may be suspended or repulsed from CSU

• CSU Code of Conduct– http://www.csuohio.edu/studentlife/conduct/

StudentCodeOfConduct2004.pdf

3131


Reference TextsReference Texts

• Security in Computing (4th Edition), by Charles P. Pfleeger, Shari Lawrence Pfleeger, Prentice Hall, 2006

• Computer Networks (4th Edition), by Andrew S. Tanenbaum, Prentice Hall, 2003

• Cryptography and Network Security: Principles and Practices (3rd Edition), by William Stallings, Prentice Hall, 2003

• SSH, the Secure Shell (2nd Edition), by Daniel J. Barrett, Robert G. Byrnes, Richard E. Silverman, O'Reilly, 2005

3232


Reference TextsReference Texts• Reliable Computer Systems: Design and Evaluation

(3rd Edition), by Daniel P. Siewiorek and Robert S. Swarz, A K Peters, 1998

• Distributed Systems: Principles and Paradigms, by Andrew S. Tanenbaum, and Maarten van Steen, Prentice Hall, 2002

• Reliable Distributed Systems: Technologies, Web Services, and Applications, by Kenneth P. Birman, Springer, 2005

• Network Intrusion Detection (3rd Edition), by Stephen Northcutt, Judy Novak, New Riders Publishing, 2002

3333


Instructor InformationInstructor Information

• Instructor: Dr. Wenbing Zhao– Email: [email protected]– Lecture hours: MW 6:00-7:50pm– Office hours: MW 2:00-4:00pm and by appointment

• Anonymous email:– [email protected]– Password:– if you are not happy, please do let me know

• Course Web site:– http://academic.csuohio.edu/zhao_w/teaching/

EEC693-S08/eec693.htm

3434


HomeworkHomework• Due Jan 16, 11:59pm• Email me the following information with “EEC693”

in the subject line– The amount of time per week you commit to this course

– The grade you expect to get

– If your schedule conflicts with my office hours, what is the best time for you to talk to me?

– Any topics you are most interested in but not listed, if any

– Comments and suggestions, if any

Documents

EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing