Schedule and Readings

Introduction (Lecture Notes)

Overview of Network Security (Lecture Notes)

Internet Architecture and IP Addresses (Lecture Notes)

• Comer's Book: Chapter 4.

ARP Protocol and ARP Cache Poisoning (Lecture Notes)

• Required Reading: The IP Smart Spoofing.
• Quick guide of what you can do with ARP.
• Comer's Book: Chapter 5 and 6.

IP Protocol and Attacks (Lecture Notes)

• RFC1858 - Security Considerations for IP Fragment Filtering
• Manual of "ping" command in Solaris (type "man ping"). You can use "ping" to understand several fields of an IP packet, including IP options and Time To Live.
• Comer's Book: Chapter 7.

ICMP Protocol and Attacks (Lecture Notes)

• Comer's book: Chapter 9.
• CERIAS slides (Network.ppt).

UDP Protocol and Attacks (Lecture Notes)

• Comer's book: Chapter 12.

TCP Protocol and Attacks (Lecture Notes)

• Comer's book: Chapter 13.
• Required Reading: ICMP attacks against TCP, by Gont, F.
• Required Reading: Slipping in the Window: TCP Reset attacks, by Paul A. Watson.
• Strange Attractors and TCP/IP Sequence Number Analysis by Zalewski.
• Remote OS detection via TCP/IP Stack FingerPrinting by Fyodor, 1998.

Basics of Cryptography (Lecture Notes)

• Secret key cryptography
• Public key cryptography
• One-way hash function
• Required Reading: Block cipher modes of operation
• Required Reading: Hash Collisions (The Poisoned Message Attack)
• Required Reading: Steve Friedl's Unixwiz.net Tech Tips: An Illustrated Guide to Cryptographic Hashes

IPSec (Lecture Notes)

• Required Reading: Steve Friedl's Unixwiz.net Tech Tips: An Illustrated Guide to IPsec.

Kerberos (Lecture Notes)

DNS and Pharming Attacks (Lecture Notes)

• Required Reading: The Pharming Guide
• Required Reading: DNS and BIND's Sample Chapter 2: How Does DNS Work?
• Required Reading: Security Issues with DNS
• Using the Domain Name System for System Break-ins
• Threat Analysis of the Domain Name System (DNS)

Cross-Site Scripting

• Required Reading: Cross-site Scripting from Wikipedia
• Required Reading: Cross-Site Scripting Worms and Virses
• News: Cross-Site Scripting Worm Floods MySpace

SQL Injection Attacks

• Required Reading: Steve Friedl's Unixwiz.net Tech Tips: SQL Injection Attacks by Example

Security of BGP Routing Protocols (Lecture Notes)

• Comer's book: Chapter 14, 15, and 16.
• Required Reading (Pages 1-16): Butler et al. A Suvey of BGP Security.
• Nordstrom and Dovrolis. Beware of BGP Attacks.

Firewall (Lecture Notes)

• Testing a router or firewall.
• Firewall Related Topics.
• HOWTO bypass Internet Censorship.
• Punching holes into firewalls.
• How To Give Network Security Administrators a Tremendous Headache.
• Firewalking.

Intrusion Detection (Lecture Notes)

• Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection.
• Snort.

Other Reading Materials

• Comer's Slides for his TCP/IP book.
• Network Security Slides from CERIAS by Pascal Meunier et al (Thanks to the generosity of Purdue's Center for Education and Research in Information Assurance and Security and Symantec Corp). Slides from the "Class 3" module is helpful to this course.