Jimma University Faculty of

Jimma Institute of Computing

Technology And informatics
Course Title: Computer Security
Course Code: CoSc4035
CoSc2032(Data
Prerequisite: Communications and
Computer Networks)
Target Group 4th Computer Science Students
CP/ECTS 3(5)hrs
Instructor Name Mikru L.
Emaile [email protected]
Course Description
To familiarize students with the security issues and technologies involved in modern
information systems, including computer systems and networks and the various ways
in which information systems can be attacked and trade-offs in protecting networks.
Course Objectives
By the end of this course, students will be able to:
  Understand the basic concepts in information security, including security
attacks/threats, security vulnerabilities, security policies, security models, and
security mechanisms

 Understand the concepts, principles and practices related to elementary

cryptography, including plain-text, cipher-text, the four techniques for crypto-
analysis, symmetric cryptography, asymmetric cryptography, digital signature,
message authentication code, hash functions, and modes of encryption
operations.

 Understand issues related to program security and the common vulnerabilities

in computer programs; including buffer overflow vulnerabilities, time-of-
check to time-of-use flaws, incomplete mediation.

 Explain and compare security mechanisms for conventional operating

systems, including memory, time, file, object protection requirements and
techniques and protection in contemporary operating systems.

 Understand the basic requirements for trusted operating systems, and describe
the independent evaluation, including evaluation criteria and evaluation
process.

 Describe security requirements for database security, and describe techniques

for ensuring database reliability and integrity, secrecy, inference control, and
multi-level databases.

 Describe threats to networks, and explain techniques for ensuring network

security, including encryption, authentication, firewalls, and intrusion
detection.

 Explain the requirements and techniques for security management, including

security policies, risk analysis, and physical threats and controls.

Course Content:
Chapter 1: Introduction to Computer Security (3 hrs)
 Basic concepts of computer security
 Threats, vulnerabilities, controls, risk
 Goals of computer security
 Security attack
 Security policies and mechanisms
 Prevention, detection, and deterrence
 Software security assurance
Chapter 2: Computer Threat (4 hrs)
 Malicious code
 Viruses
  Trojan horses
 Worms
 Spy-wares, etc.
 Class of Attacks
 Reconnaissance
 Access
 Denial of Service, etc.
 Program flaws
 Buffer overflows
 Time-of-check to time-of-use flaws
 Incomplete mediation
 Controls to protect against program flaws in execution
 Operating system support and administrative controls
 Program Security Defenses
 Software development controls and Testing techniques
 Database management systems security
Chapter 3: Cryptography and Encryption Techniques (13 hrs)
 Basic cryptographic terms
 Historical background
 Cipher Techniques
 Transposition Cipher
 Substitution Cipher
 Conventional encryption algorithms
 Cryptanalysis
 Cryptographic Systems
 Symmetric key cryptography
o DES
o 3DES
o AES
o Block Cipher Modes
 Public key cryptography
o Diffie-Hellman
o RSA
 Digital Signature
o Using Public Key
o Using Message Digest
 MD4family
 SHA family
 RIPEMD
  Public key Infrastructure (PKI)
o Trusted Third Party
o Certification
o Key Distribution
o PKI Topology
o Enrolment and Revocation Procedures
Chapter 4: Network Security (4 hrs)
 Network security basics
 Threats on network
 Trust, Weaknesses, Risk and Vulnerabilities
 TCP/IP Suit Weaknesses and Buffer Overflows
 Network security protocols
 Application layer security
o Web security
o E-mail security
 Transport layer security
 Network layer security
 Link layer security
 Physical security
 Wireless security
Chapter 5: Security Mechanisms (3 hrs)
 Firewall
 Proxy server
 IDS/IPS
 Virtual Private network
Chapter 6: Authentication and Access control (3 hrs)

 Authentication basics
 Password and Passphrase
 Biometrics
o Fingerprint
o Palm Scan
o Hand Geometry
o Iris Scan
o Signature Dynamics
o Voice Print
o Facial Scan
o Hand Typography
 AAA server
  Smart card and memory cards
 Kerberos
 Access control basics
 Access control models
 Discretionary Access Control (DAC)
 Mandatory Access Control (MAC)
 Role-Based Access Control (RBAC)

Chapter 7: Administering security (2 hrs)

 Security planning
 Risk analysis
 Security policies
 Cyber security
 Ethics

Assessment/Evaluation

Assignment/quizzes 10 %
Mid semester examination 20%
Project ` 20%
Final examination 50%

. Text books:
 Security in Computing, Charles P. Pfleeger and Shari L. Pfleeger. (3rd
edition), Prentice-Hall, 2003
References:
1. Computer Security, Dicter Gouman, John Wiley & Sons
2. Computer Security: Art and Science, Mathew Bishop, Addison-Wesley
3. Principles of Information Security, Whitman, Thomson.
4. Network security, Kaufman, Perl man and Speciner, Pearson Education
5. Cryptography and Network Security, 5th Edition William Stallings, Pearson
Education
6. Introduction to Cryptography, Buchmann, Springer.