Topics

Since this is an experimental course which is being taught for the first time, the topics listed here are tentative. Below is a rough summary.

Threat modeling and Security Mindset

Control Flow Integrity - Exploits and Defenses

• Buffer overflow, use after free, ROP, CFI memory safety

Access control

• Least privilege, authorization, discretionary access control, mandatory access control, reference monitors, role-based access control.

Information Flow Control

• Flow policies, security lattices, static and dynamic control, decentralized flow control, taint tracking

Privilege separation and isolation

• VM, containers, sandboxing

Auditing and host-based intrusion detection

• Auditing mechanisms, provenance analysis, APT attack killchain, Mitre framework

Recent cloud security papers

• Taint tracking in microservices
• New access control models
• DIFC, dynamic flow control
• Papers on securing containers and VMs

Recent IoT security papers

• Access control and flow control in IoT
• Usability of systems and devices

Enterprise Security papers

• Mimicry attacks
• Integrity of audit logs
• EDR (Endpoint detection and response) systems