JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD

Course Objectives:

• To understand the computer security fundamentals
• To understand the integrity policies
• To understand system, user, program security issues

UNIT - I

An Overview of Computer Security: The Basic Components, Threats, Policy and Mechanism, Assumptions and Trust, Assurance, Operational Issues, Human Issues. Security Policies: Security Policies, Types of Security Policies, The Role of Trust, Types of Access Control, Example: Academic Computer Security Policy, General University Policy, Electronic Mail Policy, Confidentiality Policies: Goals of Confidentiality Policies, The Bell-LaPadula Model, Informal Description, Example: The Data General B2 UNIX System.

UNIT - II

Integrity Policies: Goals, Biba Integrity Model, Clark-Wilson Integrity Model, The Model, Comparison with the Requirements, Comparison with Other Models, Hybrid Policies: Chinese Wall Model, Bell- LaPadula and Chinese Wall Models, Clark-Wilson and Chinese Wall Models, Clinical Information Systems Security Policy, Bell-LaPadula and Clark-Wilson Models, Originator Controlled Access Control, Role-Based Access Control. Design Principles: Overview, Design Principles, Principle of Least Privilege, Principle of Fail-Safe Defaults, Principle of Economy of Mechanism, Principle of Complete Mediation, Principle of Open Design, Principle of Separation of Privilege, Principle of Least Common Mechanism, Principle of Psychological Acceptability.

UNIT - III

System Security: Introduction, Policy: The Web Server System in the DMZ, The Development System, Networks: The Web Server System in the DMZ, The Development System, Users: The Web Server System in the DMZ, The Development System, Authentication: The Web Server System in the DMZ, Development Network System.

UNIT - IV

User Security: Policy, Access: Passwords, The Login Procedure, Trusted Hosts, Leaving the System, Files and Devices: Files, File Permissions on Creation, Group Access, File Deletion, Devices, Writable Devices, Smart Terminals, Monitors and Window Systems, Processes: Copying and Moving Files, Accidentally Overwriting Files, Encryption, Cryptographic Keys, and Passwords, Start-up Settings, Limiting Privileges, Malicious Logic.

UNIT - V

Program Security: Introduction, Common Security-Related Programming Problems, Improper Choice of Initial Protection Domain, Improper Isolation of Implementation Detail, Improper Change, Improper Naming, Improper Deallocation or Deletion, Improper Validation, Improper Indivisibility, Improper Sequencing, Improper Choice of Operand or Operation, Testing, Maintenance, and Operation.

TEXT BOOK:

• 1. “Introduction to Computer Security”, Matt Bishop, Sathyanarayana S. Venkatramanayya, Pearson Education.

REFERENCES:

• 1. “Computer Security”, Dieter Gollmann, Wiley India.