Syllabus

NOTICE

This syllabus is a living document. I reserve the right to update policies as needed to adapt to changing circumstances. Policy changes will appear hear and be communicated in lecture and via email.

Course Description

This course presents the basic concepts of computer security, the different vulnerabilities that can occur throughout a system, how malicious attackers exploit these vulnerabilities, the defenses that can prevent or mitigate an attack, and the consequences and costs of attacks to individuals, organizations and societies. Topics include the security of cryptographic schemes, system software, networks, databases and programs, as well as the ethical, legal, and regulatory considerations surrounding data privacy and security.

Learning Objectives

• (Cryptographic Systems) Compare and contrast private and public key cryptosystems, and identify the strengths and potential pitfalls of cryptographic systems. [Analysis]
• (Systems Software) Illustrate and detect vulnerabilities in systems; explain how attacks can exploit such vulnerabilities; explain the defense mechanisms that can detect and prevent such attacks; and explain malware propagation mechanisms and defense strategies. [Development]
• (Data privacy and security) Analyze access control mechanisms to restrict database access, and use cryptography to maintain the privacy of data stored in databases. [Professionalism]
• (Network Security) Evaluate standard protocols to secure network communications and apply them in different scenarios; describe vulnerabilities in networking protocols that can be used to attack organizations; and understand how these can be detected or prevented. [Development]
• (Programming for Security) Analyze how programs inadvertently create security vulnerabilities, and how these can be detected and prevented at the design, implementation, or deployment stage. [Development]
• (Social Impact) Describe the implications of malicious attacks on computer systems to individuals, organizations, and society. [Professionalism]
• (Ethics) Explain ethical issues in cybersecurity and state how the job of a typical IT professional might be connected to major technology-related ethical issues of the day. [Professionalism]

Staff

Course Assistants

Grading

Your course grade is broken down as follows:

Grade categories on Canvas will have total point values that will be scaled accordingly.

Letter grades are decided by grade bins, which by default are as follows:

Grade bins are subject to change, but will only ever change favorably.

Course Format and Structure

Course attendance consists of:

• 3 weekly ~1hr lectures (Mon, Wed, Fri)
• 1 weekly ~2hr lab section (Thu)

Attendance is required for both lectures and lab sessions.

Lectures

Lecture attendance is tracked using in-class poll exercises over the course of the semester. These are graded on completion, not correctness, graded as follows:

def polls_score(
    num_answered: int, # number of answered polls over semester
    total_polls: int,  # total number of polls during semester
):
    percent_answered = num_answered / total_polls * 100
    if percent_answered >= 70:
      return 100
    else:
      return percent_answered

In other words, completion of 70% of the polls will result in full credit for the semester.

Labs

We use pwn.college for our lab activities. More details about pwn.college will be included in the first lab.

In general, the labs will consist of a series of increasingly difficult capture-the-flag (CTF) challenges related to the concepts covered in lecture. As part of lab completion, you will also submit a post-lab survey after completing the challenges. Challenges are meant to be completed within your scheduled lab section time, but may be completed any time before the post-lab deadline.

The challenges take place in a Linux environment, and you are expected to get comfortable with it, as working in a Linux environment is an expected skill from prerequisite courses. If you find yourself struggling with the first few labs, we strongly suggest you try some of the other challenge modules available on pwn.college to get up to speed.

Labs may be completed collaboratively, and with the help of AI, but all students are responsible for submitting solutions on pwn.college individually. Challenge completion is tracked on pwn.college.

Labs are graded as follows:

def lab_score(
    completed_challenges: int, # number of completed lab challenges
    total_challenges: int,     # number of lab challenges assigned
    survey_completed: int,     # 1 if post-lab survey completed, 0 otherwise
    attendance: int,           # 1 if attendance marked, 0 otherwise
):
    challenge_score = completed_challenges / total_challenges * 80
    return survey_completed * challenge_score + (attendance * 20)

Other important details:

• CAs will take attendance at every lab section (and note who leaves early).
• Lab instructions will be released by Thursday 8am before lab sections.
• Labs will be due by Friday 11:59pm the following day, including the post-lab.
• There is a 1-hour grace period for submission.

Extra Credit

Additionally, it will be possible to earn extra credit through doing additional specific pwn.college challenges. The list of such challenges will be made available on the course website and may be updated throughout the semester.

In general, easier challenges on the list will be worth fewer points. They are primarily there to incentivize you to take the time to build more experience in the challenge environment. Correspondingly, harder challenges worth more points are there as a reward for taking initiative and going deeper.

The maximum amount of extra credit available through completion of these challenges will be capped. The instructor(s) reserves the right to increase (or decrease) that cap as they see fit.

Homework

There will be 5 problem sets assigned over the course of the semester that may include a mix of free response questions, short essays, and programming. These will be graded on correctness.

• You may discuss these problem sets with one another, and with AI, but you may not directly share solutions or code. If you do discuss with other students or AI, you must list your collaborators on your submission. e.g.

  Collaborators:
  - John Doe
  - Jane Doe
  - ChatGPT (GPT 5.6 Sol)
  - Gemini 3.6 Flash

• You may not use AI to complete the problem sets for you. If caught, you will at minimum receive a 0 on the assignment, and the incident reported to the Honor Board.

• All students are still responsible for submitting their solutions individually on Gradescope.

Late Policy

Note: this policy applies only to homework.

• You have 3 total slip days to use throughout the semester for homework extensions. Slip days are applied automatically. Do not email the instructor to use them.

• Following any slip days used, there will be a 20% penalty for each additional day late. The last day to submit an assignment for a maximum 50% penalty will be explicitly stated on the the assignment instructions.

• There is a 10 minute grace period for assignment submissions before slip days or penalties are applied.

In the case of medical emergencies or exceptionally extenuating circumstances, please contact the instructor as soon as possible.

Exams and Quizzes

There will be 4 unit exams each worth 10% of your final grade (for a total of 40%) that will be taken in-person during regularly scheduled lecture.

There will also be 4 quizzes leading up to each exam, each worth 2.5% (for a total of 10%) of your final grade, which will be administered in-person during the first 15-20 minutes of lecture.

If you require testing accommodations, please be sure to register them with the Office of Disability Services no later than 3 weeks after the start of the semester.

Room Policies

Exams and quizzes are conducted in-person. All accomodation requests must be registered with the Office of Disability Services at least 1 week before the relevant accomodation would apply.

The following procedures apply to quizzes and exams for this course. The instructor reserves the right to modify any conditions set forth below by printing revised Exam Room Policies on the quiz or exam.

1. You may not use any electronic devices during exams or quizzes. This includes, but is not limited to:

   • Laptops
   • Cell Phones
   • Tablets
   • Smart Watches
   • Smart Glasses

2. You may not work with or talk to other students during exams.

3. You may use one, double-sided, 8.5 x 11 page of handwritten notes on exams only. No other materials are permitted. Using notes that are not handwritten or larger than the indicated size will result in a penalty on the final exam score.

Regrade Requests

• Students have 3 days after grades are posted to inform your grader and the instructor of a problem. Regrade requests submitted after 3 days have passed will be ignored.

Course Materials

All necessary reading materials will be made available either on Canvas or the course website.

Optional Textbooks:

• Bishop. Computer Security: Art and Science, 2nd Ed.
• Pfleeger, Pfleeger, and Margulies. Security in Computing, 5th Ed.

Academic Integrity

Generative AI

You may use generative AI technology (e.g. GPT, Gemini, Claude, etc.) with care to generate ideas, brainstorm, and do research. However, you should note that the material generated by these programs may be inaccurate, incomplete, or otherwise problematic.

You may treat these programs like a virtual fellow student: you are allowed to “discuss” with them at a conceptual level (though be aware that the information they provide may be inaccurate), but you cannot share solutions or code in either direction. Presenting AI-generated work as your own is plagiarism.

If you include material generated by an AI program, it should be cited like any other reference material and clearly attributed with the model identifier. (e.g. openai/gpt-5.6-sol, openai/gpt-5-5, anthropic/claude-opus-4-8, anthropic/claude-fable-5, see docs.aimlapi.com for more examples)

Any plagiarism or other form of cheating will be dealt with under relevant Stevens policies.

Undergraduate Honor System

Enrollment into the undergraduate class of Stevens Institute of Technology signifies a student’s commitment to the Honor System. Accordingly, the provisions of the Stevens Honor System apply to all undergraduate students in coursework and Honor Board proceedings. It is the responsibility of each student to become acquainted with and to uphold the ideals set forth in the Honor System Constitution. More information about the Honor System including the constitution, bylaws, investigative procedures, and the penalty matrix can be found online.

The following pledge shall be written in full and signed by every student on all submitted work (including, but not limited to, homework, projects, lab reports, code, quizzes and exams) that is assigned by the course instructor. No work shall be graded unless the pledge is written in full and signed.

“I pledge my honor that I have abided by the Stevens Honor System.”

Reporting Honor System Violations. Students who believe a violation of the Honor System has been committed should report it within ten business days of the suspected violation. Students have the option to remain anonymous and can report violations online.

Accomodations

Stevens Institute of Technology is dedicated to providing appropriate accommodations to students with documented disabilities. The Office of Disability Services (ODS) works with undergraduate and graduate students with learning disabilities, attention deficit-hyperactivity disorders, physical disabilities, sensory impairments, psychiatric disorders, and other disabilities to help students achieve their academic and personal potential. They facilitate equitable access to the educational programs and opportunities offered at Stevens and coordinate reasonable accommodations for eligible students. These services are designed to encourage independence and self-advocacy with support from the ODS staff. The ODS staff will facilitate the provision of accommodations on a case-by-case basis.

For more information about Disability Services and the process to receive accommodations, visit their website. If you have any other questions, please contact the Office of Disability Services at disabilityservices@stevens.edu or by phone at 201.216.3748.

Disability Services Confidentiality Policy

Student Disability Files are kept separate from academic files and are stored in a secure location within the Office of Disability Services. The Family Educational Rights Privacy Act (FERPA, 20 U.S.C. 1232g; 34CFR, Part 99) regulates disclosure of disability documentation and records maintained by Stevens Disability Services. According to this act, prior written consent by the student is required before our Disability Services office may release disability documentation or records to anyone. An exception is made in unusual circumstances, such as the case of health and safety emergencies.

Inclusivity

Stevens Institute of Technology believes that diversity and inclusiveness are essential to excellence in academic discourse and innovation. In this class, the perspective of people of all races, ethnicities, gender expressions and gender identities, religions, sexual orientations, disabilities, socioeconomic backgrounds, and nationalities will be respected and viewed as a resource and benefit throughout the semester. Suggestions to further diversify class materials and assignments are encouraged. If any course meetings conflict with your religious events, please do not hesitate to reach out to your instructor to make alternative arrangements.

You are expected to treat your instructor and all other participants in the course with courtesy and respect. Disrespectful conduct and harassing statements will not be tolerated and may result in disciplinary actions.

Name and Pronoun Usage. As this course includes group work and class discussion, it is vitally important for us to create an educational environment of inclusion and mutual respect. This includes the ability for all students to have their chosen gender pronoun(s) and chosen name affirmed. If the class roster does not align with your pronouns and/or name, please inform the instructor of the necessary changes.

Religious Holidays. Stevens is a diverse community that is committed to providing equitable educational opportunities and supporting students of all ethnicities and belief systems. Religious observance is an essential reflection of that rich diversity.

Students will not be subject to any grade penalties for missing a class, examination, or any other course requirement due to religious observance. In addition, students will not be asked to choose between religious observance and academic work. Therefore, students should inform the instructor at the beginning of the semester if a requirement for this course conflicts with religious observance so that accommodations can be made for students to observe religious practices and complete the requirements for the course.

Mental Health Resources

Part of being successful in the classroom involves a focus on your whole self, including your mental health. While you are at Stevens, there are many resources to promote and support mental health. The Office of Counseling and Psychological Services (CAPS) offers free and confidential services to all enrolled students who are struggling to cope with personal issues (e.g., difficulty adjusting to college or trouble managing stress) or psychological difficulties (e.g., anxiety and depression). Appointments can be made by phone (201-216-5177), online, or in person on the 2nd Floor of the Student Wellness Center.

Emergency Information

In the event of an urgent or emergent concern about your own safety or the safety of someone else in the Stevens community, please immediately call the Stevens Campus Police at 201-216-5105 or on their emergency line at 201-216-3911. These phone lines are staffed 24/7, year-round. For students who do not reside near the campus and require emergency support, please contact your local emergency response providers at 911 or via your local police precinct. Other 24/7 national resources for students dealing with mental health crises include the National Suicide Prevention Lifeline (1-800-273-8255) and the Crisis Text Line (text “Home” to 741-741). If you are concerned about the wellbeing of another Stevens student, and the matter is not urgent or time sensitive, please email the CARE Team at care@stevens.edu. A member of the CARE Team will respond to your concern as soon as possible.