University: Dilla University
College/Faculty: School of Computing and
Informatics Course title: Computer Security
Course code: CoSc4031
Credit hours: 3 ECTS: 5 Contact hrs: 2 Lab hrs: 3 Tutorial hrs: 1
Prerequisite: CoSc2034-Data Communications and
Computer Networks Course category: compulsory
The course will be given on Year: IV Semester: I
Course Description
To familiarize students with the security issues and technologies involved in modern
information systems, including computer systems and networks and the various ways in which
information systems can be attacked and tradeoffs in protecting networks.
Course objectives
By the end of this course, students will be able to:
Understand the basic concepts in information security, including security
attacks/threats, security vulnerabilities, security policies, security models, and security
mechanisms
Understand the concepts, principles and practices related to elementary
cryptography, including plain-text, cipher-text, the four techniques for crypto-
analysis, symmetric cryptography, asymmetric cryptography, digital signature,
message authentication code, hash functions, and modes of encryption operations.
Understand issues related to program security and the common vulnerabilities
in computer programs; including buffer overflow vulnerabilities, time-of-check
to time-of-use flaws, incomplete mediation.
Explain and compare security mechanisms for conventional operating systems,
including memory, time, file, object protection requirements and techniques and
protection in contemporary operating systems.
Understand the basic requirements for trusted operating systems, and describe the
independent evaluation, including evaluation criteria and evaluation process.
Describe security requirements for database security, and describe techniques
for ensuring database reliability and integrity, secrecy, inference control, and
Page | 1
multi-level databases.
Describe threats to networks, and explain techniques for ensuring network
security, including encryption, authentication, firewalls, and intrusion detection.
Explain the requirements and techniques for security management, including security policies,
risk analysis, and physical threats and controls.
Course Outline
Chapter 1: Introduction to Computer Security (3 hrs)
Basic concepts of computer security
Threats, vulnerabilities, controls, risk
Goals of computer security
Security attack
Security policies and mechanisms
Prevention, detection, and deterrence
Software security assurance
Chapter 2: Computer Threat (4 hrs)
Malicious code
Viruses
Trojan horses
Worms
Spy-wares, etc.
Class of Attacks
Reconnaissance
Access
Denial of Service, etc.
Program flaws
Buffer overflows
Time-of-check to time-of-use flaws
Incomplete mediation
Controls to protect against program flaws in execution
Operating system support and administrative controls
Program Security Defenses
Software development controls and Testing techniques
Page | 2
Database management systems security
Chapter 3: Cryptography and Encryption Techniques (13 hrs)
Basic cryptographic terms
Historical background
Cipher Techniques
Transposition Cipher
Substitution Cipher
Conventional encryption algorithms
Cryptanalysis
Cryptographic Systems
Symmetric key cryptography
o DES
o 3DES
o AES
o Block Cipher Modes
Public key cryptography
o Diffie-Hellman
o RSA
Digital Signature
o Using Public Key
o Using Message Digest
MD4family
SHA family
RIPEMD
Public key Infrastructure (PKI)
o Trusted Third Party
o Certification
o Key Distribution
o PKI Topology
o Enrollment and Revocation Procedures
Chapter 4: Network Security (4 hrs)
Network security basics
Threats on network
Page | 3
Trust, Weaknesses, Risk and Vulnerabilities
TCP/IP Suit Weaknesses and Buffer Overflows
Network security protocols
Application layer security
o Web security
o E-mail security
Transport layer security
Network layer security
Link layer security
Physical security
Wireless security
Chapter 5: Security Mechanisms (3 hrs)
Firewall
Proxy server
IDS/IPS
Virtual Private network
Chapter 6: Authentication and Access control (3 hrs)
Authentication basics
Password and Passphrase
Biometrics
o Fingerprint
o Palm Scan
o Hand Geometry
o Iris Scan
o Signature Dynamics
o Voice Print
o Facial Scan
o Hand Typography
AAA server
Smart card and memory cards
Kerberos
Access control basics
Access control models
Page | 4
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Chapter 7: Administering security (2 hrs)
Security planning
Risk analysis
Security policies
Cyber security
Ethics
Lab content: using OpenSSL
Lab 1: Installing and configuring OpenSSL
Lab 2: Introduction and commands used in
OpenSSL
Lab 3: Encryption using conventional
algorithms
Lab 4: Symmetric encryption with OpenSSL
Lab 5: Encrypting file using DES
Lab 6: Asymmetric encryption with
OpenSSL L
Lab 7: Encrypting file using RSA
Lab 8: Combination of DES and RSA
Lab 9: Digital Certification with
OpenSSL
Lab 10: Digital Signature
Page | 5
Assessment methods
Assignment/quizzes 10%
Mid semester examination 20%
Project /Lab 20%
Final examination 50%
Total 100%
Text books:
Security in Computing, Charles P. Pfleeger and Shari L. Pfleeger. (3rd edition), Prentice-Hall,
2003
References:
1. Computer Security, Dicter Gouman, John Wiley & Sons
2. Computer Security: Art and Science, Mathew Bishop, Addison-Wesley
3. Principles of Information Security, Whitman, Thomson.
4. Network security, Kaufman, Perl man and Speciner, Pearson Education
5. Cryptography and Network Security, 5th Edition William Stallings, Pearson Education
6. Introduction to Cryptography, Buchmann, Springer.
Page | 6
