Midterm Study Guide

This is simply a guide of topics that I consider important for the midterm. I don’t promise to ask you about them all, or about any of these in particular; but I may very well ask you about any of these, as well as anything we discussed in class, in the discussion section, or that is in the readings (including the papers).

  1. Fundamentals
    1. What is security?
    2. Basics of risk analysis
    3. Relationship of security policy to security
    4. Policy vs. mechanism
    5. Assurance and security
  2. Saltzer’s and Schroeder’s principles of secure design
  3. Robust programming
  4. Common vulnerabilities
    1. Buffer overflows
    2. Injections (SQL, command)
    3. Failure to check inputs
    4. Execution with unnecessary privileges
  5. Penetration studies
    1. Flaw hypothesis methodology
    2. Scoping the system
  6. Attack models
    1. Attack trees
    2. Requires/provides model
  7. Access control matrix
    1. Matrix
    2. Primitive operations
    3. Commands
    4. Harrison-Ruzzo-Ullman result (undecidability of safety)
  8. Access Control
    1. ACLs, C-Lists
    2. UNIX protection scheme
    3. Multiple levels of privilege
    4. Lock and key
    5. MULTICS ring protection scheme
  9. Malware
    1. Trojan horse, replicating Trojan horse
    2. Computer virus
    3. Computer worm
    4. Bacteria, logic bomb
    5. Keystroke logger
    6. Ransomware
    7. Botnets
    8. Countermeasures
UC Davis sigil
Matt Bishop
Office: 2209 Watershed Sciences
Phone: +1 (530) 752-8060
Email: mabishop@ucdavis.edu
ECS 153, Computer Security
Version of April 23, 2016 at 8:30PM

You can also obtain a PDF version of this.