Final Study Guide

This is simply a guide of topics that I consider important for the final. I don’t promise to ask you about them all, or about any of these in particular; but I may very well ask you about any of these, as well as anything we discussed in class, in the discussion section, or that is in the textbook or readings.

1. Anything from before the midterm
2. Network Security
   1. Firewalls
   2. DMZs
   3. TLS, SSL
3. Access control matrix
   1. Matrix
   2. Primitive operations
   3. Commands
   4. Harrison-Ruzzo-Ullman result (undecidability of safety)
4. Authentication
   1. Passwords (selection, storage, attacks, aging)
   2. One-way hash functions (cryptographic hash functions)
   3. UNIX password scheme, what the salt is and its role
   4. Password selection, aging
   5. Challenge-response schemes
   6. Biometrics and other validation techniques
5. Access Control
   1. ACLs, C-Lists, lock-and-key
   2. UNIX protection scheme
   3. Multiple levels of privilege
   4. Lock and key
   5. MULTICS ring protection scheme
6. Information flow
7. Malware
   1. Trojan horse, replicating Trojan horse
   2. Computer virus
   3. Computer worm
   4. Bacteria, logic bomb
   5. Keystroke logger
   6. Ransomware
   7. Botnets
   8. Countermeasures
8. Common vulnerabilities
   1. Buffer overflows
   2. Injections (SQL, command)
   3. Failure to check inputs
   4. Execution with unnecessary privileges
9. Penetration studies
   1. Flaw hypothesis methodology
   2. Scoping the system
10. Intrusion detection

Matt Bishop Office: 2209 Watershed Sciences Phone: +1 (530) 752-8060 Email: mabishop@ucdavis.edu

ECS 153, Computer Security Version of December 1, 2019 at 12:52AM

You can also obtain a PDF version of this.