Weill Medical College of Cornell University · Courses
eCornell CS
6 courses with the subject eCornell CS, each shown exactly as we captured it from the college's catalog, with every element we hold. Where the wording looks broken, that is our reading of the catalog, not the college's text.
eCornell CS431Systems Security0
In this course, you examine security for computers and networked information systems. The focus is abstractions, principles, and their practical embodiments for implementing military as well as commercial-grade secure systems. You will learn the technical vocabulary of the field so that you can access the technical literature. You will also engage in discussions of policy issues; for example, the national debates on cryptography policy. The landscape of security mechanisms will be surveyed: authentication (for people and for machines), authorization, audit, and enforcement (through isolation, monitoring, and asymmetric costs).
Protocols for authenticating machines have an important role in systems security, and this course will focus on various aspects of this challenge. Using case studies of protocols that work and that have failed will help you to acquire the skill and skepticism necessary to analyze and deploy authentication protocols successfully. In this course, you will investigate shared key and public key cryptography and the trade-offs associated with these different types of keys. You will also examine some of the standard cryptographic building blocks and their use. It is recommended to only take this course if you have completed Systems Security or have equivalent experience.
If an attacker can masquerade as an authorized user of a system, then many other defenses become irrelevant. This course addresses how a computing system can authenticate a human user, discussing implementations of mechanisms as well as their privacy implications. Passwords, biometrics, and tokens all will be discussed, along with their combination as multifactor authentication. It is recommended to only take this course if you have completed Systems Security and Authenticating Machines or have equivalent experience.
Access control mechanisms ensure that a user is able to read and/or update only certain objects. With discretionary access control, it is the creator of an object who decides which other users should have access. A broad set of mechanisms have been developed to enforce discretionary access control in a computing system. This class will survey the two approaches widely used in these mechanisms: access control lists and capabilities. Implementations in processor hardware, operating systems, and programming languages will be discussed. Case studies will illustrate the pragmatics. It is recommended to only take this course if you have completed Systems Security, Authenticating Machines, and Authenticating Humans, or have equivalent experience.
Sometimes the owner of an object is not, in fact, the one to determine who should get to access that object; rather, it is an institutional policy that dictates that decision. That form of access control is known as mandatory access control, and it is frequently used in business and military settings. This course is dedicated to discussing various forms of mandatory access control policies and their implementations, including multilevel security, commercial, and role-based access control schemes. It is recommended to only take this course if you have completed Systems Security, Authenticating Machines, Authenticating Humans, and Discretionary Access Control, or have equivalent experience.
eCornell CS436Enforcement Mechanisms and Strategies0
Vulnerable systems are made secure by employing enforcement mechanisms. Beyond enforcement mechanisms for authentication and for authorization, this course will explore the use of mechanisms for protecting the integrity of systems and, thus, preventing an attacker from circumventing controls. You will learn about the three primary classes of enforcement mechanisms mediation/monitoring, isolation, and asymmetry and discuss how they are deployed in systems today. It is recommended to only take this course if you have completed Systems Security, Authenticating Machines, Authenticating Humans, Discretionary Access Control, and Mandatory Access Control, or have equivalent experience.
