CY 3740 - Systems Security

Welcome to the landing page for what will eventually become the CY 3740 Fall 2021 website!

At this time I'm not officially affiliated with Northeastern yet, and all of my previous email accounts you'll find in various directories are fubar. You can reach me at the address you see on your left until we sort things out... but I'm also creating this page so that you don't have to go through the scarring experience of writing a stiff email to a professor. Everything you need to know about this course is below. Please pretend that this is a formal syllabus.

So what's the big deal?

This course will teach you security. All of it.

I realize that's a very ambitious goal for a 4-month stint. You won't have become a leet hacker by Spring, BUT you'll be equipped with all the fundamentals to go down the security rabbit hole as deep as you need or want to. If you want a career in security, take this course. If you want to do something else with your life, it's still a mighty good idea to take it; security has already become a topic you can't avoid no matter what career path you choose. You'll thank me when you get your pay check.

The course has two main components: classes and challenges.

Classes are just so much fun it's beyond belief, I can't express it with words, you need to come and see for yourself. We meet on Tuesdays from 6pm to 9pm. Be absolutely sure that you make it. There is no security book that covers this material, and I guarantee that you'll be lost if you don't attend classes. If you can't be present, DO NOT sign up, you've been warned.

Challenges are like homework but way more spectacular. I give you something to break, you do that, everything gets graded automatically, you get infinite tries until you succeed, and when you're done you know you're done. There is no report to write, no paper to submit, no stressful wait for grades. It's fast and fun. There'll be a new challenge every week, keeping you on your toes, but they're very lean and focused so that you don't waste your time with the unfun overhead.

Here comes the important part.

Classes are good fun, but this course is more about the challenges. You'll do a great deal of learning on your own. Classes will cover the basics, but the first time you see a challenge you may experience a fleeting WTF? sensation. These won't be a straightforward application of what you learned in class that day, you'll need to do some research and reading on your own, and then it'll click, and that'll feel really good.

All of this is designed to give you a real-life security professional experience. You'll write real exploits and break very realistic applications. Okay the applications are actually crap but the vulnerabilities are directly adapted from real-life cases. Many security professionals start and end their careers without having exploited a single XSS or stack overflow vulnerability. This is not a knock on them, but after completing this course, you'll be in a different league. No real-life exploit plays out like the examples in a textbook. The challenges capture that well, you need to keep calm and apply your hacker toolset to the circumstances.

Also notice that we are approaching things from an attacker's perspective most of the time. I won't make you defend anything or write secure code. I'll make you recognize bad code and bad design. I'll have you constantly break things in a safe environment, so that you get sick of it by the time we're done, and you spend the rest of your life making the world more secure. That last part isn't a joke, ethical hacking is a concept you'll hear a whole lot in my class. Thinking like an attacker is an asset, acting like one is a crime. If you were planning on getting rowdy on the Internet, don't come to my class. I'll call the cops on you.

Expect 10 main challenges. Add another 5, optional, but more quirky. There's plenty of extra points to score, but it's perfectly fine if you don't want the extras, an "A" is very doable without them. This gives you a lot of room to get a top grade even if you miss a few things.

There are 2 exams. Exams are often boring, and therefore I make them fun, and in the process impose more WTF? moments on students. To avoid that we might have a few short quizzes in the same format, so that y'all are prepared for what's coming.

Those bits about challenges and exams sound scary. Is it scary?

This is an easy no. My job is to make you succeed, and most of you will succeed. If you get a B, I too get a B in teaching. We don't want that.

You'll have 24-hour support when you get stuck. I rarely sleep. The course structure may feel a bit different to your typical CS or engineering courses. Different doesn't equate to difficult, I bet you'll find this easier and less time consuming than most other courses. Grades should never be a problem.

Check out my previous reviews for CS 5770 which follows a similar format, see what other people thought. Take both positive and negative comments with a grain of salt.

Can we get a proper syllabus now?

WARNING

CY 3740 and CY 5770 are similar enough that you SHOULD NOT take both. Pick one. Keep in mind that CY 3740 is the more advanced course despite being listed as an undergraduate course. That doesn't make it harder, just that the topics go deeper into modern attacks and defenses.


Classes

Tuesdays, 6pm-9pm. Bring coffee.


Topics


The list of topics is similar to CY 2550 on the surface. This course is the followup to that, we'll repeat the fundamentals, but then go into a lot more depth for each topic.


Non-Topics



Requirements



Grading


I curve grades in mysterious ways.