Software Foundations of Security and Privacy

Course ID 15316

Description Security and privacy issues in computer systems continue to be a pervasive issue in technology and society. Understanding the security and privacy needs of software, and being able to rigorously demonstrate that those needs are met, is key to eliminating vulnerabilities that cause these issues. Students who take this course will learn the principles needed to make these assurances about software, and some of the key strategies used to make sure that they are correctly implemented in practice. Topics include: policy models and mechanisms for confidentiality, integrity, and availability, language-based techniques for detecting and preventing security threats, mechanisms for enforcing privacy guarantees, and the interaction between software and underlying systems that can give rise to practical security threats. Students will also gain experience applying many of these techniques to write code that is secure by construction.

Key Topics
Policy models: safety & liveness, information flow, capabilities
Reference monitors
Security type systems
Isolation principles & techniques: software fault isolation, control-flow integrity, hardware protection
Trusted computing: authorization logic, public key infrastructure, hardware & software support
Side channel vulnerability & defense
Techniques for ensuring rigorous data privacy
Identifying vulnerabilities in real systems

Learning Resources
See course website

Course Relevance
Fulfills a requirement in the undergraduate concentration in Security & Privacy and is an elective in the concentration on Principles of Programming Languages. Finally, it fulfills the Logics & Languages elective in the CS undergraduate program. 15-316 Section R is reserved for students who are unable to register for an in-person section due to a government visa/travel restriction or a documented medical condition. Enrollment in this section will require university-level approval. Register for an in-person section unless you are absolutely certain when you register that you will not be able to attend in-person this Fall.

Course Goals
The goal of the course is to teach students the principles and algorithms behind good security and privacy solutions, so they they can adapt and extend them in the future. In order to achieve this level of understanding, the course will cover a number of key ideas from logic and languages when developing the security topics above.

Pre-required Knowledge
Maturity in programming at the level of 15-213 or 15-150

Assessment Structure
Homeworks 45%, Labs 35%, Final Exam 20%

Course Link
https://15316-cmu.github.io/2023/index.html