This is a course on computer systems security through a balanced mixture of theory and practice.

We’ll start out with building the foundations of security through an exploration of cryptography. From there, we’ll move to more complex, multi-faceted systems such as web applications, operating systems, and networks. Along the way, we’ll explore complementary topics such as authentication, physical security, social engineering, privacy, anonymity, usability, and the security of emergent systems such as blockchains and machine learning.

By learning about security through these multiple domains, you’ll concretely learn how various classes of attacks appear in a vast variety of scenarios and how they work in practice. You’ll also learn how to evaluate systems adversarially, from writing precise security analyses about subtle issues in protocols to discovering and exploiting vulnerabilities in concrete technical systems for yourself.

Through all of these activities, you’ll ultimately work to develop a specific kind of intuition—a “security mindset”—that will give you the knowledge, vocabulary, and confidence to critically analyze and effectively defend the software and systems you approach as a computer scientist even after the course.

We strongly encourage you to consider taking CS162, the additional half-credit “lab”. If you take CS162, you’ll have the opportunity to work on advanced challenges that will provide you with a greater appreciation of systems security and the “security mindset” as a whole:

CS162 is intended to be taken concurrently with CS166 and provides students with a deeper understanding of the material by doing advanced versions of the CS166’s projects and advanced questions on the written assignments (homeworks and midterms). These advanced versions focus on real-world skills: performing attacks that are more difficult and rely on less serious vulnerabilities, performing attacks against systems with more real-world constraints, and creating attacks that achieve a higher standard of quality than a mere proof of concept.

In previous years, CS162 students report spending approximately 8 to 20 extra hours on each project throughout the semester, though they also note that the additional components are more front-loaded so the second half of the semester is much more flexible. (We anticipate that this will be the same this year.) You do not need any additional experience on the base prerequsites of the course to succeed in CS162—anyone who feels comfortable taking CS166 and is able to put in the extra time should also feel comfortable taking CS162.

If you’re interested, undergraduate and PhD students should register for CS162 as normal on Courses@Brown. (Senior undergraduates are eligible to capstone with CS162—email the HTA list if you intend to capstone.) If you’re a Masters student, you may earn 2000-level credit for CS166 by completing the CS162 requirements—email the HTA list if you want to do this.

You should have an intro-sequence’s worth of programming experience (016, 018, or 019) and have a good understanding of systems programming (030, 033, 131, or 133). This concretely means that:

• You should be comfortable writing programs and scripts in the language of your choice (such as Python, Ruby, Bash, Go, C++, etc.), be comfortable in a Unix command-line environment (running binaries, filesystem navigation, etc.) and using SSH with the Brown CS filesystem, have a basic understanding of systems programming concepts such as memory management and networking.
• You also should have heard of the terms “race condition”, “packet”, “TCP”, “UDP”, “buffer overflows”, and “DNS”. (If you forget what these are, don’t worry—we’ll describe them again when they come up in the latter half of the course.)
• You should also be at least somewhat comfortable (and very willing) to learn new programming languages and reading code in languages and programs that you’ve never used before. (You’ll get lots of practice with this in this course!)

If you don’t meet the official prerequisites but still want to take the course, talk to the HTAs (they can advise you on your particular situation).

Your willingness to challenge yourself is perhaps the most important prerequsite for the course. Security can be frustrating at times, but the rewards are great—in exchange for engaging with some difficult intellectual challenges, you’ll have the opportunity to gain concrete insights about systems and security and become a better computer scientist by the end of the course.

We will have live lecture on Tuesdays and Thursdays @ 1pm - 2:20pm ET using Zoom. The information needed to access the lectures is available on the Piazza board.

Attendance Policy: Attending lectures synchronously and active class participation is highly encouraged, but not required. While lecture will be recorded, class participation will help the instructor better assess your understanding of the topics in determining the final grade.

The instructor determines overall letter grades by taking into account the final numerical grade and, in borderline cases, class participation in both lecture and sections. If you can’t attend lectures, we recommend that you try to attend one of the sections each week (though section attendance is not required). In other words, not attending lecture and section won’t directly impact your grade, but you might get more out of lecture and section if you’re able to participate (and, if you’re at a letter grade boundary, class participation and attendance might positively impact your final letter grade at the instructor’s discretion).

If you’re unable to attend lecture on a given date, you don’t need to notify us. (If you’ll routinely be unable to attend lecture—for instance, due to time zone constraints—email Bernardo briefly explaining why in the first two weeks of the course.)

Asking Questions: During the lecture all students will be muted, but we encourage signaling your questions via Zoom chat. This helps us maintain a queue of student questions. You can either ask your question directly in the chat, or, if you want to ask your question verbally, simply type the word "question" in the chat and Bernardo will signal to you when you can unmute and ask your question.

Recording Policy: Lectures will be recorded and made available to all registered students within 24 hours of the lecture date via this Panopto folder (during shopping period, if you are not officially registered, you need to have CSCI1660 in your Primary Cart on Courses@Brown in order to see the Panopto folder). We will also post lecture slides for each lecture. For organizational and privacy reasons (some course content covers sensitive topics), the lecture recordings (not the slides) will be automatically removed three weeks after each lecture is given. However, if you have extenuating circumstances that prevent you from watching a given lecture within three weeks, email Bernardo to request a one-off extension to view a given lecture past that time.

“Chatting Time”: The 10 minutes following the end of lecture are “Chatting Time”. During “Chatting Time”, Bernardo (and, occassionally, some of your TAs) will remain in the Zoom call and will be available to answer any questions about the lecture material, talk about course logistics, or, in general, just chat with students and other course staff members before the call ends. (“Chatting Time” won’t be included in the Zoom recording.)

Zachary and William will lead synchronous weekly recitation sections on most weeks. Sections are optional, but attendance is highly recommended—many students in previous years find that they’re directly helpful on for working on the assignments in the course in preparing for the midterms. (They’re also designed to give you an opportunity to get to work with and meet some of your fellow classmates in the course.) Please see Sections for more information.

The Collaboration Policy details the rules surrounding collaboration on all aspects of the course and plays a major role in the pedagogical goals of the course. Please read it in its entirety and make sure you understand its contents before working on any assignment in this course.

To emphasize the points related to collaborating with other students in the course:

• Midterms: Must be completed entirely independently. Any form of collaboration on midterms is strictly prohibited other than that detailed in the Collaboration Policy.

• Projects: Whenever you’re actively interacting with project systems, you must do so entirely independently. “Actively interacting” includes having the project systems (binary, website, etc.) within sight or interacting with them, exploring system source code, writing your deliverables (solutions, writeup, exploit code, video, etc.), and so on. You also may not share your deliverables with others, and you may not read others’ deliverables.

  That said, we allow discussion of projects with other students as long as no student in the discussion is actively interacting with the project systems. You should treat project-based discussions like going to TA hours—that is, focus on high-level hints, prodding questions, and occasional debugging help on narrowly scoped technical issues, but don’t give away full answers. Finally, when you talk to other students about projects, you must cite those students in your handin. See the Policy for more details.

• Homeworks: You’re permitted to (and encouraged to) discuss any aspect of the homework problems with other students currently in CS166. In this course, the homework problems generally will require you to approach problems from different angles and are designed to encourage discussion amongst students.

  However, you must write your homework solutions entirely independently. You may not share your solutions with anyone (or read solutions written by others). You should not write your solutions while working with other students, and when you’re writing your solutions, you should ensure that you independently understand and can reproduce your answers without referring to notes from collaboration sessions and consulting with other students. (Homework Clinics are not exempt from this policy.) Finally, when you talk to other students about homeworks, you must cite those students in your handin. See the Policy for more details.

Even if you’ve read the above summary, please read the remainder of the Collaboration Policy, since it covers more policies on referencing external sources, how to cite other students in your handins, etc. If you have any questions about the Policy, please ask on Piazza.