Syllabus #
Co-requisites #
Formal: CSC326.
Informal: You need to have a basic understanding of programming/the use of programming languages to build software systems. They should also be able to pick up a new programming language (e.g., Python) with relative ease. You need to understand the software engineering process, including requirements, agile software development, and use cases. If you do not have a basic understanding of these areas, you will have difficulty with the course. If you have questions regarding these prerequisites, please contact the instructor.
Technology Requirements #
Laptops (or a mobile device with internet access) are required in class to complete in-class lab activities. NC State’s Online and Distance Education provides technology requirements and recommendations for computer hardware.
Software that will be used in the class exercises includes the following which will all be installed locally:
- SonarQube
- ZAP
Required Materials #
There are no required books to purchase for this class.
Recommended Materials #
We will use online resources as noted in the syllabus. You may find the following online resources helpful as well:
- Security Engineering, Ross Anderson
- Computer Security and the Internet: Tools and Jewels, Paul C. van Oorschot
- Software Security: Principles, Policies, and Protection, Payer
- The library has print and online copies of ‘The Web Application Hacker’s Handbook’. We recommend checking it out (first come, first served), or finding a copy of your own. The book presents a principled approach to discovering web application vulnerabilities, and a lot of detail on how to do so, things that will help you succeed at the project assignments.
- While the book is old, ‘The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities’, Dowd, McDonald and Schuh is the bible of conducting security audits. The book is available in print from the library. If you were going to build a library of security books, you should consider this one.
Course Details #
A detailed list of lecture-by-lecture contents, assignments, and due dates (subject to change as the semester evolves) is available on the course schedule.
The semester’s submission lockers will be within the Gradescope system. No submissions will be accepted through email or message board posts!
Classroom attendance and activities will be managed through TopHat.
Course Assignments #
Count on last-minute system failures, power outages, laptop issues, internet connectivity issues, etc. Make sure you back up your work so you can at least receive partial credit. A broken computer, power outage, etc. are not acceptable excuses for requesting extensions on assignment deadlines!
Do not wait until the last minute!
You must inform your instructor as soon as possible of anything that may prevent you from completing coursework and exams as well as any other concerns that you may have.
Workshops #
Description: During the “Common Vulnerabilities & Software Weaknesses” unit of the course, students will complete workshop assignments to practice exploiting vulnerabilities in software.
Collaboration Policy: Workshop assignments will be completed in pairs (though one group of 3 may happen each workshop). You will have the ability to express your preferences on teammates. The makeup of the teams will change every few weeks.
Late Submission Policy: Late workshop assignments will not be accepted without a documented excused absence.
Workshops are organized by topics – some workshops require less effort than others. Please plan ahead and use your time wisely. Do NOT wait until the last minute to complete workshops!!!
Project #
Description: You will complete a thorough security review of an open-source software system based on the topics and tools presented and discussed throughout the course.
Collaboration Policy: Projects must be completed in small teams of 3-4 students. You will have the opportunity to request your teams. Students who do not request teams will be assigned to random teams.
Late Submission Policy: Project materials will not be accepted late without a documented excused absence. All team members will be held responsible if a submission is not submitted on time or if academic misconduct is observed.
Grading Information #
A weighted grade average will be calculated as follows:
- 40% (20% each) – Midterm Exams (2)
- 10% – Final Exam
- 30% (10% each) – Projects
- 16% – Workshops (#1-8)
- 4% – Attendance/participation
Excused absences are defined in the NC State Academic Policy on Attendance Regulations. Documentation of the absence is required to excuse an absence. DO NOT SCHEDULE AN INTERVIEW ON THE MIDTERM DATES OR FINAL EXAM DATES! (You cannot get an excused absence for an interview on an exam date.)
Grade Scale #
| Grade | Percentage (including) |
|---|---|
| A+ | 97 - 100 |
| A | 93 - 96 |
| A- | 90 - 92 |
| B+ | 87 - 89 |
| B | 83 - 86 |
| B- | 80 - 82 |
| C+ | 77 - 79 |
| C | 73 - 76 |
| C- | 70 - 72 |
| D+ | 67 - 69 |
| D | 63 - 66 |
| D- | 60 - 62 |
| F | Below 60 |
If you are happy with your midterm averages, your two midterms can count for 25% each and you do not have to take the final exam.
To pass CSC415, you must have a weighted average of 60% or higher on the following individual components: Midterm #1, Midterm #2, Final Exam.
Students are expected to conduct themselves in a respectful and professional manner at all times. Grades will be adjusted if students do not conduct themselves in a respectful and professional manner toward all members of the teaching staff and others in the class, including via email, message board posts, in-person communication, and peer evaluations. Any threatening language or behaviors will be reported to the appropriate authorities.
Attendance #
Please contact the teaching staff to obtain an excused absence only in the case that you had adequate documentation, such as a doctor’s note or an interview invitation. All anticipated absences must be presented to the instructor no later than one week before the absence. All emergency absences must be submitted no later than 1 week after the student’s return date.
You are allowed to miss up to 4 lectures throughout the semester without penalty. Please do NOT contact the teaching staff if you feel sick but not sick enough to see a doctor, or have something else going on in your life that prevents you from coming to class.
Regrading #
- Should you discover what you think is an error in grading, you must submit a request for regrade via Gradescope.
- You have only ONE WEEK after the grades are returned to you to request a re-grade. After that point, you cannot appeal your grade.
- Communicate with the TA (who did the grading) and see if you can get it resolved. If you are still unsatisfied, contact Dr. Williams.
Class Communications and Course Evaluations #
The class will use Piazza for communication.
You can email Dr. Williams at laurie_williams@csc.ncsu.edu. When emailing, use “[CSC415]” in the subject.
Online class evaluations will be available for students to complete during the last two weeks of class. Students will receive an email message directing them to a website where they can log in using their Unity ID and complete evaluations. All evaluations are confidential; instructors will never know how any one student responded to any question, and students will never know the ratings for any particular instructors.
- Evaluation website: https://classeval.ncsu.edu
- Student help desk: classeval@ncsu.edu (for evaluations)
- More information about ClassEval: http://www2.acs.ncsu.edu/UPA/classeval/index.htm