A Course in Computer Systems Security

Vinod Ganapathy, IISc Bangalore

---

The unpleasant memories of the Covid lockdown days are hopefully well behind us now. The one silver lining from those days was that when I offered my course on computer systems security, I chose to record those lectures and upload them on to Youtube. This series of lectures is from that August-December 2020 offering of the course.

This lecture series is not supposed to be a comprehensive overview of computer systems security (far from it!), but covers a few popular topics based on my own taste in computer security. The course does not require any prerequisites except for a basic undergraduate-level exposure to standard computer science topics, such as operating systems, systems programming, computer architecture, and a few others. You should be able to pick up this background (should you lack it) from standard textbooks, or various sources on the Internet.

• Topic
•  
• References
•  
• Lecture

• Course Overview
•  
• -
•  
• Lecture-1

• Stack smashing attacks, malware
•  
• [1]
•  
• Lecture-2
  Lecture-3
  Lecture-4

• Code-reuse attacks
•  
• [2]
•  
• Lecture-5

• Memory-bounds Checking
•  
• [3]
•  
• Lecture-6

• Control-flow Integrity
•  
• [4]
•  
• Lecture-7
  Lecture-8

• Taint Analysis
•  
• [5]
•  
• Lecture-9

• Intel MPK
•  
• [6]
•  
• Lecture-10

• Virtualization and applications
•  
• [7]
•  
• Lecture-11

• Privilege Separation
•  
• [9]
•  
• Lecture-12

• Authentication and Protocols
•  
• [10]
•  
• Lecture-13
  Lecture-14
  Lecture-15

• Capabilities and Access Control
•  
• [11]
•  
• Lecture-16

• Web Apps: SOP, CSP, Cookies, XSS, XSRF, SQL Injection
•  
• [12]
•  
• Lecture-17
  Lecture-18

• Defenses for Web-based Attacks
•  
• [13, 14]
•  
• Lecture-19

• Trusted Computing
•  
• [15]
•  
• Lecture-20

• Intel SGX
•  
• [16]
•  
• Lecture-21

• Containers
•  
• [17]
•  
• Lecture-22
  Lecture-23

• Side-channel attacks
•  
• [18]
•  
• Lecture-24

• ARM TrustZone
•  
• [19]
•  
• Lecture-25

• Mobile App Security
•  
• [20]
•  
• Lecture-26

•  
•  
•  
•  
•  

The course is best learned if you have a virtual machine on hand, and are able to try some of the material that is taught in the course hands-on. Many of the code examples referenced in the lectures are pre-loaded onto this virtual machine (download and tar -xzvf class_vm.tar.gz). You can get the virtual machine running using Oracle VM VirtualBox (version 6.1.16), and try out the code examples and the demos shown in the video lectures. The password of the root user on this virtual machine is the same as the login name.

The course draws upon various sources as reference material, and does not follow any prescribed textbook. However, if you prefer a texbook to learn some basic material, the book on Security Engineering by Ross Anderson is a decent reference. Older editions of the book are available for free download from the author's webpage.

---