CompSci 702 Security for Smart Devices

1. CompSci 702 Security for Smart Devices http://www.cs.auckland.ac.nz/courses/compsci702s1c/

2. Applied Smart-Device Security • Considerations • Is it secure? • How do you know? • What are the dangers of using this smart-device? • Imagine some scenarios and apply sound security technology principles My goal here is to promote security fundamentals, not firearms.

3. Welcome! • From the 702 Team • Andrew Colarik • a.colarik@auckland.ac.nz • Robert Sheehan • r.sheehan@auckland.ac.nz

4. Course Structure • Security by Design (AC: 1 Week) • Overview of access control models (AC: 1 week) • DAC, MAC, RBAC, UCON • Policy-based • Android (AC: 5 weeks) • Overview • Android security model and pitfalls • Android malware characterisation and study of most common samples • A concrete approach to fight malware • iOS overview and its security model (RS: 2 weeks) • Seminars (YOU: 3 weeks)

5. Team Project • Goals • Research mobile technologies • Design a simple everyday process • Apply security concepts into the design • Build a proof of concept / artefact for consideration • Perform an analysis of what was built, what could have been built, and is missing to secure the process • Completed in phases throughout the semester • Each phase builds on the previous

6. Research Report • You select one or more papers to read from a provided list • More details on how later • Each of you will prepare a research report of 4 pages on the paper • Be sure to identify what is most critical • Don’t just re-iterate the paper but provide depth of understanding on what it is communicating • The content of the report must be YOURS • No copy-and-past from the main article • Use your own words to describe the article • Take a look at its references for additional understanding and content • 50/50 approach • 2 pages for description • 2 pages for analysis/criticism • Needs a proper cover page

7. Research Report Continued • How to Analyse/Criticise • Does the paper live up to your expectations? • Think about what you were expecting from this paper by reading the Abstract/Title/Intro • Does this article help you with your security requirements? • If you were the user of this system, would it work for you? • Why? • Why not? • What could the authors have done differently? • What is the real value of this article?

8. Seminar • You select one or more papers to read from a provided list • More details on how later • Each of you will give a 15 minute presentation on it • Be sure to identify what is most critical • Don’t just re-iterate the paper but provide depth of understanding on what it is communicating

9. Course Books • Access control chapter in any security books • Mark Stamp, Information Security: Principles and Practice, Wiley 2011 • Matt Bishop, Computer Security: Art and Science, Addison-Wesley 2003 • The library is your friend • The rest of the course will be based on research papers and information available from the library and the Internet

10. Grades • 15% Seminar • 15% Research Report • 20% Team Project • 5% Phase 1 • 5% Phase 2 • 10% Phase 3 • 50% Final Exam • Lectures • Readings • Seminars • Team Project Concepts

11. Questions?