courses

CS 491/591: Introduction to Security

Location: FAB 47 (MW 15:30-17:10)

Instructor: D. Kevin McGrath

TA: Nikki Rudnick

Code Party:


Final Project

Course Description

This class provides an overview of computer security intended for a broad audience. Topics covered include basic security principles, access control, cryptography, authentication, network security, host security, application security, and privacy and anonymity with a focus on how they are embodied in actual systems.

Course objectives

  1. Explain the concepts of confidentiality, availability and integrity.
  2. Explain standard access control mechanisms (mandatory, discretionary, originator controlled) and how they can be used in conjunction with security models.
  3. Describe use of cryptographic algorithms in various secure protocols including digital signatures, hash functions, symmetric key, and public key cryptography.
  4. Explain various forms of authentication and identify social engineering attacks.
  5. Explain security issues in networks, hosts, and applications and how they can be addressed
  6. Identify privacy issues in computing systems and how they can be addressed

Policies

Grading Attendance and participation Academic Misconduct
Attendance      5%
Lab notebooks   65%
Final           30%
Attendance is required and will be taken each class. If you miss class, extra credit will be given back for outside communication that indicates you are keeping up with the material. You are expected to follow this code of conduct when communicating. * Includes allowing another student to copy your work unless specifically allowed by the instructor.
* Results in a grade of 0 for the assignment or exam.
* Results in the initiation of disciplinary action at the university level.

Schedule (SUBJECT TO CHANGE – CHECK REGULARLY)

Week Meetings (MW) Topic Labs Due (Fri, 23:59:59)
1 Sep 28, Sep 30 Introduction
Careers and Roles in Cybersecurity (CyberPDX)
Principles and Approaches (CIA, AAA, attacker mindset, attack surface, defense in depth)
Linux Basics (files, commands, command I/O, shell navigation)
Lab #1  
2 Oct 5, Oct 7 Linux basics (advanced files, regex and text processing, file utilities, network commands, processes)
Access Control and Authorization (reference monitor, ACLs vs capabilities, DAC/MAC/RBAC/ABAC, Bell–LaPadula/Biba)
Linux Access Control (permissions, setuid, sudo, ACLs)
Lab #2 Lab #1 — Oct 9
3 Oct 12, Oct 14 A history of cryptography: classical ciphers, frequency analysis, Enigma, Shannon
Applied cryptography: Encoding, Hash functions, Message Authentication Codes
Applied Cryptography: Symmetric encryption, block ciphers and modes
   
4 Oct 19, Oct 21 Applied Cryptography: Asymmetric (Public-Key) encryption, Digital signatures
Applied Cryptography: Certificates, PKI, and key management
Applied Cryptography: Key exchange protocols, Perfect Forward Secrecy, Future Secrecy, Signal protocol
  Lab #2 — Oct 23
5 Oct 26, Oct 28 Authentication: Password security, Multi-factor authentication, FIDO/Passkeys (Passwordless authentication)
Authentication: OAuth 2.0 and OIDC, Zero-trust and continuous authentication
Social engineering (Spam, Phishing, Business Email Compromise, Scams, Fraud)
Offline password and passphrase cracking
Lab #3  
6 Nov 2, Nov 4 Network security: Data-link layer (802.11, WPA2, ARP)
Network layer (IP, CIDR, Sniffing, Spoofing, Hijacking)
Traffic capture and analysis (tcpdump, Wireshark, tshark, Scapy)
Lab #4 Lab #3 — Nov 6
7 Nov 9 only
(Nov 11 — Veterans Day, university closed)
Network layer (DDoS, IPSec/VPNs, firewalls and filtering, network segmentation, network intelligence, ICMP)
Transport layer (TCP, TLS, certificate authorities and transparency, certificate revocation)
Application layer: DNS security (DNS, DNSSEC, DoH, DoT, Oblivious DNS), E-mail security (SMTP/IMAP/POP over TLS, DKIM, SPF, DMARC)
  Final project topic — Nov 13
8 Nov 16, Nov 18 Host Security: Host attacks (Initial access, Privilege escalation, Internal recon)
Host attacks (Lateral movement, Persistence, Impact)
Host defenses (IDS/IPS/EDR, signature detection, anomaly detection, blocklisting and allowlisting, Software signing, Virtualization and isolation techniques, File system backup and encryption)
Monitoring and response: SIEM/SOC, incident response
Lab #5 Lab #4 — Nov 20
9 Nov 23, Nov 25 Threat modeling and vulnerability management
Application security: OWASP Top 10, SAST/DAST, DevSecOps, containerization
Programming language and CPU security, Memory corruption, Return-oriented Programming, Canaries, ASLR, Control-Flow Integrity
   
10 Nov 30, Dec 2 Supply-chain security
Privacy and anonymity security
Course wrap-up and final project work
  Lab #5 — Dec 4
Finals Dec 7–11
no class meeting
No lecture; no office hours   Final Project — Dec 11

Finals week is 7–11 December 2026. We will not be meeting that week, and I will not be holding office hours. I will be available via email, but may not reply immediately, or even the same day.


Course Pages

Reference pages from across the course repo, organized by the schedule week where they are most relevant. General-purpose references that apply throughout the course are listed first.

General Reference

Page Description
Technical Writing Markdown and LaTeX for lab notebooks
SSH Tunnel for Windows RDP Applied example: Remote Desktop over a combined forward + reverse SSH tunnel
Kali Configuration Course Kali linux environment (can also be used on macOS)
PowerShell Profile PowerShell environment configuration

Weeks 1–2: Linux Basics and Access Control

Page Description
Security Principles and Approaches CIA triad and extensions, AAA, attacker mindset, attack surface and trust boundaries, risk management, defense in depth and the recurring design principles
Roles and Careers in Cybersecurity Red/blue/purple/yellow teams, NICE Framework, defensive/offensive/builder/GRC/specialized roles, mapping to PSU courses, certifications and getting started
Access Control and Authorization Reference monitor, access control matrix, ACLs vs capabilities, DAC/MAC/RBAC/ABAC/ORCON, Bell–LaPadula/Biba, least privilege, Linux worked examples
Navigation Basics Filesystem layout, ls, cd, pwd, mv, cp, mkdir, rm, and the FHS hierarchy
Editing Files Vim, Nano, and Emacs fundamentals
Shell and Other Basics PATH resolution, environment variables, I/O redirection, man, sudo
Working with Files Permissions, chmod, chown, archiving, rsync, hard links and symlinks
Process Management Background/foreground jobs, ps, signals, kill, nice
Unix Text Processing: grep, sed, and awk Stream editing, in-place replacement, validation, and pipeline patterns
Software Configuration Environment setup for the course VM
User Management Creating users and groups, chmod/chown, ACLs, sudo configuration, setuid
SSH: Secure Shell Key generation/use, ~/.ssh/config (patterns, %h/%n placeholders, Match, ProxyJump), forward/reverse/dynamic tunnels, authorized_keys forced commands, option precedence
Git Git fundamentals — branching, merging, rebasing, GitLab workflow
zsh: The Z Shell Shell theory and startup files, globbing/qualifiers, completion, history, prompt and plugins (oh-my-zsh/powerlevel10k), bash differences
tmux: The Terminal Multiplexer Client-server model, sessions/windows/panes, persistence over SSH, copy mode, ~/.tmux.conf, tpm/tmuxinator

Weeks 3–4: Cryptography

Page Description
A History of Cryptography From Caesar and al-Kindī’s frequency analysis through Vigenère, Enigma, Shannon’s perfect secrecy, DES/AES, and the public-key revolution — with a 20th-century timeline of how long each cipher stayed ahead of brute force
Cryptography Symmetric, asymmetric, hashing, HMAC, digital signatures, key exchange, certificates, TLS, PKI, forward secrecy, certificate transparency, key management

Week 5: Authentication, Social Engineering, and Credential Attacks

Page Description
Identity and Access Management Password security, MFA, TOTP, OAuth 2.0, OIDC, RBAC, FIDO2/passkeys, zero-trust, continuous authentication, workload identity
Social Engineering Cialdini’s persuasion principles, phishing/spear/whaling, vishing/smishing/quishing, pretexting, baiting, BEC, dissecting phishing email headers (SPF/DKIM/DMARC), phishing-resistant defenses
Cracking WiFi 802.11 capture, WPA2 handshake cracking with aircrack-ng
Hash Cracking with Hashcat and John Offline cracking, hash identification, wordlists, mangling rules, mask/hybrid/combinator attacks, PRINCE and the Purple Rain expansion, John’s *2john converters and unshadow

Weeks 6–7: Network Security

Page Description
Introduction to Networking TCP/IP stack, subnetting, ARP, DHCP, routing, DNS, HTTP, TLS, email protocols
Network Security Segmentation, nftables, VLANs, WAF, DNSSEC, DDoS mitigation
VPNs and IPSec Remote-access vs site-to-site, full vs split tunnel, IPSec (AH/ESP, transport/tunnel mode, IKEv2/PFS), OpenVPN, WireGuard, TunnelVision and DNS-leak limitations
DNS Security and Privacy Cache poisoning, DNSSEC (integrity), encrypted transports DoT/DoH/DoQ (confidentiality), Oblivious DoH, kdig worked examples
Email Security SMTP/IMAP/POP and TLS ports, STARTTLS vs implicit TLS, MTA-STS/DANE, SPF/DKIM/DMARC and alignment, ARC/BIMI, S/MIME and PGP, auditing a domain with dig
Defensive Measures Firewalls, packet filtering, IDS/IPS overview
Network Traffic Capture Capture points, strategies, span ports, physical taps
Capturing Packets with tcpdump tcpdump filters, ring-buffer capture, reading pcap files
Wireshark Display filters, stream following, statistics, TLS decryption
tshark tshark field extraction, display filters, scripting
Pcap Analysis and Manipulation Tools tcpflow, ngrep, tcpreplay, Zeek, argus, editcap
Network Flow Analysis: NetFlow, Zeek, and Argus NetFlow/IPFIX, nfdump, Zeek log analysis and scripting, Argus flow capture
Scapy Packet crafting, ARP spoofing, custom protocol building
Windows Packet Capture pktmon, Wireshark, tshark, netsh trace on Windows
Introduction to Recon Network reconnaissance and nmap
IPv6 RH0 Attack Ripple20 routing header vulnerability — worked network attack example

Week 8: Host Security, Monitoring, and Incident Response

Page Description
MITRE ATT&CK Framework Attack tactics, techniques, and procedures (TTPs) reference
Host Security and the Attack Lifecycle Initial access, privilege escalation, persistence, lateral movement, exfiltration; SUID/sudo/cron enumeration; host defenses — HIDS/EDR, signatures vs anomaly, allowlisting, code signing, auditd, backups
Suricata IDS/IPS Installation, IDS and IPS modes, rule writing, Lua detection, EVE log analysis
SIEM and SOC SIEM concepts, Elastic Security, Wazuh, Falco, auditd, SOAR
Incident Response NIST IR lifecycle, volatile evidence, digital forensics, root cause analysis

Week 9: Threat Modeling, Application Security, and Memory Corruption

Page Description
Threat Modeling STRIDE, PASTA, attack trees, Data Flow Diagrams, pytm
Vulnerability Management Scanning, CVEs, CVSS scoring, patch management
Application Security OWASP Top 10, SQL injection, XSS, SAST/DAST, SCA, secrets detection
DevSecOps Fundamentals Shift-left security, CIA triad, zero-trust, defense in depth, minimal CI/CD pipeline
Containerization cgroups, namespaces, OCI runtimes, Docker, container security
Memory Corruption and Exploit Mitigations Stack buffer overflows, ROP, stack canaries, NX/DEP, ASLR/PIE, CFI and shadow stacks, checksec, memory-safe languages
Network-Based Fuzzing boofuzz, protocol fuzzing, crash analysis with pwndbg

Week 10: Supply Chain and Privacy

Page Description
Software Supply-Chain Security Dependency confusion, typosquatting, SolarWinds and XZ Utils (CVE-2024-3094), SBOMs (SPDX/CycloneDX), Sigstore/cosign, SLSA, syft/grype worked example
Privacy Law: Beyond the Fourth Amendment Privacy law, cyber-crimes, anonymity, legal frameworks

Assignments

Labs and notebook

Lab assignments will be given each class covering the course material. You will perform each one, while maintaining a lab notebook in markdown that documents your progress via screenshots with your OdinID in them. The notebook should also include answers to any questions in the labs. Notebooks should be done in Markdown in their respective folders. Submission will be done via adding, committing and pushing the files to your private CECS GitLab repository.

Please add myself (dmcgrath) as a collaborator to your private repo. You can do this by going to the settings page for your repo, clicking on the “Manage access” tab, and then clicking on the “Invite a collaborator” button. You will need to add both myself and your TA as collaborators.

Always turn in what you have done on-time. Late work throughout the quarter may be compiled into a single submission that will be graded at the end of the last week of class in a file named notebooks/LateLabs.pdf. The notebook will be graded based upon the following rubric:

Academic or Student Support Services

Accommodations

Accommodations for students with disabilities are determined and approved by Disability Resource Center (DRC). If you, as a student, believe you are eligible for accommodations but have not obtained approval please contact DRC immediately at 503-725-4150, drc@pdx.edu, or https://www.pdx.edu/disability-resource-center. DRC notifies students and faculty members of approved academic accommodations and coordinates implementation of those accommodations. This course has no in-person, timed exams — the final is a recorded presentation — so testing-center scheduling does not apply. If any accommodation affects how you complete the labs or the final recording, contact me early in the term so we can arrange it.

I want to make this class an open and welcoming environment for all. Your success is my goal.

Religious Observance

Portland State University strives to respect all religious practices. If you have religious holidays that conflict with any of the requirements of this class, please see me immediately so that we can make alternative arrangements.

Reach Out for Success

The PSU Center for Student Health and Counseling (SHAC) is staffed with folks who care and can help with a wide range of personal challenges. Here at PSU, there is never a need to tough things out alone.

As a student you may experience a range of issues that can cause barriers to learning, such as strained relationships, increased anxiety, alcohol/drug problems, feeling down, difficulty concentrating and/or lack of motivation. These mental health concerns or stressful events may lead to diminished academic performance or reduce a student’s ability to participate in daily activities. PSU is committed to advancing the mental health and well-being of its students. If you or someone you know is feeling overwhelmed, depressed, and/or in need of support, services are available. You can learn more about the broad range of confidential mental health services available on campus via SHAC https://www.pdx.edu/health-counseling/.

SHAC also has resources for physical health, including flu shots. You can check out their COVID-19 resources page here: https://www.pdx.edu/health-counseling/covid-19-resources (including testing).

Get Food Now Here at PSU, there is never a need to tough things out alone. Those who can, give, so those who need, have.

Housing / financial crisis help. Here at PSU, there is never a need to tough things out alone. Emergency Housing, etc.

Title IX

As an instructor, students frequently come to me for assistance in matters that are not related to the course material. Please be aware that PSU’s policies require instructors to report any instance of sexual harassment, sexual and relationship violence and/or other forms of prohibited discrimination to University Officials, who keep the information private. If you would rather share information about these experiences with a PSU staff member who does not have these reporting responsibilities and can keep the information confidential, please contact one of the following campus resources.

PSU Sexual Misconduct Response website gives you comprehensive information about how to support and/or report an incident.

Please complete the required student module Understanding Sexual Misconduct and Resources in Canvas, which provides information about PSU policy and resources.

You may also report sexual and relationship violence to law enforcement on campus with Campus Public Safety Office (CPSO).

Or you may file an anonymous report with Campus Public Safety Office or a Bias Incident report with the Bias Review Team (BRT). PSU does not typically investigate the reports that are made through these two avenues. These reports help PSU understand what students and employees are experiencing on and around campus and provide support where needed.

Previous Offerings