Department of Computing

Local Navigation

• Comp Home

Unit Outline: ITEC851

Semester 2, 2008

Convenor: Milton Baar

Prerequisites: It is strongly recommended that prospective students have an understanding of operating systems internals and information risk management.

About This Unit

This course will look in detail at the following commercial operating systems: Microsoft Windows 2000, Microsoft Windows 2003, Microsoft Windows 2008, HP/UX 11i, Solaris 10, Red Hat Linux, IBM z/OS, IBM i5/OS and HP OpenVMS and explore how secure they are in a commercial environment.  This course will include hands-on tutorials on most of the operating systems and will also include threat and vulnerability analysis of common configurations.  As operating systems provide the environment upon which all application processing is based, knowing their strengths and weaknesses will help in understanding how to make commercial environments more secure.

The course will have a high practical component, with the ability to experience the operating systems characteristics and weaknesses.  Lab work will be undertaken for 10 weeks of the course.  Depending upon class size and makeup, site visits to a Protected and a Highly Protected site will be arranged.

This unit is related to ITEC854 Information Security Management and ITEC856 Operating Systems Programming.  ITEC854 provides detailed content on Information Security Management and gives the student more insight and practical skills into managing information risks.  ITEC856 provides deeper technical skills in Linux programming at the kernel level.

Teaching Staff

Role	Name	Email	Room	Office hours
Convenor, Lecturer	Milton Baar	mbaar@ics.mq.edu.au

All emails related to ITEC851 should be sent to itec851-admin@ics.mq.edu.au and must include your full name and your student id number.

Classes

Each week you should attend 2 hours of lectures and a two hour tutorial/practical. For details of days, times and rooms consult the timetables webpage.

Note that Tutorials commence in week 2 .

If you do not have a class, or if you wish to change one, you should see the enrolment operators in the E7B courtyard during the first two weeks of the semester. Thereafter you should go to the Student Centre.

Please note that you will be required to attend most of the tutorials and hand in prepared work as required. Failure to do so may result in you failing the unit or being excluded from the exam.

Required and Recommended Texts

Supplied through Blackboard

• Operating Systems Handbook (or, Fake Your Way Through Minis and Mainframes), Bob DuCharme, McGraw-Hill (supplied free by the author to students and provided in PDF format)

• ISO27001, AS/NZS4360 and other ISO standards.

Optional reading

• Hacking Exposed, 5^th Edition, McClure, Scambray & Kurth, published by Osborne

• Operating Systems Concepts, 7^th Edition, Silberschatz, Galvin & Gagne, Wiley.

Unit Web Page

The web page for this unit can be found at http://online.mq.edu.au/pub/ITEC851. Note that the majority of the unit materials are publicly available while some material requires you to log in to Blackboard to access it.

The unit will make use of discussion boards hosted within Blackboard. Please post questions there, they will be monitored by the staff on the unit.

Learning Outcomes

A student completing the unit should have:

1. An introductory understanding of commercial risk related to information security, how to measure it and tools and techniques used in its mitigation;
2. An understanding of how different commercial operating systems are designed and their inherent flaws and strengths;
3. Some hands-on skills in vulnerability testing and analysis of commercial operating systems; and
4. Quantitative analysis skills to enable the creation of an application-to-operating system risk evaluation matrix.

In addition to the discipline-based learning objectives, all academic programs at Macquarie seek to develop students' generic skills in a range of areas. One of the aims of this unit is that students develop their skills in the following:

• Critical analysis skills;
• Problem-solving skills; and
• Creative thinking skills.

Teaching and Learning Strategy

ITEC851 is taught via lectures, tutorials and practical sessions in the laboratory. Lectures are used to introduce new material, give examples of information security risk and operating system security characteristics and techniques and put them in a wider context. While lectures are largely one to many presentations, you are encouraged to ask questions of the lecturer to clarify anything you might not be sure of. Tutorials give you the opportunity to interact with your peers and with a tutor who has a sound knowledge of the subject. You will be given problems to solve each week prior to the tutorial; preparing solutions is important because it will allow you to discuss the problems effectively with your tutor and maximise the feedback you get on your work.

Each week you should:

• Attend lectures, take notes, ask questions.
• Attend your tutorial, seek feedback from your tutor on your work.
• Read appropriate sections of the text, add to your notes and prepare questions for your lecturer or tutor.
• Prepare answers to next week's tutorial questions.
• Work on any assignments that have been released.

Lecture notes will be made available each week but these notes are intended as an outline of the lecture only and are not a substitute for your own notes or the textbook.

Topic List

 

Relationship Between Assessment and Learning Outcomes

1. Improved problem solving skills and enhanced ability to think algorithmically: all assessment tasks involve problems solving and analysis and many of the problems involve algorithmic solutions.
2. An understanding of the importance of documentation, testing, and security of operating systems: these aspects are taken into account in the marking of the assignments.
3. An understanding of the basics of computer architecture, including security structures and program execution: Computer architecture will feature in quizzes and in the final exam
4. An understanding of information risk as understood by commercial organisations: your understanding of information security risk will feature in assessments and the final exam.

Task	Planned Date	Total Marks
In-class Quizzes (3)	Weeks  4, 10, 13	30%
Assignment 1:	Due Week 6	15%
Assignment 2:	Due Week 11	15%
Final Examination	TBA	40%

 

Your final grade will depend on your performance in each part separately. In particular:

• You must perform satisfactorily in the examination in order to pass this unit.
• You must submit a reasonable attempt to both assignments to pass this unit.
• You must submit a reasonable attempt to all quizzes to pass this unit.

All assignments should be handed in via the online Blackboard system at http://online.mq.edu.au/ by the time specified in the assignment description. Tutorial questions should be submitted via Blackboard before 9am on the Monday of each week.

All work submitted should be readable and well presented.

Late work will be accepted with a penalty of 10% of the marks for the assignment per day submitted late. Hence, an assignment submitted five days late will get at most half the marks. If you cannot submit on time because of illness or other circumstances, please contact the lecturer before the due date.

Examinations

The university examination period in Second Half year 2008 is from November 24th to December 5th.

You are expected to present yourself for examination at the time and place designated in the University Examination Timetable. The timetable will be available in Draft form approximately eight weeks before the commencement of the examinations and in Final form approximately four weeks before the commencement of examinations.

You are advised that it is Macquarie University policy not to set early examinations for individuals or groups of students. All students are expected to ensure that they are available until the end of the teaching semester, that is the final day of the official examination period.

The only exception to not sitting an examination at the designated time is because of documented illness or unavoidable disruption. In these circumstances you may wish to consider applying for Special Consideration. Information about unavoidable disruption and the special consideration process is available on the web (PDF).

If a Supplementary Examination is granted as a result of the Special Consideration process the examination will be scheduled after the conclusion of the official examination period. For details of the Special Consideration policy specific to the Department of Computing, see the Department's policy page.

Plagiarism

Please refer to the Department of Computing Plagiarism Policy for the definition of plagiarism, advice on avoiding it and the penalties in place if you are found to have submitted plagiarised work.

University Policy on Grading

Academic Senate has a set of guidelines on the distribution of grades across the range from fail to high distinction. Your final result will include one of these grades plus a standardised numerical grade (SNG).

On occasion your raw mark for a unit (i.e., the total of your marks for each assessment item) may not be the same as the SNG which you receive. Under the Senate guidelines, results may be scaled to ensure that there is a degree of comparability across the university, so that units with the same past performances of their students should achieve similar results.

It is important that you realise that the policy does not require that a minimum number of students are to be failed in any unit. In fact it does something like the opposite, in requiring examiners to explain their actions if more than 20% of students fail in a unit.

Student Support Services

Macquarie University provides a range of Academic Student Support Services. Details of these services can accessed at http://www.student.mq.edu.au.

Staff-Student Liaison Committee

The Department has established a Staff-Student Liaison Committee at each level to provide all students studying a Computing unit the opportunity to discuss related issues or problems with both students and staff.

For each meeting, an agenda is issued and minutes are taken. These are posted on the web at:

• http://www.comp.mq.edu.au/units/800-liaison

Details of the regular meeting dates will be posted on the unit home page. Anyone with an interest in Computing units may attend. This includes staff involved in the teaching and administration of the units, and all students currently taking a Computing unit at that level. There are formal Liaison Committee representatives for each unit who attend to present the views of the student body; all students are welcome and are encouraged to attend.

The meetings are usually held in the Department of Computing Meeting Room, E6A357.

To forward agenda items or get in touch with your representative, send an email to itec851liaison@ics.mq.edu.au.

If you have exhausted all other avenues, then you should consult the Director of Teaching (Dr Steve Cassidy) or the Head of Department (Assoc. Prof. Tony Sloane). You are entitled to have your concerns raised, discussed and resolved.