Course syllabus

Webbsäkerhet
Web Security

EITF05, 4 credits, G2 (First Cycle)

Valid for: 2014/15
Decided by: Education Board A
Date of Decision: 2014-04-07

General Information

Main field: Technology.
Compulsory for: C3
Elective for: BME4, D4-ks, E5
Language of instruction: The course will be given in Swedish

Aim

The course aims at giving the student knowledge about the security problems and solutions that relate to web based technology. Some areas will be addressed in more detail.

Learning outcomes

Knowledge and understanding
For a passing grade the student must

• Describe how web applications can be realized and how they interact with a web server.
• Describe the different security problems that arise when using web based protocols, applications and servers.
• Describe why the problems arise and how they can be avoided.

Competences and skills
For a passing grade the student must

• Be able to analyze the security problem and be able to propose solutions.
• Show that you understand the technical solutions that are used to avoid a security flaw.
• Show that you understand the security limitations in web based services.

Judgement and approach
For a passing grade the student must

During the course you have to be prepared to present and discuss your project.

Contents

Cryptology: Encryption, authentication and signing of messages

Web applications security: Security in PHP and MySQL, validation of user data with regular expressions, SQL-injections, cross site scripting, cross site request forgery, directory traversal, file inclusion, session attacks.

Server security: HTTP server, PHP and MySQL configuration.

Client Security: Javascript, cookie-security, same-origin policy, CORS.

Remote login: Basic and digest access authentication.

Email and Spam: Email security, spamming techniques, spam filters, email tracking, DKIM SPF, hashcash.

DNS Security: DNS configuration, Amplification attacks, DNS cache poisoning, DNS rebinding, DNSSEC

Examination details

Grading scale: TH
Assessment: Written exam. Approved project is required to pass the course.

Admission

Required prior knowledge: EIT060 Computer Security, EDA011 or EDA016 Programming, First course.
The number of participants is limited to: No

Reading list

• Lecture notes.

Contact and other information

Course coordinator: Dr. Martin Hell, martin.hell@eit.lth.se
Course homepage: http://www.eit.lth.se/course/eitf05
Further information: The course material will be in English.