Instructors Trent Jaeger (tjaeger 'at' cse.psu.edu)
Joshua Schiffman (jschiffm 'at' cse.psu.edu)
Location 223B IST Building
Meeting Times M 5:00pm-8:00pm
Credits 3
Office Hours by appointment


In this course, we will survey recent research in computer and operating systems (host) security. The course aims to provide a view of new and ongoing research in systems security through presentation and discussion of recently published security papers from major systems and security conferences.

Topics will include protection systems, trusted computing, virtual machine systems, cloud computing, mandatory access control, security kernels, decentralized information flow, and distributed systems security. Students will also be expected to present several in-class updates on a new or ongoing system security research project. This will give students a chance to vet each other's ideas and eventually lead to a draft ready for submission to a conference.

A detailed list of lecture by lecture contents, assignments, and due dates (subject to change as semester evolves) is available on the course calendar.


The course will be graded on paper presentations, project presentations, paper review writeups, and class participation in the following proportions:

60% Paper Presentations (3-4)
10% Paper Reviews
20% Project Presentations
10% Class Participation

Paper Presentations

Each student will be responsible for preparing several (3-4) 30 minute presentations for their assigned papers. The presentations should cover the major ideas from the paper and any additional material that the student finds relevant to the work. This includes prior papers that led to the current paper, background information on the topic area, or response papers. The student should also lead the class in discussing the paper's merits and any criticisms they have.

Paper Reviews

Each student is expected to write a two paragraph essay for each paper. These essays are due the day before class (Sunday). The first paragraph should summarize the paper by identifying the topic, problem, related work, solution, and major contributions. The second paragraph should detail a specific criticism (or expand on the contribution if none comes to mind) that can be brought up during the in-class discussion. These reviews will help the students to reinforce their knowledge of the paper and foster a more robust discussion.

Project Presentations

Students are required to give two in-class presentations on a new or ongoing research project in the area of systems security. These 15 minute presentation will enable the class to provide feedback as well as educate the class. For students without a project, the student can choose a topic relevant to system security and give a coherent presentation that teaches the class about that topic. For example, a student familiar with network security could choose a topic relevant to distributed system security like BFT. If the student is unsure, please contact the instructor for clarification and approval.

Class Participation

Class participation focuses on the readings assigned for the class. We will discuss the readings, and students are required to participate in discussions during each lecture. It is strongly suggested that students do the reading prior to this class. Ultimately, the students' ability to exhibit comprehension of readings is essential to a good grade.

Lateness Policy

Students are expected to give presentations on the day they are due. Late paper-reviews will be assessed a 20% penalty per day. Unless the problem is apocalyptic, don't give me excuses. Students with legitimate reasons who contact the professor before the deadline may apply for an extension.

Required Texts

Course readings will come entirely from research papers presented within the last few months at major security and systems conferences. The specific papers will be posted on the course calendar.

Academic Integrity Policy

Students are required to follow the university guidelines on academic conduct at all times. Students failing to meet these standards will automatically receive a 'F' grade for the course. The instructor carefully monitors for instances of offenses such as plagiarism and illegal collaboration, so it is very important that students use their best possible judgement in meeting this policy. The instructor will not entertain any discussion on the discovery of an offense, and will assign the 'F' grade and refer the student to the appropriate University bodies for possible further action.

Note that students are explicitly forbidden to copy anything off the Internet (e.g., source code, text) for the purposes of completing an assignment or the final project. Also, students are forbidden from discussing or collaborating on any assignment except were explicitly allowed in writing by the instructor.

Ethics Statement

This course considers topics involving personal and public privacy and security. As part of this investigation we will cover technologies whose abuse may infringe on the rights of others. As an instructor, I rely on the ethical use of these technologies. Unethical use may include circumvention of existing security or privacy measurements for any purpose, or the dissemination, promotion, or exploitation of vulnerabilities of these services. Exceptions to these guidelines may occur in the process of reporting vulnerabilities through public and authoritative channels. Any activity outside the letter or spirit of these guidelines will be reported to the proper authorities and may result in dismissal from the class.

When in doubt, please contact the instructor for advice. Do not undertake any action which could be perceived as technology misuse anywhere and/or under any circumstances unless you have received explicit permission from Professor Jaeger.