\documentclass{article}
\usepackage{../style}


\begin{document}

\section*{Handout 1 (Security Engeneering)}

Much of the material and inspiration in this module is taken
from the works of Bruce Schneier, Ross Anderson and Alex
Halderman. According to them, a security engineer requires
a certain mindset. Bruce Schneier for example writes:

\begin{quote} 
\it ``Security engineers --- at least the good ones --- see
the world differently. They can't walk into a store without
noticing how they might shoplift. They can't use a computer
without wondering about the security vulnerabilities. They
can't vote without trying to figure out how to vote twice.
They just can't help it.''
\end{quote}

\begin{quote}
\it ``Security engineering\ldots requires you to think
differently. You need to figure out not how something works,
but how something can be made to not work. You have to imagine
an intelligent and malicious adversary inside your system
\ldots, constantly trying new ways to
subvert it. You have to consider all the ways your system can
fail, most of them having nothing to do with the design
itself. You have to look at everything backwards, upside down,
and sideways. You have to think like an alien.''
\end{quote}

\noindent In this module I like to teach you this mindset. To
defend a system, you need to have this mindset and think like
an attacker. This will include understanding techniques that
can be used to compromise security and privacy of others.

{\bf Warning!} However, don’t be evil! Using those techniques in the real
world may violate the law or the university’s rules, and it
may be unethical. Under some circumstances, even probing for
weaknesses may result in severe penalties, up to and including
expulsion, civil fines, and jail time. Acting lawfully and
ethically is your responsibility.



Don’t be evil!
- Ethics requires you to refrain from doing harm
- Always respect privacy and property rights
- Otherwise you will fail the course
- Federal and state laws criminalise computer intrusion and wiretapping
- e.g. Computer Fraud and Abuse Act (CFAA) 
- You can be sued or go to jail
- University policies prohibit tampering with campus systems
- You can be disciplined, even expelled
 
To defend a system, you need to be able to think like an
attacker, and that includes understanding techniques that can
be used to compromise security. However, using those
techniques in the real world may violate the law or the
university’s rules, and it may be unethical. Under some
circumstances, even probing for weaknesses may result in
severe penalties, up to and including expulsion, civil fines,
and jail time. Our policy in EECS 588 is that you must respect
the privacy and property rights of others at all times, or
else you will fail the course.

Acting lawfully and ethically is your responsibility.
Carefully read the Computer Fraud and Abuse Act (CFAA), a
federal statute that broadly criminalizes computer intrusion.
This is one of several laws that govern “hacking.” Understand
what the law prohibits — you don’t want to end up like this
guy. The EFF provides helpful advice on vulnerability
reporting and other legal matters. If in doubt, we can refer
you to an attorney.

 
 
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: