Security Architecture and Engineering

Notes from Columbia University class "COMS 4187: Security Architecture and Engineering"

Read it on Gitbook.

What this course is about?

Security Primitives

• What are the basic mechanisms you can use to secure a system?
• What are the properties of these mechanisms?
• What is the assurance associated with them?

Security Architecture

• How to put the pieces together?
• How to spot the risky parts?
• How to evaluate an architecture?

Security Engineering

• Putting the pieces together
• Tradeoffs
• Balancing cost, security, usability, acceptability..

How to Think About Security

• Security is a property of the overall design
• You do not get security by sprinkling on crypto or by forcing people to change their passwords frequently
• Those can sometimes help—but bad guys go around strong security, not through it
• Security is a systems property

How to Think About Insecurity

• The bad guys don’t follow the rules
• To understand how to secure a system, you have to understand what sort of attacks are possible
• Note that that is not the same as actually launching them.