CSE-60770 (40770) Secure Software Engineering

This class includes the following graded components:

• Case Study: An in-depth investigation of security challenges experienced by a real software product. While in class you will be learning about security tactics, common weaknesses, and secure coding practices, in the case study you will see investigate how those concepts are applied (or not at all). The outcome is a technical report (2-3 pages).
• Seminar Presentation: Every student will select (or be assigned) one paper on a course-related topic. The student is to gain a detailed understand of the paper, and present it to the class. The student should highlight the motivation of the work, its novel contributions, any surprising findings and possible applications of the work. This also includes a critique which contains at least three strengths of the paper and at least three weaknesses of the paper.
• Course Project: A a group project where the students would be working throughout the semester. You are expected to work on the course project in pairs (or in rare occasions groups of three students). Each group is expected to write a research paper by the end of the quarter. The topic is to be negotiated with the instructor. Examples include: building a tool to support secure software engineering practices, or a survey paper of a software security related topic (typically involves surveying several research papers), or empirical studies, etc. The final report (10 pages in length) should be submitted by the end of the semester. All project-related documents (i.e., project proposal and project report) should use the IEEE conference publication format. If the paper is deemed publishable, the instructor will work with the student to make appropriate changes to the final report and submit the paper for publication.
• Homeworks: Each lecture cover a different practice or tool. The homeworks are intended for the student to apply the studied concepts in class. Most of these homeworks are individual.
• Attendance & In-Class Participation: Classes may include short hands-on activities/exercises that are submitted during class. These may be used as points towards attendance.

Your final course grade is computed according to the following breakdown:

Grades are assigned as follows:

Deadlines are strictly enforced. There is a penalty of 10% for submissions up to 24hrs past the deadline. Submissions made more than 24hrs past the deadline are not accepted (i.e., they will be assigned 0). Late submissions are accepted if (a) the student make prior arrangments with the instructor, or (b) the student has a university-approved reason (and notified the instructor in advance). In case of justifiable exceptional circunstances, please communicate with the instructor as soon as possible (and prior the deadline if humanly feasible) to make arrangements.

HOWEVER...
Life Happens. We all lead densely-layered lives; therefore, one of my core values is leading with grace. As a result, I institute a "Life Clause": should you need it, you may invoke the “Life Clause” on ONE assignments, and get 3-day extension: no explanation required. To invoke a life clause, please send an e-mail to the instructor.

To maintain fairness, the instructor does not grant extensions on a case-by-case basis (i.e., the rules laid out in here applies to all students -- without exceptions).

It is cheating to copy, to allow another person to copy, all or part of an exam or an assignment, or to fake program output. It is also a violation of the Undergraduate Academic Code of Honor to observe and then fail to report academic dishonesty. You are responsible for the security and integrity of your own work.

For the individual assignments in this class, you may discuss with other students and consult printed and online resources. You may quote from books and online sources as long as you cite them properly. However, you may not look at another student's solution, and you may not copy any significant portions of other's solutions.

For the group project, the same rules applies. The main difference is that you are allowed -- and expected -- to discuss specifics of the solution for the project with your team members (i.e., students in your group). However, the group may not copy a solution from elsewhere (i.e., another team, book, tutorial, etc). Any honor code violation to the project will be reported as a major violation.

The following table summarizes how you may work with other students and use print/online sources:

See the CSE Guide to the Honor Code for definitions of the above terms.

The "Pencils Down" Rule: You may communicate about homework with your classmates at a high-level, give general advice, and chat about common problems. You may not communicate specific knowledge such as problem solutions or steps or planning documents. A good litmus test is if you would need to write it down to communicate or remember something, it is off limits. Seek homework help from the Professor or the TAs instead.

Per stated in Section 2.4.1 in the Undergraduate Academic Code of Honor "Faculty and anyone else responsible for teaching or assisting in a course will not tolerate academic dishonesty.". Therefore, if an instructor sees behavior that is academically dishonest, that professor is required to file either an Honor Code Violation Report (HCVR) or a formal report to the College of Engineering Honesty Committee.