Usable Security and Privacy (CS60081) Autumn 2020
All secure and privacy-preserving systems are ultimately used
by humans, who might or might not understand the intended usage
of these systems. In fact, often users are the “last line of
defense” in securing a system and if the systems are not
designed keeping user mental model and their background
knowledge in mind, that can lead to system misuse and consequent
security and privacy disasters. Thus, only designing secure and
private systems are not enough, we need to design secure and
private systems keeping usability in mind. In other words, we
need to understand the user expectation from the systems and
incorporate this understanding in system design.
This course will focus on how to design for security and
privacy in systems using a user-centric view. We will combine
concepts from computer systems, human computer interaction (HCI)
and secure/private system design. We will introduce core
security and privacy technologies, as well as HCI techniques for
conducting robust user studies. The course will cover topics
like passwords, definitions of privacy, usable encryption,
authentication, privacy of archival data, usability of crypto
libraries and privacy notices. See the course schedule for details.
Instructor
TAs
Course Information
| Credit (L-T-P) |
3-0-0 |
| Background Knowledge |
Since this course deals with usability of systems,
(naturally) you need to first know how systems work. We
will assume some familiarity with some basic computer
science / mathematics concepts. We are providing a
list of expected background knowledge below (this list is
not complete, but should give you an idea about what basic
background knowledge you need for this course).
|
| Lectures | Scheduled lecture timings are: Monday 3:00 pm - 4:55 pm Tuesday 3:00 pm - 3:55 pm Wednesday 8:00 pm - 9:30 pm (extra slot) However, this semester we will conduct the course online with a mix of live lectures, pre-recorded course videos and online doubt clearing sessions. Please keep an eye on the Schedule page for the latest updates. We will also use the Wednesday slot for things like viva, project discussion, project presentation etc. |
| Textbook | No specific books; That said, we will post publicly
available research papers/book excerpts that you need to
read for following the class as well as for the
quizzes/viva (will be added to the course schedule page ). |
| Coursework | The coursework for all students consists of
semi-regular quizzes/vivas and a term project (in groups
of 2-3). |
| Communication | We will update the course schedule regularly
throughout the course. Quizzes
General discussion
|
| Late policy | The regular quizzes will be time bound and you can take
and complete the quiz in the assigned time window (will be
announced via Microsoft classroom). Moodle will not accept
late submissions by design. Of course, in exceptional circumstances related to personal emergencies, serious illness, wellness concerns, family emergencies, and similar, please make the course staff aware of your situation beforehand/as soon as possible and we will decide how to handle your case. |
Course evaluation components [And timeline]
(40%) |
|
| Viva/class test (54%) |
To test student's understanding we will
also conduct in-person viva and time bound online class
tests (total three). We will share the details in due
course. |
| Term project (46%) |
Students will work on course projects in
small groups of 2-3. We will provide a choice of projects.
Students will be given an opportunity to indicate their
preferences before project groups are assigned by the
instructors. Students who have their own ideas for projects (or already formed a group) should discuss them with the instructors within the first week (start with sending a mail). The end goal of this project is to (i) teach you the principles of usable security and privacy hands-on (ii) create an academic research paper as an output of this course. All reports should be written in ACM double column "sigconf" template. Check the template here. Feel free to use the overleaf link in that page. We will deduct marks if your report is not in ACM double column sigconf format. We encourage you to use LaTex. Each report should contain your name and Roll numbers. Furthermore, one report-upload per group in Moodle (by any of the group members) will suffice (submission by multiple people will only confuse the course-stuff and you will risk being evaluated by the submission of a random group member). Here is a Timeline of as part of the project what will the students do:
|
Honor code
You are permitted to talk to the course staff and to your fellow
students about any of the problem sets. Any assistance, though,
must be limited to discussion of the problem and sketching general
approaches to a solution. Each student must write out his or her
own solutions to the problem sets. Consulting another student's
solution is prohibited, and submitted solutions may not be copied
from any source. These and any other form of collaboration on
assignments constitute cheating.No collaboration is permitted on quizzes or assignments. All work submitted for the project must properly cite ideas and work that are not those of the students in the group. Simply stated, feel free to discuss problems with each other, but do not cheat. It is not worth it, and you will get caught. In that case, we will be forced to award you no marks for that assignment/quiz/project, take away 50% of your total final marks and you will risk deregistration.
Grading
Your course grade will be calculated as follows:| 3 Viva/Class tests |
54% (18% each) |
| Term project | 46% |