66123 Saarbrücken (Germany)
Prof. Thorsten Holz ist Tenured Faculty am CISPA Helmholtz-Zentrum für Informationssicherheit. Bevor er im Oktober 2021 zum CISPA wechselte, war er Professor an der Fakultät für Elektrotechnik und Informationstechnik der Ruhr-Universität Bochum. Seine Forschungsinteressen umfassen technische Aspekte sicherer Systeme, mit einem besonderen Fokus auf Systemsicherheit. Thorsten Holz hat einen Abschluss als Dipl.-Inform. in Informatik von der RWTH Aachen (2005) und den Doktortitel von der Universität Mannheim (2009). Im Jahr 2011 wurde er mit dem Heinz Maier-Leibnitz-Preis der Deutschen Forschungsgemeinschaft (DFG) und 2014 mit einem ERC Starting Grant ausgezeichnet. Von 2019 bis 2021 war er außerdem Co-Sprecher des Exzellenzclusters "CASA - Cyber Security in the Age of Large-Scale Adversaries" (mit C. Paar und E. Kiltz). In den letzten Jahren hat er in vielen Programmausschüssen mitgearbeitet und war Co-Vorsitzender des Programmausschusses (PC) für zwei der führenden Computersicherheitskonferenzen, nämlich dem IEEE Symposium on Security and Privacy (2021, 2022) und dem USENIX Security Symposium (2016).
EuroSys 2022EuroSys 2022
RAID 2016, 19th International Symposium on Research in Attacks, Intrusions and Defenses
Symposium on Usable Privacy and Security (SOUPS) 2016
Proceedings of the 36th IEEE Symposium on Security and Privacy (S&P)
Proc. of the 2015 Internet Measurement Conference (IMC'15)
Proceedings of the 21st ACM conference on Computer and Communications Security (ACM CCS '14)
Proceedings of the 23rd USENIX Security Symposium (USENIX '14)
Proc. of the 30th Annual Computer Security Applications Conference (ACSAC'14)
Proceedings of the 17th International Symposium on Research in Attacks, Intrusions and Defenses
Current Topics in Systems Security
For the first time, we offer a seminar on "Current Topics in Systems Security". The focus areas of this seminar are software security, network security, privacy, reverse engineering and similar topics. Students are expected to independently investigate a narrowly defined topic, typically based on recently published scientific papers. They are expected to write a text summarizing their findings and prepare a presentation on the topic. The text should be about 15 pages long, while the presentation should be about 20 minutes long. This will be complemented by a discussion on the topic.
The seminar is organized similar to a scientific conference. In addition to writing a summary of a particular topic, students also learn about the peer-review process: An important aspect of the seminar is constructive feedback on other students' reports, e.g., in the form of suggestions on how to improve the writing and presentation. Students should then also use this feedback to improve their own text. The seminar will take place at the end of the semester as part of a block seminar, there will be no weekly classes.
The students get to know methods in research-related teaching and are able to study a closely defined topic on their own based on scientific literature. The students learn to understand technical literature on a specific topic and obtain insights into current research topics. The students can practice to write scientific texts and the summary of complex subject areas. The students learn more about the peer-review process and scientific work in general. Furthermore, the talk enables students to learn to present scientific results and deepen the subject.
The list of topics and papers for this year's seminar can be found here.
In this course, important theoretical and practical aspects from the area of systems security are presented and discussed. The focus is on various aspects of software security and different attack and defense techniques are presented. More specifically, important attack methods (e.g., buffer overflows, race conditions, microarchitectural attacks, etc.) as well as defense strategies (e.g., non-executable memory, Address Space Layout Randomization, memory tagging, etc.) are discussed. Other topics of the lecture are fuzzing, obfuscation, and similar aspects of systems security.
At the end of the course, students should be able to analyze security aspects of various types of software systems, detect vulnerabilities in the design and implementation, and independently develop security mechanisms. In addition, other aspects from the area of systems security, such as privacy and anonymity, will be discussed. An important part of the course are exercises, which illustrate and deepen the material with practical examples.
At the end of the class, the students know important theoretical and practical aspects of security mechanisms of modern software systems. They are able to independently analyze the security of a given program, detect vulnerabilities in the design, and independently develop possible solutions and protective mechanisms. In addition, they have become familiar with basic terms from the field of systems security. They are able to create new security models themselves and defend them argumentatively.
There are no formal prerequisites for this course. However, if you want to participate, please take the following aspects into account:
Background in security is also an advantage (e.g., prior participation in the Foundations of Cybersecurity lecture or Security core lecture). However, we will also cover several relevant aspects as part of the lectures.
The lecture will take place every Wednesday from 12:00-14:00 o'clock, starting on October 20, 2021. The lecture will be offered in a hybrid format: we will have regular lectures in the CISPA lecture hall (0.05) and also record the lectures. The exercises will be offered via Zoom, you can find more information on the page "Access to lectures".
For passing the course, you need to obtain at least 50% of the points from the final exam. For admission to the exam, you need to obtain at least 50% of the points from the exercises (120 points). The final grade is based on your exam results only. More details can be found below:
During the semester, there will be seven assignments with a total of 240 points. You need at least 50% in total (120 points) to be admitted to the exam. The assignments cover the topics discussed in the lectures and aim to deepen your knowledge of the topics. We encourage you to solve these assignments because this helps to understand the topics covered in the lectures.
Assignments have to be submitted individually, no group work is allowed. A submission typically consists out of a theoretical and practical part. Submit solutions to all theoretical tasks (e.g., questions, charts to fill out, etc.) in a single PDF file. For all practical tasks, we have prepared a remote environment equipped with all necessary tools and materials. Practical tasks are solved and submitted directly within this environment. Check the Remote Exercise Framework (REF) PDF for more information. These practical exercises are designed like CTF challenges. You will typically be tasked to exploit a vulnerable program to extract a secret flag.
At the end of the semester, there will be a written exam. The exact date and time will be announced once the information is available. Note that physical presence is required for the exam. The exam consists of both theoretical questions and practical questions. Theoretical questions are based on the theoretic parts and concepts of the slides and possibly additional content presented in the lecture, which is not part of the slides. Practical questions are, in principle, similar to the practical assignments. However, the complexity of the questions is of course scaled to make them adequate for the time available during an exam (e.g., you are not expected to implement a longer piece of assembler code). If you have at least 50% of the points, you will pass the class.
All questions of the exam are in English. Answers can be given either in English or in German, at the student’s discretion.
No lecture notes or any other materials are allowed during the exam. All materials required to solve the practical questions are provided at the exam.