Computer Security
Threats, cryptography, secure systems and defensive practice: security principles and threat modelling, classical and symmetric cryptography with authenticated encryption, hashing, MACs and secure password storage, public-key cryptography and the post-quantum transition, certificates and TLS 1.3, access control mechanisms, memory safety and safe input handling, web application security against the OWASP Top 10 (2025), operating system and network hardening, and privacy-enhancing technologies under PIPEDA and Quebec's Law 25, ending in a threat-modelling capstone with the law on computer misuse and coordinated disclosure.
CMPUT-331 Year 3 3 credits 12 lessons · 6 h 49 min
Offered by HSM University · Computing Science
This is the Canadian version of this course. See the American version.
What you'll learn
- Apply security principles such as least privilege, defence in depth and complete mediation, and build threat models with STRIDE and attack trees.
- Explain classical ciphers, frequency analysis, perfect secrecy and Kerckhoffs's principle, and why they shaped modern cryptography.
- Select and use symmetric encryption correctly, including block cipher modes, nonces and authenticated encryption with associated data.
- Use hash functions and MACs appropriately and design secure password storage with salted, memory-hard functions and modern password policy.
- Describe Diffie–Hellman, RSA, elliptic-curve cryptography and digital signatures, their correct use, and the post-quantum migration timeline.
- Explain certificates, chains of trust, Certificate Transparency and the TLS 1.3 handshake, and avoid common validation mistakes.
- Implement and evaluate access control using reference monitors, ACLs, capabilities, Unix permissions, MAC, RBAC, ABAC and secure sessions.
- Recognize memory-safety bug classes, apply safe coding, sanitizers and memory-safe languages, and validate untrusted input with allow-lists after canonicalization.
- Defend web applications against the OWASP Top 10 (2025) using parameterized queries, output encoding, CSRF protection, security headers and supply chain controls.
- Harden operating systems and networks with privilege separation, sandboxing, safe process execution, segmentation, default-deny filtering and detection.
- Apply privacy principles under PIPEDA and Quebec's Law 25 and use privacy-enhancing technologies such as k-anonymity, differential privacy and keyed pseudonymization.
- Threat model and harden a web application end to end, and act lawfully and ethically under the Criminal Code, with coordinated vulnerability disclosure.
Course content
12 lessons · 6 h 49 min total · final exam
- 1 Security principles and threat modelling 36 min · quiz
- 2 Classical cryptography and the foundations of modern cryptography 36 min · quiz
- 3 Symmetric cryptography: block ciphers, modes and authenticated encryption 34 min · quiz
- 4 Hash functions, message authentication codes and secure password storage 37 min · quiz
- 5 Public-key cryptography: key agreement, RSA, signatures and the post-quantum transition 35 min · quiz
- 6 Certificates, public key infrastructure and TLS 35 min · quiz
- 7 Authentication and access control mechanisms 33 min · quiz
- 8 Secure software I: memory safety and safe input handling 34 min · quiz
- 9 Secure software II: web application security 34 min · quiz
- 10 Operating system and network security 31 min · quiz
- 11 Privacy and privacy-enhancing technologies 32 min · quiz
- 12 Capstone: threat modelling and hardening a web application, ethics and careers 32 min · quiz
- E Final exam 20 questions
Requirements
Recommended background. You can start any course at any time.
Description
Threats, cryptography, secure systems and defensive practice: security principles and threat modelling, classical and symmetric cryptography with authenticated encryption, hashing, MACs and secure password storage, public-key cryptography and the post-quantum transition, certificates and TLS 1.3, access control mechanisms, memory safety and safe input handling, web application security against the OWASP Top 10 (2025), operating system and network hardening, and privacy-enhancing technologies under PIPEDA and Quebec's Law 25, ending in a threat-modelling capstone with the law on computer misuse and coordinated disclosure.
Part of the Science stream, typically taken in year 3.