Open to the WWWorld
Zagreb, 17-19 April, 1997

Tutorials

Matt Blaze, AT&T Laboratories - Research

Security for Software Developers:
How to Write Code that Withstands Hostile Environments

One full day

Synopsis:
Increasingly, client/server software is being deployed in hostile environments that it may not have been designed to withstand. Attendees will learn how to spot and avoid making typical flaws in security programming, using examples and case studies from existing applications.

Outline:
Basics

• Taxonomies of software and system flaws
• The importance of security
• Putting security at the right layer
• Orange book (C2, B1, B2 systems)
• Authentication versus Authorization

Data Protocols

• How protocols are secure or insecure
• Designing a protocol for security
• Typical weaknesses of protocols

Using cryptography

• Basics (Public key, Secret Key, Certificates)
• Randomness
• Algorithms
• Synchronizing protocols
• What cryptography can and can't do for you

Authentication

• What to authenticate
• Challenge/response
• Authenticating packet streams
• Publicly-available authentication systems

Writing secure network daemons

• Chroot
• Setuid
• Minimizing code
• How to avoid doing everything as "root"

About the lecturer:
Matt Blaze is a Principal Research Scientist at AT&T Laboratories, where he studies computer security, applied cryptology, and large scale distributed computing sytstems. His recent work has been influential in shaping the technological aspects of US cryptography policy; his 1994 discovery of a fundamental weakness in the US Government's proposed ``Clipper'' key escrow system was a turning point in the cryptography debate and has sparked an ongoing area of cryptology research. His current interests focus on the use of secure hardware, the management and specification of trust in large systems, public-key certificate infrastructure, and cryptography policy. Matt holds a PhD in Computer Science from Princeton University. He received the Electronic Frontier Foundation's Pioneer award in 1996.

Matt Blaze is coming thanks to the the support of the USENIX Association.

Jan Saell, jan@yask.com

One full day

Synopsis:
This course is a starting course for people wanting to know how to produce and WEB site or WEB pages. It is focused on the Language and the constructs you have to create pages. It will give an in-depth knowledge about HTML and tables, forms, image maps and frames.

Outline:

• The history behind HTML
• Connections to other languages (SGML and Java)
• Basic HTML-Parts (HEAD/TITLE/BODY)
• Basic HTML-Codes (Rubriker, Brytningar, linjer, Listor)
• Formatting (Bold, italics)
• Images
• Document structures
• Links
• Tables
• Forms
• Image maps
• Frames

Attendees should have some knowledge about the Internet and TCP/IP concepts.

About the lecturer:
Jan Saell is a leading UNIX consultant operating both in Sweden and internationally. He is currently operating his own company - YASK - based in Kumla in the centre of Sweden. YASK provides advanced UNIX and network consultancy. He is currently a member of the EurOpen.SE Governing Board, and responsible for the EurOpen.SE newsletter and the EurOpen.SE network and WWW-server. He is also on the EurOpen board and responsible for events in Europe.

Mr Saell has been working in the UNIX environment since 1983. Prior to starting the company YASK, he was employed by Ekonomistyrning Data AB, a company specialised in advanced Accounting systems.

Simon Kenyon