Course Objectives

Students completing this course will learn how to:

Ultimately, students should leave able to design, build, and assess secure software systems.

Student Outcomes

The ECE department is accredited by ABET to ensure the quality of your education. ABET defines 7 Educational Objectives that are fulfilled by the sum total of all the courses you take. The following list describes which objectives are fulfilled by 18-335/732 and in what manner they are fulfilled. ABET numbers objectives from 1 to 7. Those objectives not fulfilled by this course have been omitted from the following list.

  1. An ability to identify, formulate, and solve complex engineering problems by applying principles of engineering, science, and mathematics. The course poses many problems (on homework, during exams, and for in-class exercises) for students to formulate and solve using good engineering practice. Students will use mathematical and engineering concepts to identify flaws in software and solve the complex problems necessary to secure it.
  2. An ability to apply engineering design to produce solutions that meet specified needs with consideration of public health, safety, and welfare, as well as global, cultural, social, environmental, and economic factors. Poor software design and engineering are the root causes of most security vulnerabilities in deployed systems today. As society increasingly relies on software in critical situations, these vulnerabilities translate into threats to safety and economic well being. This course will examine approaches, mechanisms, and tools used to make software systems more secure.
  3. An ability to communicate effectively with a range of audiences. Students practice their communication skills during team-based homework exercises, as well as the basic written communication of problem solutions on homework and exams.
  4. An ability to recognize ethical and professional responsibilities in engineering situations and make informed judgments, which must consider the impact of engineering solutions in global, economic, environmental, and societal contexts. As in many engineering domains, designing secure software involves extensive tradeoffs. Students will learn to assess and weigh these tradeoffs, including the impact they have on end users.
  5. An ability to function effectively on a team whose members together provide leadership, create a collaborative and inclusive environment, establish goals, plan tasks, and meet objectives. Most assignments will be done in teams of 2-3 students, so students will start to learn teamwork and team management skills. They will also work in teams during in-class exercises.
  6. An ability to develop and conduct appropriate experimentation, analyze and interpret data, and use engineering judgment to draw conclusions. Homework assignments provide an opportunity to conduct experiments applying various forms of software analysis to real code, and using the results to analyze the effectivesness of such analysis.
  7. An ability to acquire and apply new knowledge as needed, using appropriate learning strategies. In a large-scale, multi-phase assignment, students must design a secure system to meet an extensive set of requirements. This includes the use of external libraries for cryptography, which requires the students to draw on external documentation to learn appropriate usage. The final, large-scale assignment also builds on cutting-edge verification tools that requires students to devise new strategies to apply the tools to class concepts.


Your final grade will be determined by:


There will be three in-class, closed book exams during the course of the semester. Each will cover a disjoint portion of the class topics.


Attendance in lecture is required (if not always strictly recorded). For the first two weeks, the lectures will will be held synchronously on Zoom (see the Zoom link on our Canvas site). Subsequent lectures will (hopefully) be in person. You will be responsible for all materials presented in lectures and recitations. You should not expect that all lecture or recitation materials will be given to you in written form. We strongly encourage you to be active in class discussions, in recitation, and Piazza, but your actual participation grades will be based on the quantitative measures described below. If you are unable to attend lecture or recitation synchronously, please get in touch via Piazza, and we will arrange alternate assignments.

Recording (audio or video): To accomodate the inevitable technical glitches that might disrupt your attendance over Zoom, we will be recording the lectures. The recordings will be made available on Canvas, although the time Zoom takes to transcode the videos can vary, so they may not be available immediately after the lecture slot.

Students may not independently record lectures or recitations or post the recordings from Zoom without explicit permission in writing from the instructor. Violations will result in your failing the course. Exceptions will be granted in accordance with university guidelines for accessibility concerns, but even then such recordings may not be shared publicly or privately and must be deleted at the end of the semester.

Class Participation Score: Your class participation score will be based on the use of Zoom and Piazza polls. Most classes will begin with 1-2 questions about the previous lecture. These will be answered on your own. There will also be questions during the lectures. For these, you will typically be allowed to confer with a partner before answering. Overall, there will typically be 4-5 questions each class. To lower the pressure and to account for inevitable conflicts or technical glitches that cause you to miss class, we will drop the lowest 30% of your answers. In other words, if during the entire course, we have 100 questions, then if you get credit for 70 of the questions, you will receive full credit for the class participation portion of your grade.

Participation Ethics: Note that class and recitation participation points are meant to provide both you and me with important feedback on how well you are learning the material. In this regard, they serve the same purpose as homeworks or exams, just at a more frequent, lower-stakes level. Hence, just like on homeworks and exams, conferring with others is not permitted (unless otherwise announced) nor should you enter answers on others’ behalf. Violations will be handled in accordance with the Cheating Policy below.


Because our class will include a discussion component, it’s important that we maintain an open and respectful environment in class. You can vehemently disagree with someone while still respecting them and remaining civil. Everyone is coming to the class from a different background, and we will be covering some very advanced topics, so there will be topics where some people are better informed than others, but that should be an opportunity for learning, not for grandstanding or belittling others. If you do feel uncomfortable in class for any reason (including something we might do or say) please let us know.

Homework Assignments

There will be three homework assignments/projects during the semester, the first of which will have multiple phases. The homework assignments are designed to give you hands-on experience with both attacks and defenses. It can be hard to appreciate the strengths and weaknesses of the methods and tools that we learn about without getting your hands dirty!

Topics covered include:

Most assignments will be done in teams of 2-3 students. These teams will be randomly assigned.

We realize that this will lead to some logistical coordination challenges, but this is very good experience for real-world software development! Almost no one develops serious software on their own, and you rarely get to pick your colleagues at a company. Most companies, let alone open-source projects, will have many geographically distributed employees, so learning how to coordinate in such environments is crucial. We encourage you to use tools like Slack, Skype, Google Docs, and Office 365 to coordinate with each other.

Each project will be assessed once for the whole group, but there will also be a peer evaluation component where you can assess how the other members of your team contributed (and vice versa).

Grading will typically be automated or semi-automated, and you can turn your assignment in early and multiple times without penalty. We encourage you to do this, so you can see how you’re doing on the assignment. By the time you turn in your final submission, there should be very little mystery in what you grade will be.

It’s important to turn your assignments in on time, as late assignments make it difficult to return everyone else’s graded assignments in a timely manner. We encourage you to start early, as security tasks, like most programming tasks, often take longer than you expect! To accomodate unexpected life events, we will give you 3 late days. No more than 1 can be used on any given assignment, so assignments will not be accepted more than 24 hours after the due date. After the 3 late days are used up, we will not grant any additional extensions, so use your late days wisely.


The final third of the course (Languages) will use a new textbook Program Proofs. You will need to order the textbook in advance, as it may take 3-4 weeks to arrive. It should cost $25-30, depending on where you are shipping it. See Canvas for the necessary link.

The earlier parts of the course draw on recent research that is not covered by textbooks. However, the lecture schedule includes links to research papers and/or book chapters on which the lectures are based. We strongly recommend you to do the readings, especially those that are not labeled as optional. These will provide greater depth, detail, and examples than we can cover in class. While quizzes, exams, and homeworks will, in theory, be doable based only on lecture content, doing the readings will make all of the above much easier.

Slides from each lecture will also be posted online after the corresponding lecture, so there’s no need to try to replicate them in your notes during the lecture.


The Friday recitation sessions will primarily be an informal question and answer session. This is your chance to ask questions to help you fully understand material covered in class. You can also ask questions about the homework assignments. We may occasionally have a more structured recitation to dive deeper into a specific topic or tool, but these will be announced in advance.


We will be using Piazza (via Canvas) for discussions outside of class. Rather than emailing general questions to the TAs or instructors, we encourage you to post your questions on Piazza, so everyone can benefit from the answer and any discussions around it.

To get in touch with us for topics or questions specific to you, you can use private posts on Piazza, or you can email us.
We typically aim to respond within 24 hours, unless it’s an emergency. Latency will be higher on the weekends.

You can also drop by Bryan’s office, CIC 2121, anytime, but he may or may not be there or in a meeting. You can schedule a specific meeting time via email, or come by during the formal office hours listed on the main page

Academic Integrity

Students are expected to complete each assignment by working only within their assigned group, and they should be able to explain all of the work that they hand in. Copying code, or text from other students (or sharing yours with them) or online sources is not allowed. However, students are encouraged to discuss assignments (in person or via Piazza) with each other at a sufficiently high level to avoid the risk of duplicating implementation or proof. Examples of this would be discussing algorithms and properties referred to in the assignment, helping other students with questions about a programming language or tool required to complete the assignment, discussing a general technique, or referring to an online source with useful information. If you have questions about whether something might be an issue, contact the course staff before discussing further. Please refer to the Carnegie Mellon Code for information about university policies regarding academic conduct.

Work Life Balance

Take care of yourself. Do your best to maintain a healthy lifestyle this semester by eating well, exercising, avoiding drugs and alcohol, getting enough sleep and taking some time to relax. This will help you achieve your goals and cope with stress.

All of us benefit from support during times of struggle. You are not alone. There are many helpful resources available on campus and an important part of the college experience is learning how to ask for help. Asking for support sooner rather than later is often helpful.

If you or anyone you know experiences any academic stress, difficult life events, or feelings like anxiety or depression, we strongly encourage you to seek support. Counseling and Psychological Services (CaPS) is here to help: call 412-268-2922 and visit their website. Consider reaching out to a friend, faculty or family member you trust for help getting connected to the support that can help.

If you have questions about this or your coursework, please let us know.