26f-2550: Introduction to Cybersecurity

Welcome to CY 2550 Fall 2026.

First steps

• You have a few actions items before class:
  1. Enroll in the course Campuswire. I have emailed you an invite. We use this platform for course questions, announcements, and discussions.
  2. Enroll in gradescope using the registration code that was emailed to you or from the first day of class.

Course Basics

• Instructors: abhi shelat
• TF 1:35–3:15
  • The best way to engage the course staff is via Campuswire.
• Office hours:
  • Zoom links will be posted in Campuswire.

Goals

This is an introductory course that presents an overview of basic cybersecurity principles and concepts. The high-level goal is to introduce main topics in security, introduce adversarial thinking mindset, threat modelling, and design of defense mechanisms.

In my own interpretation, a large part of the field is understanding different expectations of behavior and then studying failures to achieve those expectations in critical systems. I think of four categories of failures:

• Failure in operation:
  • Human model of usage
  • Inadvertently leaking secret keys
• Failures of implementation:
  • improperly handling untrusted input
  • time of use and time of check
  • error handling leaks implementation
  • linux scheduling
• Failures of design:
  • MD5, SHA1 hash function
  • wifi pwd protocol
• Failures of abstraction: when the assumed abstraction does not hold, which leads to catastropic flaws in security. (These are sometimes the most interesting cases to study.)
  • side-channels: power, acoustical, spectre, meltdown
  • adversary is stronger than expected
  • Unintended consequenses: privacy loss

These four are the main themes around which the class is organized. As we study these failures, and understand how to design better systems, the field also considers practical defenses against unforseen attacks and adversaries:

• Defense in depth
• reducing attack surface (e.g., point-to-point instead of perimeter security)
• least privilege
• advanced cryptography

The course will cover most of the required background and we encourage wide participation. Concepts will be illustrated with practical tools, systems, and applications that exemplify them. Hands-on projects will introduce students to key security tools and libraries.

Course Schedule

Ethics

You will learn about security techniques and tools that can potentially be used for offensive purposes. It is imperative that students only use these tools and techniques on systems they own (your personal computers) or systems that are sanctioned by the instructor. NEVER perform attacks against public systems that you do not control. It is both ethically problematic to attack systems that you do not own and may violate the law.

Grading

Your final grade is computed as a weighted sum of your project scores and your progess exercise scores.

• Projects (6–8)
• Progress exercises (10+)

Each project will include a breakdown of how it will be graded. Some projects may include extra credit components that can boost your grade above the maximum score. We assign final letter grades in a way that is consistent with either a curving strategy or a numerical threshold system.

Projects

There will be six to eight projects throughout the semester. Projects must be submitted before 11:59:59pm on the specified date. You can submit as many times as you like through gitlab.
Your last commit timestamp on your files will be used to determine submission time.

Here is a basic list, but the deadlines may be changed depending on lecture progress.

Progress exercises

Some lecture days will include in-class progress exercises. I expect there to be more than 10 of them, and your highest 10 scores will form this portion of your final grade. The exercise must be completed in class. There will not be any opportunity to finish the exercise outside of class. The aim of the exercise is to evaluate you well you understand the coursework to date. We expect that you may miss a lecture day on which we complete an exercise; this is why we use only your 10 highest scores for this portion of the classword.

Late Policy

Project deadlines have no flexibility. Within a few hours after the posted deadline, we will turn off the grader and post the grades, after which you will not be able to submit.

Cheating Policy

1. Collaborating with other students in the class on homework problems is encouraged, though we urge you to first attempt working out all of the problems by yourself. It’s ok to ask your peers about the concepts, algorithms, or approaches needed to do the assignments. We encourage you to do so; both giving and taking advice will help you to learn.

2. You may use LLMs in this course, but do not copy and paste LLM text into your response.

3. You must write up, prepare, submit your solutions, in your own words. Looking at or copying code or homework solutions from other people or an LLM or the Web is strictly prohibited. In particular, looking at other solutions (e.g., from other groups or students who previously took the course) is a direct violation. Projects must be entirely the work of the students turning them in, i.e. you and your group members. If you have any questions about using a particular resource, ask the course staff or post a question to the class forum.

Example: If you have copied and pasted any text from someone else, you have violated this policy even if the two of you were working together on an assignment. Type your own keystrokes that lead you to a solution; do not copy commands that you do not understand or that you were given to you by someone else.

1. All students are subject to the Northeastern University’s Academic Integrity Policy. Per Khoury College policy, all cases of suspected plagiarism or other academic dishonesty must be referred to the Office of Student Conduct and Conflict Resolution (OSCCR). This may result is deferred suspension, suspension, or expulsion from the university.

2. If you violate this policy, you receive a 0, possibly for all assignments up to the violation. There will be no leeway on enforcement of this policy.

Textbook

You do not need a textbook for this course. I am not aware of a great textbook on cybersecurity that aligns with my approach to the topic. However, there are many online resources that cover the topics of this course.
Here is a free online textbook on security that might help you; you will have to find the relevant topics that correspond to class.