ISA 419: Data-Driven Security

.title[
# ISA 419: Data-Driven Security
]
.subtitle[
## 01: Introduction to Cybersecurity
]
.author[
### <br>Fadel M. Megahed, PhD <br><br> Professor <br> Farmer School of Business<br> Miami University<br><br> <a href="https://twitter.com/FadelMegahed"><svg viewBox="0 0 512 512" style="height:1em;position:relative;display:inline-block;top:.1em;fill:white;" xmlns="http://www.w3.org/2000/svg"> <path d="M459.37 151.716c.325 4.548.325 9.097.325 13.645 0 138.72-105.583 298.558-298.558 298.558-59.452 0-114.68-17.219-161.137-47.106 8.447.974 16.568 1.299 25.34 1.299 49.055 0 94.213-16.568 130.274-44.832-46.132-.975-84.792-31.188-98.112-72.772 6.498.974 12.995 1.624 19.818 1.624 9.421 0 18.843-1.3 27.614-3.573-48.081-9.747-84.143-51.98-84.143-102.985v-1.299c13.969 7.797 30.214 12.67 47.431 13.319-28.264-18.843-46.781-51.005-46.781-87.391 0-19.492 5.197-37.36 14.294-52.954 51.655 63.675 129.3 105.258 216.365 109.807-1.624-7.797-2.599-15.918-2.599-24.04 0-57.828 46.782-104.934 104.934-104.934 30.213 0 57.502 12.67 76.67 33.137 23.715-4.548 46.456-13.32 66.599-25.34-7.798 24.366-24.366 44.833-46.132 57.827 21.117-2.273 41.584-8.122 60.426-16.243-14.292 20.791-32.161 39.308-52.628 54.253z" /></svg> <span class="citation">@FadelMegahed</span></a> <br> <a href="https://github.com/fmegahed/"><svg viewBox="0 0 496 512" style="height:1em;position:relative;display:inline-block;top:.1em;fill:white;" xmlns="http://www.w3.org/2000/svg"> <path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6zm-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3zm44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9zM244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8zM97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1zm-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7zm32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1zm-11.4-14.7c-1.6 1-1.6 3.6 0 5.9 1.6 2.3 4.3 3.3 5.6 2.3 1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2z" /></svg> fmegahed</a> <br> <a href="mailto:fmegahed@miamioh.edu"><svg viewBox="0 0 512 512" style="height:1em;position:relative;display:inline-block;top:.1em;fill:white;" xmlns="http://www.w3.org/2000/svg"> <path d="M476 3.2L12.5 270.6c-18.1 10.4-15.8 35.6 2.2 43.2L121 358.4l287.3-253.2c5.5-4.9 13.3 2.6 8.6 8.3L176 407v80.5c0 23.6 28.5 32.9 42.5 15.8L282 426l124.6 52.2c14.2 6 30.4-2.9 33-18.2l72-432C515 7.8 493.3-6.8 476 3.2z" /></svg> fmegahed@miamioh.edu</a><br> <a href="https://calendly.com/fmegahed"><svg viewBox="0 0 384 512" style="height:1em;position:relative;display:inline-block;top:.1em;fill:white;" xmlns="http://www.w3.org/2000/svg"> <path d="M202.021 0C122.202 0 70.503 32.703 29.914 91.026c-7.363 10.58-5.093 25.086 5.178 32.874l43.138 32.709c10.373 7.865 25.132 6.026 33.253-4.148 25.049-31.381 43.63-49.449 82.757-49.449 30.764 0 68.816 19.799 68.816 49.631 0 22.552-18.617 34.134-48.993 51.164-35.423 19.86-82.299 44.576-82.299 106.405V320c0 13.255 10.745 24 24 24h72.471c13.255 0 24-10.745 24-24v-5.773c0-42.86 125.268-44.645 125.268-160.627C377.504 66.256 286.902 0 202.021 0zM192 373.459c-38.196 0-69.271 31.075-69.271 69.271 0 38.195 31.075 69.27 69.271 69.27s69.271-31.075 69.271-69.271-31.075-69.27-69.271-69.27z" /></svg> Automated Scheduler for Office Hours</a><br><br>
]
.date[
### Spring 2025
]

---

## Learning Objectives for Today's Class

- Define **information security (Infosec)**, its **main goals**, and how it fits within a firm’s overall security protocols

- Describe the **three main steps** in information security: prevention, detection, and response.

- Explain why **prevention as a sole security measure is deemed to fail**.

- Describe **course structure**, **goals**, and **overview**.

---
class: inverse, center, middle

# Information Security & its Main Goals

---

## What is Security?

- According to the [Merriam-Webster Dictionary](https://www.merriam-webster.com/dictionary/security), **security** can be defined as: **"the
quality or state of being secure: such as freedom from danger."**

- I.e., the objective is to **protect against adversaries who would do harm whether it is intentional or not.**

- For example, **national security** is a ``multilayered system that protects the sovereignty of
a state, its assets, its resources, and its people.'' ([Whitman and Mattford, 2022, p. 8](https://www.cengage.com/c/principles-of-information-security-7e-whitman-mattord/9780357506431/))
]

<div class="figure" style="text-align: center">
<img src="data:image/png;base64,#../../figures/firm_security.png" alt="An illustrative bubble diagram highlighting the different dimensions of a firm's security. At the center is the largest bubble, labeled 'Firm's Security Dimensions' in bold text. Surrounding this central bubble are four smaller bubbles, each representing a key aspect of security: 'Physical', 'Personnel', 'Operations', and 'Network'. Additionally, there's a bubble for 'Information'. Each bubble is connected to the central one, indicating the interconnected nature of these security aspects. The bubbles are uniformly colored in miami red, and the text inside each bubble is small and bold for emphasis." width="80%" />
<p class="caption">Integrating InfoSec within the Broader Spectrum of Firm's Security Dimensions</p>
</div>
]

---

## What is Cyber/Information Security?

While some researchers distinguish between them, in this course, we will use both terms
**interchangeably**. Possible **definitions for cyber/information security include:**

- .bold[According to the [Merriam-Webster Dictionary](https://www.merriam-webster.com/dictionary/cybersecurity), cyber security can be defined as: .red[“measures taken to protect a computer or computer system (as on the Internet) against unauthorized access or attack.”]]

- .bold[According to the [SANS Institute](https://www.sans.org/information-security/), “information security refers to the processes and methodologies which are designed and implemented to protect print, electronic, or any other form of confidential, private and sensitive information or data from .red[unauthorized access, use, misuse, disclosure, destruction, modification, or disruption.]"]

---

## Information Security Goals

- .bold[.red[Confidentiality:] Preventing unauthorized reading/disclosure of information.]

- .bold[.red[Integrity:] Preventing unauthorized modification of information.]

- .bold[.red[Availability:] Preventing unauthorized withholding of information/ resources]

]

<div class="figure" style="text-align: center">
<img src="data:image/png;base64,#../../figures/cia_triad.png" alt="A visually striking cybersecurity diagram featuring a central node labeled 'CIA' in bold white text on a miamired background, symbolizing the core principles of cybersecurity: Confidentiality, Integrity, and Availability. The central node is connected to three surrounding nodes, each with miamired borders and no fill color. The 'Confidentiality' node includes a lock icon, 'Integrity' features a check circle icon, and 'Availability' is represented with a cloud icon. All arrows linking the central node to the surrounding nodes are in miamired, emphasizing the interconnectedness of these principles." width="80%" />
<p class="caption">The Interconnected Core of Cybersecurity: CIA Principles in Focus.</p>
</div>

]

---

## Class Activity: Explaining the CIA Triad

Suppose that I would like to start an online banking business, named Miami University Online Bank (MUOB). Assume that we have:

<div style="text-align: center; display: flex; justify-content: center;">
  <div style="flex: 1; margin: 0 10px;">
    <img src="../../figures/fadel.jpg" alt="Fadel, the owner of the proposed bank" style="height: 175px; width: auto;">
    <p style="text-align: center;">Fadel (Owner)</p>
  </div>
  
  <div style="flex: 1; margin: 0 10px;">
    <img src="../../figures/john.jpg" alt="John McClane, a picture of Bruce Willis from Die Hard, as the customer" style="height: 175px; width: auto;">
    <p style="text-align: center;">John McClane (Client)</p>
  </div>
  
  <div style="flex: 1; margin: 0 10px;">
    <img src="../../figures/hans.png" alt="Hans Gruber, a picture of Bruce Willis from Die Hard, as the bad guy" style="height: 175px; width: auto;">
    <p style="text-align: center;">Hans Gruber (Bad Guy)</p>
  </div>
</div>

**Your task:** "Think-Pair-Share activity" Reflect individually, then discuss with your partner to finalize your explanation of the CIA principles in the MUOB context. Write it down in 2nd panel.
]

.can-edit.key-activity1[
- **Confidentiality:** Edit me in your web browser.

- **Integrity:** Edit me.

- **Availability:** Edit me.

] 
]
]

???

In the context of Miami University Online Bank (MUOB), the CIA principles - Confidentiality, Integrity, and Availability - can be explained with the help of the roles of Fadel (Owner), John (Customer), and Hans (Bad Guy):

- **Confidentiality:** This principle ensures that sensitive information is accessible only to those authorized to view it. For MUOB, confidentiality means that customer data, such as John's account details and transaction history, should only be accessible to John and authorized MUOB personnel like Fadel. It prevents unauthorized individuals like Hans from accessing or viewing this sensitive information. Techniques to ensure confidentiality include strong authentication mechanisms, encryption, and access control measures.

- **Integrity:** Integrity refers to maintaining the accuracy and consistency of data over its entire lifecycle. For MUOB, this means ensuring that any transaction or data modification, like deposits or withdrawals made by John, is accurately recorded and unaltered. Fadel, as the owner, is responsible for implementing systems that log and verify every transaction to prevent Hans from unauthorized altering of transaction data or account balances. Tools like checksums, digital signatures, and audit trails help maintain integrity.

- **Availability:** This principle ensures that information and resources are available to authorized users when needed. In MUOB's context, availability means that John should be able to access his account and perform transactions whenever he needs to, without interruptions. Fadel needs to ensure that the online banking system is robust, with minimal downtime, and is protected against attacks from Hans that could disrupt service, such as Denial of Service (DoS) attacks. Measures like redundant systems, regular maintenance, and strong cybersecurity defenses are vital to ensure high availability.

---

## Beyond the CIA: Other InfoSec Objectives

???
This diagram suggests additional key concepts that are crucial in the broader scope of cybersecurity:

- **Authentication (Computer vs. Network):** This refers to the process of verifying the identity of a user or a device. It's a critical security measure to ensure that only authorized users or devices can access certain information or networks. The distinction between computer and network authentication highlights the different approaches and mechanisms required for securing individual devices (like a computer) and network access.

- **Authorization:** This concept involves granting or denying rights and permissions to access and use information or resources. After a user is authenticated, authorization determines what they are allowed to do within the system, like accessing specific files, executing commands, or reading data.

- **Privacy:** This involves protecting sensitive personal information from unauthorized access and disclosure. In the context of cybersecurity, it emphasizes the need to handle and secure personal and private data, respecting user confidentiality and regulatory requirements.

- **Non-repudiation:** This principle ensures that a party in a communication cannot deny the authenticity of their signature on a document or a message that they originated. In cybersecurity, it's crucial for maintaining the integrity of transactions and communications, often implemented through digital signatures and audit trails.

- **Auditability:** This refers to the ability to audit and review logs and records to trace and understand actions taken within a system. Effective auditability helps in detecting security violations, understanding the impact of the incidents, and improving the security posture of an organization.

By including these concepts, the chart emphasizes that a comprehensive approach to cybersecurity involves more than just the traditional CIA Triad; it also requires attention to authentication, authorization, privacy, non-repudiation, and auditability.

---

## Risk Management Controls

Effective cybersecurity **begins** with implementing diverse risk management controls, each targeting specific security aspects:

- **Administrative:** Includes the development and deployment of policies and procedures; for example:  
    * Password policies  
    * Principal of least privilege (POLP)  
    
- **Physical:** In addition to securing a firm’s premises through doors/locks/etc., typical risk
management controls utilize the:  
    * Principal of separation of duties

???
See [IBM's 5 Principles for Cyber Architecture](https://www.youtube.com/watch?v=jq_LZ1RFPfU&ab_channel=IBMTechnology) for more details.

---

## Protocols, Host-Based Protections, and Other Key Preventive Measures

- **Protocols:** For example, the reliance on secure socket layer (SSL) to authenticate the web source

- **Host-based protections:** secure operating systems and/or patching

- **Access Control:** Through identification (username), authentication (over a computer/ network), and authorization (file permissions, need-to-know principle)

- **Firewalls:** to control inter-network traffic (e.g., from/to internet)

- **Security by design:** code reviews, unit testing, defense in depth, and principle of least privilege

---

## Class Activity: Have you been Pwned?

- The purpose of this class activity is to investigate how many of your web accounts have been breached. This activity consists of the following steps:

- Go to <https://haveibeenpwned.com/>

- Insert the email you use most online (e.g., in my case it is my Gmail) into the search bar and then click on "pwned?"

- Record the count of breaches that you were pwned in.

- Anonymously, report the count of your breaches on the survey site <www.menti.com> (you will need to include the access code shown in class).

- **Outside of class:** .bold[Address the breaches by changing your password for these sites, opting into 2-factor authentication, and changing the passwords in other websites] (if you re-used this password).

---

## Class Activity: Have you been Pwned? (Cont.)

---

# Prevention as a Sole Security Measure is Deemed to Fail

---

## Failure of Prevention: World’s Biggest Data Breaches

---

## Failure of Prevention: World's Most Targeted Industries

---

## Failure of Prevention: Monetary Damage in the U.S.

---

## Failure of Prevention: Attacks Constantly Getting Easier

<div class="figure" style="text-align: center">
<img src="data:image/png;base64,#../../figures/attack-soph.png" alt="The figure shows how the attack sophistication has increased over time, while the intruder’s technical knowledge has decreased. This means more amateur attackers can apply sophisticated attacking tools to conduct dangerous attacks against computational devices, networks or smart premises." width="66%" />
<p class="caption">Attack sophistication versus intruder technical knowledge</p>
</div>

**Source:** Ramirez, J. H. P. (2017). An Anomaly Behavior Analysis Methodology for the Internet of Things: Design, Analysis, and Evaluation ([Doctoral dissertation, The University of Arizona](https://arizona.aws.openrepository.com/handle/10150/625581)).
]

---

## Failure of Prevention: Attacks Constantly Getting Faster

<div class="figure" style="text-align: center">
<img src="data:image/png;base64,#../../figures/attack-time.PNG" alt="Figure indicates that the attackers can currently impact regional networks in term of minutes, and it has been predicted that they will be able to impact the global infrastructure in the matter of seconds in the near future." width="75%" />
<p class="caption">The timeline of cyber-threads scope of damage and impact time</p>
</div>

---

## Failure of Prevention: Attackers Having More Options

**Source:** Louis Columbus (2023). Why attackers love to target IoT devices. [VentureBeat](https://venturebeat.com/security/why-attackers-love-to-target-iot-devices/).
]

---

## Why is Prevention .black[Not] Enough?

<html>
<ul>
    <li>Inherent weaknesses in increasingly more complex systems/networks
        <ul>
            <li>Poor Design
                <ul>
                    <li>Software and hardware</li>
                    <li>Example: sendmail (race condition vulnerability, buffer overflow, group permission vulnerability, etc.)</li>
                </ul>
            </li>
            <li>Poor Implementation
                <ul>
                    <li>Security an afterthought</li>
                    <li>Lack of personnel experience/training</li>
                    <li>Poor system configuration (e.g., default firewall configurations with open insecure ports)</li>
                </ul>
            </li>
            <li>Poor Management
                <ul>
                    <li>Inadequate policies/procedures</li>
                </ul>
            </li>
        </ul>
    </li>
</ul>

</html>

???
This slide presents a structured breakdown of the inherent weaknesses found in increasingly complex systems and networks, categorized into three main areas: Poor Design, Poor Implementation, and Poor Management. Each category is explored with further details:

- Poor Design:  
  - This point addresses fundamental flaws in the architecture of software and hardware.  
  - An example given is 'sendmail', a widely used mail transfer agent, which has had vulnerabilities like race conditions, buffer overflows, and group permission issues. These vulnerabilities are often due to design choices that do not adequately consider security.

- Poor Implementation:   
  - Here, the focus is on how systems are set up and maintained, highlighting that security is often not the primary concern.  
  - Factors contributing to poor implementation include a lack of experienced personnel or training, and suboptimal system configurations. For instance, default firewall configurations might leave insecure ports open, creating security risks.

- Poor Management:  
  - This final point stresses the importance of good governance in managing IT systems.  
  - Inadequate policies and procedures can lead to systemic weaknesses, as they fail to establish a strong security culture or provide clear guidelines for maintaining security.

---

## Why is Prevention .black[Not] Enough?

- Tradeoff between security and usability

- Cost of prevention

**Source:** Adapted from CS 259D, Stanford University, <https://web.stanford.edu/class/cs259d/lectures/Session1.pdf>
]

---

# The Three Main Steps in Information Security (Defense)

---

## A Taxonomy of Information Security Measures

---

# Course Design, Expectations, and Overview

---

## Course Overview

Traditionally, information technology (IT) security was a job that entailed using a few tools, solutions and best practices that focused on attack prevention and protect a company’s sensitive information and network assets. However, these solutions are no longer sufficient. The businesses are transitioning to a new era, where cybersecurity is **enhanced and almost always requires data-driven analytical solutions**. The primarily goals of data-driven security are to:  
  - discover malicious patterns from the data-lakes of logs produced by security software, and   
  - develop automated tools that can assist in the surveillance of security-related data.  
  
This course covers various analytic applications in information/cyber security including: **user behavior analysis, network and host intrusion detection, web security, phishing detection, and emerging issues in Industrial Internet of Things (IIoT) security**. Note that the course is designed to be **very applied, involving a large amount of programming to examine real datasets.**

---

## Course Overview

<div class="figure" style="text-align: center">
<img src="data:image/png;base64,#../../figures/course_overview.png" alt="Flowchart depicting the structure of the ISA 419 course, divided into two phases. The top node is labeled 'ISA 419'. Below it, two branching nodes represent the course's phases. The left node, 'Phase I: Foundations and Leveling (Weeks 1-8)', focuses on foundational aspects. The right node, 'Phase II: Applications (Weeks 9-15)', covers application-oriented topics. Arrows flow from ISA 419 to both Phase I and Phase II, indicating the course progression." width="60%" />
<p class="caption">How the ISA 419 course is organized.</p>
</div>

---

## Course Objectives

Upon completing the course, you will:

- Describe key cybersecurity concepts, including the CIA Triad, access management, incident response, and common cybersecurity best practices.

- Demonstrate a fundamental understanding of the role of analytical solutions in state-of-the-art cybersecurity solutions.

- Understand the uniqueness of cybersecurity datasets, including the nature of unbalanced data and diversity of data in each class, asymmetrical costs of misclassification, and non-stationary inference.

- Understand the theory behind some commonly used statistical methodologies and machine learning algorithms in data-driven security.

- Use and implement an appropriate modeling paradigm to tackle cybersecurity problems.

---

## Instructional Approach

<div class="figure" style="text-align: center">
<img src="data:image/png;base64,#../../figures/instructional_approach.png" alt="An overview of the instructional approach for ISA 419." width="100%" />
<p class="caption">An overview of the instructional approach for ISA 419.</p>
</div>

---

## How will I Evaluate your Learning?

<div class="figure" style="text-align: center">
<img src="data:image/png;base64,#../../figures/evaluation.png" alt="An overview of the evaluation components for ISA 419." width="100%" />
<p class="caption">An overview of the evaluation components for ISA 419.</p>
</div>

---

# The Equifax Data Breach: A Case Study

---

## Case Background

**Equifax Overview:**
  - Major credit reporting agency.  
  - Manages sensitive personal data of millions.

**The Breach Discovery:**  
  - Disclosed in September 2017.  
  - Compromised personal information of 147 million individuals.

**Vulnerability Exploited:**  
  - Apache Struts CVE-2017-5638.  
  - Equifax's system was unpatched.

???
See the HBS case study under references for more details.

---

## Case Background (Cont.)

**Breach Timeline:**
  - Apache reported the vulnerability in March 2017.  
  - Equifax’s systems remained vulnerable for months.  
  - Unauthorized access occurred from May to July 2017.

**Data Compromised:**  
  - Included names, Social Security numbers, birth dates.  
  - Addresses, and in some cases, driver's license numbers and credit card numbers.

---

## The Detailed Timeline of the Equifax Data Breach

---
class: inverse, center, middle

# Recap

---

## Summary of Main Points

By now, you should be able to do the following:

- Define **information security (Infosec)**, its **main goals**, and how it fits within a firm’s overall security protocols

- Describe the **three main steps** in information security: prevention, detection, and response.

- Explain why **prevention as a sole security measure is deemed to fail**.

- Describe **course structure**, **goals**, and **overview**.

---

## 📝 Review and Clarification 📝

1. **Class Notes**: Take some time to revisit your class notes for key insights and concepts.
2. **Zoom Recording**: The recording of today's class will be made available on Canvas approximately 3-4 hours after the session ends.
3. **Questions**: Please don't hesitate to ask for clarification on any topics discussed in class. It's crucial not to let questions accumulate.

---

## 🎯 Assignment 🎯

In pairs, you are expected to do a deep dive on the case by reading the following sources:  
  - **Student 1:** should read in detail the  [CSO Online](https://www.csoonline.com/article/567833/equifax-data-breach-faq-what-happened-who-was-affected-what-was-the-impact.html) article.  
  - **Student 2:** should read in detail the archived artile from the [EPIC report](https://archive.epic.org/privacy/data-breach/equifax/)  
  - You are **both** encouraged to explore any hyperlinks within both articles and take notes pertaining to the discussion questions below.

**Discussion Questions**

1. What was the Apache Struts CVE-2017-5638 vulnerability and its associated patch?

1. Discuss how the Equifax breach violated the principle of **confidentiality**.

1. what was the impact of the breach on Equifax's data **integrity** and service **availability**?

1. Evaluate Equifax's response strategy in terms of information security best practices.

**Assignment Details and Submission**

The assignment should be submitted on [Canvas](https://miamioh.instructure.com/courses/229048/assignments/3056659). See the assignment submission page for more details.

]