Given the wealth of information online about security, we will not have a textbook for this class. Our readings will come from a combination of papers, blogs, tutorials, and other online sources.
That said, there are some excellent reference books out there. I particularly like Ross Anderson's Security Engineering (first edition available online). For web security, check out Dafydd Studdard and Marcus Pinto's Web Application Hacker's Handbook. OWASP's WebGoat project offers self-guided lessons on web application security. In general, OWASP has a host of useful summaries on attacking, finding, and preventing web application vulnerabilities.
Highlighted readings should be done before class. Other readings provide additional information that might help with assignments or for those interested in the topic.
Aug 26: Course Overview
Aug 27: SQL Injection
Readings:
Aug 30: Cross-Site Scripting
Readings:
Sept 2: Clickjacking
Readings:
Sept 3: Session Management
Readings:
Sept 6-7: Authentication and Identity
Readings:
Sept 10: Capabilities
Readings:
Sept 13: Threat Modelling
Readings:
Sept 14: Case Study Presentations
Sept 16-17: Usability
Readings:
Sept 20-21: Case Study Presentations
Sept 23: Cryptography
Readings:
Sept 24: Protocol Analysis (Professor Guttman Guest Lecture)
Sept 27-28: Case Study Presentations
Sept 30: Attacking C Code
Readings:
October 4, 5, 7: Case Study Presentations
October 8: Security in the Cloud
Readings:
October 11: Network Security (Guest Lecture, Phil Deneault, WPI NetOps)
October 12: Security Models
Readings:
October 14: Course Feedback Discussion; Course Evals