Given the wealth of information online about security, we will not have a textbook for this class. Our readings will come from a combination of papers, blogs, tutorials, and other online sources.
That said, there are some excellent reference books out there. I particularly like Ross Anderson's Security Engineering (first edition available online). For web security, check out Dafydd Studdard and Marcus Pinto's Web Application Hacker's Handbook. OWASP's WebGoat project offers self-guided lessons on web application security. In general, OWASP has a host of useful summaries on attacking, finding, and preventing web application vulnerabilities.
Highlighted readings should be done before class. Other readings provide additional information that might help with assignments or for those interested in the topic.
Oct 27: Course Overview
Oct 29: SQL Injection
Readings:
Oct 30: Cross-Site Scripting
Readings:
November 3: Clickjacking
Readings:
November 5: Session Management
Readings:
November 6: Authentication and Identity
Readings:
November 9: Access Control
Readings:
November 12: Attacking C Code
Readings:
November 16-23: Case Study Presentations
November 24: Threat Modelling
Readings:
November 30: Cryptography
Readings:
December 1: Protocol Analysis (Professor Guttman Guest Lecture)
December 3-4: Usability
Readings:
December 7-10: Case Study Presentations
December 11: Security in the Cloud
Readings:
December 14: Network Security (Guest Lecture, Phil Deneault, WPI NetOps)
December 15: Security Models
Readings:
December 17: Course Feedback Discussion; Course Evals