Tentative Syllabus (some dates will change)

Unless explicitly marked as Optional, all readings are considered required.

Date	Topic
Sept 24	Introduction
Sept 29	Class cancelled
Oct 1	Threat Modeling and Risk Read by today: Thompson, Reflections on Trusting Trust
Oct 6	Software Security I: Buffer Overflows Read by today: Aleph One, Smashing the Stack for Fun and Profit. Optional: Richard Bonichon's Basic exploitation techniques slides
Oct 8	Software Security II: Format strings and Integers Read by today: van der Veen et al, Memory Errors: The Past, the Present, and the Future Optional: sploitfun, Understanding glibc malloc. Also, Cong Wang's explanation for how the unlink macro works and can be abused in (we are working with old glibc per his terminology)
Oct 13	Software Security III: Defenses and evolution Read by today: Erlingsson et al, Low-level Software Security by Example Optional: Szekeres et al, Eternal War in Memory
Oct 15	Software Security IV: ROP and CFI Optional: Shacham, The Geometry of Innocent Flesh on the Bone and Abadi et al, Control Flow Integrity.
Oct 20	System security I: Isolation and Privilege Jaeger, Security in Ordinary Operating Systems
Oct 22	System security II: Side channels (also slides excerpted from Schwarz and Lipp) Anderson, Security Engineering, Chap 19, Side Channels
Oct 27	Web Security I Deian Stefan's lecture notes on CSRF, XSS and SQLi, SQL injection
Oct 29	Midterm. Some sample questions here.
Nov 3	Web Security II
Nov 5	Web Security III
Nov 10	Network Security I
Nov 12	Network Security II
Nov 17	Network Security III
Nov 19	Crypto I Security Engineering, Chapter 5
Nov 24	Crypto II: Key distribution
Nov 26	Class cancelled: Thanksgiving holiday
Dec 1	User Authentication
Dec 3	Malware and Botnets
Dec 3	Cybercrime
Dec 9	Class final: 11:30-1:30 Center 109. Some sample questions here.