Computer Security: Course Resources

Selected Classic Papers

• Butler Lampson. Computer Security in the Real World.
• Bill Cheswick. An Evening with Berferd.

Books

There is no single book that covers the same topics precisely as in the course. Gollmann provides a good (but sometimes brief) overview. Anderson gives more detail (in places) and is much broader, considering whole-system and non-software aspects of security.

• Dieter Gollmann. Computer Security, 3rd Edition.
  
• Ross Anderson. Security Engineering, 2nd Edition.
• Nigel Smart Cryptography: An introduction. Free online 3rd edition.
• Matt Bishop Computer Security: Art and Science.
• Bruce Schneier Applied Cryptography.
• Menezes, van Oorschot and Vanstone. The Handbook of Applied Cryptography (online).
• Cheswick and Bellovin. Firewalls and Internet Security: Repelling the Wily Hacker (1st edition online).
• McGraw and Felten. Securing Java (online).
• Publishers: O'Reilly; CRC press. Prentice Hall; Wiley.

Reference

• The ISO Common Criteria for IT Security Evaluation. Local copy (Version 3.2 rev 1/2, September 2007): Part 1, Part 2, and Part 3.
• The ISO/IEC 17799 standard (2002):
  Part 1, Code of Practice for Information Security Management and
  Part 2, Specification of Information Security Management Systems.
• FIPS US Federal standards (relevant FIPS: nos 46, 180, 186, and 197). See more US standards at NIST.
• Internet standards: see the Internet Engineering Taskforce.
• SANS and CWE/SANS Top 25 most dangerous software errors.

Software

• GPG (GNU version of PGP) docs: Privacy Handbook, MiniHowto, FAQ
  The OpenPGP standard is in RFC 2440.
• Open SSH, Tectia (formerly SSH.com)
• OpenVPN

Web and Media

• Information Security Magazine
• Bruce Schneier's homepage, hosting his monthly CRYPTO-GRAM newsletter/column.
  (Shortcuts to recent CRYPTO-GRAMs: Nov 05, Dec 05 )
• Freedom to tinker, Ed Felten's weblog.
• Page aboout attacks on steganography
• CERT/CC: security advisories, incident tracking, reports.
• SANS: alerts, certification.
• Security Focus. A solutions company, also news, articles and mailing lists including Bugtraq.
• OS security: Linux security and Secure programming HOWTO.
• The WWW Security FAQ
• News at Slashdot (security, privacy); The Register (security, malware); Wired security politics, ZDnet security blog.

Research

• Security: the Journal of Computer Security, ACM TISSEC, IEEE CSF.
• Crypto: IACR and its e-print archive.
• Sys admin: USENIX.
• Research groups (random selection): MIT; Cambridge; Microsoft security, Microsoft crypto; Purdue.

Note

These are just a few pointers to get you started, not a complete guide to the subject online. The links are subject to rot, if you find a broken one please tell me its replacement. If you think something really vital should be included, please let me know.