6.857 Network and Computer Security - Fall 2002


This document lists several sources for network and computer security research.

Security books

We give a brief comment about the content of each book. For the serious student, we have starred the books which are most relevant. The starred books are also on reserve in the Barker Engineering Library. You may send us suggestions if you find a security book you find useful.

*Alfred Menezes, Paul van Oorschot, Scott Vanstone. Handbook of Applied Cryptography. CRC Press. 1997.
This is a very comprehensive book. The best part is that you can download this book online! The hardcopy is very convenient though.
*Bruce Schneier. Applied Cryptography, 2nd Edition. John Wiley & Sons. 1996.
This is the best book to read for an introduction to applied security and cryptography. There is much less math than the book by Menezes et al. Sometimes statements are made without much justification, but no other book even compares to this comprehensive introduction to cryptography. The bibliography alone is worth buying the book.
*Ross Anderson. Security Engineering. John Wiley & Sons. 2001.
An excellent book on security in real world systems.
Douglas Stinson. Cryptography Theory and Practice. CRC Press. 1995
This used to be required for 6.875, the theory of cryptography class at MIT.
Bruce Schneier. Secrets and Lies.
Schneier used to advocate good cryptography as the solution to security problems. He has since changed his mind. Now he talks about risk management and cost-benefit analysis.
Eric Rescorla. SSL and TLS: Designing and Building Secure Systems. Addison-Wesley. 2001.
The only book you need to read to learn about the evolution, politics, and bugs in the development of SSL. Eric's a swell guy too; buy his book.
Peter Neumann. Computer Related Risks. Addison-Wesley. 1995.
Power grid failures. Train collisions. Primary and backup power lines blowing up simultaneously. These events aren't supposed to happen! Neumann offers a plethora of stories about the risks and consequences of technology, gathered from his Risks mailing list. On a side note, Neumann is also responsible for coming up with the pun/name, "Unix."
Jakob Nielsen. Usability Engineering. Academic Press. 1993.
There are a lot of non-intuitive GUIs out there for security products. Anyone making a security product for use by humans should learn about principles of smart GUIs.
Charlie Kaufman, Radia Perlman, Mike Speciner. Network Security: Private Communication in a Public World, 2nd Edition. Prentice Hall. 2002.
The authors discuss network security from a very applied approach. There is a lot of discussion about real systems, all the way down to the IETF RFCs and the on-the-wire bit representations. The authors also have a fun, informal style.
Simson Garfinkel, Gene Spafford. Web Security, Privacy & Commerce. O'Reilly. 2002.
It's hard to keep up with all the security software out there. But these authors do a good job documenting it all. After many years in the real world, Garfinkel recently joined the MIT Lab for Computer Science as a graduate student.
Kahn. The Codebreakers

Security Conferences


Most of the reading material in 6.857 comes from conferences on computer and network security. Here is a list of the papers we hope to discuss; we won't have time for everything. Send us a note if you see a paper that greatly interests you.


6.857 home // Last updated (GMT) $Date: 2002/11/04 17:56:41 $ by $Author: fubob $