Course Schedule Fall 2026
This schedule is subject to change. Please check back frequently.
Part 1. Security Fundamentals
| Monday | Wednesday | Friday |
|---|---|---|
|
Aug. 21 The security mindset Welcome, Threat models, how to think like an attacker and a defender, ethics |
Aug. 24 Crypto Basics Alice and Bob, hashes, HMACs, Length extension attacks |
Aug. 26 Crypto Basics Generating randomness, PRGs Homework 1 available |
Aug. 28 Confidentiality One-time pad, ciphers from hashes/MACs |
Aug. 31 Confidentiality AES, Block ciphers, modes and padding oracle attacks |
Sep. 2 Key exchange Diffie-Hellman key exchange, man-in-the-middle attacks |
Sep. 4 Public-key crypto RSA encryption, digital signatures, secret sharing |
Sep. 7 Labor Day; No class |
Sep. 9 Public-key crypto RSA attacks, drawbacks, and fixes |
Sep. 11 Modern public-key crypto Elliptic curve, Post-quantum cryptography Homework 1 due 11:59pm
|
Part 2. Web and Network Security
| Monday | Wednesday | Friday |
|---|---|---|
|
Sep. 14 Web Basics Crash course in HTML, CSS, and Javascript |
Sep. 16 Web Basics AJAX, Cookies, and threats |
Sep. 18 Web Basics Same origin policy Crypto Project due 11:59pm
|
Sep. 21 Web Attacks Client attacks and defenses: Cross site scripting (XSS) |
Sep. 23 Web Attacks Cross site scripting and request foregery (XSS & CSRF) |
Sep. 25 Web Attacks Server attacks and defenses: SQL / shell injection |
Sep. 28 HTTPS and TLS The TLS protocol |
Sep. 30 QUIC Modern cryptographic protocol |
Oct. 2 Public Key Infrastructure Certificates, Authorities (CAs), and Transparency (CT) |
Oct. 5 TLS' Greatest Hits Attacks on TLS: Null Prefix, BEAST, CRIME, POODLE, Heartbleed, Logjam, FREAK, DROWN |
Oct. 7 TLS Greatest Hits, continued Null Prefix, BEAST, CRIME, POODLE, Heartbleed, Logjam, FREAK, DROWN |
Oct. 9 Networking Basics How the Internet works, packets, network monitoring Homework 2 due 11:59pm
|
Oct. 12 Networking Basics Routing, BGP, and threats |
Oct. 14 Network attacks and defenses ARP/IP spoofing, Network tools, DNS poisoning Web Project due 11:59pm
|
Oct. 16 Midterm exam In class, covering Crypto & Web projects |
Part 3. Host and Application Security
| Monday | Wednesday | Friday |
|---|---|---|
|
Oct. 19 Control hijacking Software architecture in x86: the stack, and return addresses |
Oct. 21 Control hijacking Simple buffer overflow |
Oct. 23 Control hijacking Common exploitable application bugs, shellcode Homework 3 due 11:59pm
|
Oct. 26 Control hijacking Defenses: canaries, ASLR, DEP |
Oct. 28 Control hijacking, Part AAAAAAAAAAAAAAAAAAAAAA |
Oct. 30 Computer architecture Security Meltdown & Spectre, Rowhammer attacks Networking Project due 11:59pm
|
Part 4. Security in Context
| Monday | Wednesday | Friday |
|---|---|---|
|
Nov. 2 Voting Risks, audits, and public policy |
Nov. 4 Cryptocurrency Bitcoin, blockchains, and friends |
Nov. 6 Cryptocurrency Ethereum |
Nov. 9 Machine Learning Crash course on gradient descent |
Nov. 11 Machine Learning Adversarial examples |
Nov. 13 Machine Learning ML in Python AppSec Project due 11:59pm
|
Nov. 16 'Smart' contracts Programming Ethereum and vulnerabilities |
Nov. 18 Online Privacy Online tracking, threats from “big data”, targeted snooping, differential privacy |
Nov. 20 Anonymity Tor, hidden services, attacks and defenses Homework 4 due 11:59pm
|
Nov. 23 Fall break |
Nov. 25 Fall break |
Nov. 27 Fall break |
Nov. 30 Internet censorship, Professor AMA Censors, circumvention, research Q&A |
Dec. 2 Physical security Locks and safes, lock picking techniques; defenses Homework 5 due 11:59pm
|
Dec. 4 Final exam review ML Project due 11:59pm
|
