331 - Network and Web Security - 2027
Table of Contents
A.k.a 60015 or 70082, but just "331" for short.
Announcements
- The 2027 edition of the course starts on January 15 at 4pm in HXLY 308.
Resources
- Reference books (electronic edition available via central library):
- Threat modelling – Designing for security (Shostack)
- Professional Penetration Testing (Wilhelm)
- The tangled web (Zalewski)
- The Web Application Hacker's Handbook (Stuttard, Pinto)
- Recommended books
- Computer Networking - A Top-Down Approach (Kurose, Ross)
- SSL and TLS: Theory and Practice (Oppliger)
- Vulnerabilities
- CWE/SANS Top 25 Most Dangerous Software Errors.
- OWASP Top 10 list of the most critical web application security flaws.
- Search the CVE Vulnerability Database.
- Search the exploit-db database.
- Hacker One reward program for internet vulnerability disclosures.
- Full Disclosure mailing list.
- Black Hat and DEF CON hacking conferences.
- General
- A short dictionary of cybersecurity terms: Sophos' Threatsaurus.
- The Elevation of Privilege card game.
- w3schools tutorials
- Tails: live os with state-of-the-art privacy protection (including Tor browser).
- MITRE ATT&CK: a knowledge base of adversary tacticts and techniques.
- Practice hacking
- Kali Linux distribution for pentesting.
- OWASP Broken Web Applications Project
- Exploit exercises
- PentesterLab Bootcamp
- VMs recommended by students
- Sources for web-related standards:
- Blogs and news:
People
Lecturer
Sergio Maffeis. Sergio is an associate professor in Computer Security at Imperial, where he leads the Security and Machine Learning Lab. He received his PhD from Imperial and his MSc from University of Pisa, Italy. Maffeis' research interests include security, machine learning, formal methods, and programming languages. You can find out more from his home page.
Teaching Assistants
Adbdullah Adlaihan.
Abdullah is a PhD student at Imperial under the supervision of Dr. Maffeis. He received his MSc in computer science from Georgia Institute of Technology, and his BSc in computer science from King Saud University. Abdullah's focus is on utilizing Large Language Models (LLMs) for systems security.
Adam Jones.
Adam is a PhD student at Imperial under the supervision of Dr. Maffeis and Dr. Zizzo. He received his MEng from Imperial in Computer Science. Adam's research is focused on the security of foundation models that generate code, in particular researching attacks and defenses in the domains of model poisoning and prompt injection.
Archie Licudi.
Archie is a PhD student at Imperial under the supervision of Dr. Maffeis.
They received their Joint Mathematics and Computing MEng from Imperial and have worked at Oxford as a research assistant in federated learning for healthcare. Archie’s research is now focused on applications of concepts from algebra, pattern theory, and formal methods to the design of reliable machine learning systems for cybersecurity.
Kevin Peng.
Kevin is a PhD student at Imperial under the supervision of Dr. Maffeis. He received his MEng in Electronic and Information Engineering from Imperial. Yunan’s research is focused on cyberattack prediction, specifically combining contextual-awareness techniques and generative models.
Xin Fan Guo.
Xin Fan is a PhD student in the Safe and Trusted AI CDT, a joint program between King’s College London and Imperial, supervised by Dr. Pierazzi and Dr. Maffeis. She holds a BSc in Computer Science from King’s College London. Her research focuses on applying symbolic AI to enhance network security.