These are wonderful notes and prof. Avi Kak deserves many thanks for
sharing them. I'm adding them to my huge and ever growing collection
of comp.sec, sec.eng and crypto notes for comparison and examples.<p>Notably they go back to 2006 and have been lovingly updated. That
tends to yield notes that are carefully checked and refined through
countless lectures and practical sessions.<p>They integrate well into my own because I also get students doing
exercises with simple Python and Perl (great to see it still being a
workhorse for this sort of thing), along with copious command line
examples, always hexdumping and diffing things to to check results
etc. So I like his (her?) style.<p>In response to sibling comments.<p>@sunhester<p>> In my experience "higher education facilities" are a nightmare of
social extremes that inhibit the growth of "cyber security". But I'm
usually wrong.<p>You are not wrong. Absolutely YES. That's why I got out of university
teaching and moved into private work. Maybe some forceful and well
connected people can still teach at places like Purdue, Stanford, MIT,
but generally, and especially in the UK, universities have become a
suffocating bureaucratic hellhole in which teaching, learning and
research is no longer possible. They bring in completely inappropriate
corporate CISO's who do not understand the tradeoffs and culture of
the academy. They do not listen and they do not care so long as
everyone uses the lowest common denominator of feculent Microsoft
insecure rubbish. I eventually grew tired of spending all my energy
fighting people whose job is to labour against my principles, sabotage
all my efforts [0], undermine my students [1], and ask me to teach
some people that frankly just felt morally wrong and a threat to
national security [2].<p>@waihtis<p>> Nothing about cloud, AD, limited discourse about vulnerabilities
which dominate (at least) the enterprise security space.<p>This is really a separate layer that falls more under "security
management", "operational security" and "security systems engineering"
and so on. We normally do this after the foundation. The thing with
"enterprise" level is that it's a quite fluid set of practices,
regulations, compliance docs and products that come in and out of
fashion.<p>Anyway, as for maintaining quality, theoretical depth, and hands-on
practice I am pleased to see a few profs are still "getting away with
it".<p>[0] <a href="https://techwrongs.org/o/2021/11/29/teaching-cybersecurity/" rel="nofollow">https://techwrongs.org/o/2021/11/29/teaching-cybersecurity/</a><p>[1] <a href="https://www.timeshighereducation.com/features/we-cant-teach-technological-dystopia" rel="nofollow">https://www.timeshighereducation.com/features/we-cant-teach-...</a><p>[2] <a href="https://www.timeshighereducation.com/opinion/should-i-be-worried-about-where-my-cybersecurity-students-will-end" rel="nofollow">https://www.timeshighereducation.com/opinion/should-i-be-wor...</a>