Federated learning (FL) has been widely investigated in academic and industrial fields to resolve the issue of data isolation in the distributed Internet of Things (IoT) while maintaining privacy. However, challenges persist in ensuring adequate privacy and security during the aggregation process. In this paper, we investigate device scheduling strategies that ensure the security and privacy of wireless FL. Specifically, we measure the privacy leakage of user data using differential privacy (DP) and assess the security level of the system through mean square error security (MSE-security). We commence by deriving analytical results that reveal the impact of device scheduling on privacy and security protection, as well as on the learning process. Drawing from these analytical findings, we propose three scheduling policies that can achieve secure aggregation of wireless FL under different cases of channel noise. In particular, we formulate an integer nonlinear fractional programming problem to improve the learning perfor- mance while guaranteeing privacy and security of wireless FL. We provide an insightful solution in the closed form to the optimization problem when the model has a high dimension. For the general case, we propose a secure and private aggregation (SPA) algorithm based on the branch-and- bound (BnB) method, which can obtain the optimal solution with low complexity. The effectiveness of the proposed schemes for device selection is validated through simulations.