If you somehow cannot register for the course (yet), send me an email, so that I can make sure email announcements via Brightspace reach you!Prerequisites
This course addresses two questions:
Common security problems include buffer overflows, integer overflows, injection attacks (such as command injection or SQL injection), XSS and other web-specific attacks, deserialisation attacks, and race conditions. Techniques to prevent or detect problems include threat modeling, checklists and coding standards, code reviews, "safe" programming languages, LangSec (language-theoretic security), fuzzing and other forms of security testing, static analysis tools and source code analyzers, information flow analysis (incl. tainting), program verification, and proof-carrying code.
The focus of this course is not on pen(etration)-testing or hacking to find vulnerabilities, as in the bachelor courses `Hacking in C' and `Web Security', but more on underlying causes and general techniques to improve the security of software.Lectures & obligatory reading material
Lectures: Fridays 15:30-17:15 in HG00.304 in Q1 and HG00.303 in Q2 (i.e. starting November).
NB the description below will be updated as we go along, with slides and pointers to papers. The obligatory reading material and exam material for the course includes (i) the slides, (ii) the papers and (iii) the course lecture notes, which covers material presented in some of the lectures.
|1st individual project: PREfast. Deadline: Oct 4|
|Thursday evening Sept 27, not part of this course but highly relevant: OWASP NL Chapter meeting in Nijmegen|
|Group project: Deadlines: Nov 14 (inventory on tool feedback), Dec 19 (xls for evalution), January for the PDF report.|
|Oct 26 & Nov 2: no lectures (midterm break)|
|2nd individual project (6EC version only). Deadline: Dec 11|
|Tue Dec 4
|Jan 16||Exam - 13:00-16:00 in HAL 2 (in sports complex, the Gymnasion)|| The exam is closed book, and covers the material treated in class
(and in the slides), the course lecture notes, the papers listed above, and the projects.
Some hints on what to expect for the exam
The course will be graded based on a written exam and project work: two smaller individual projects (C++ code analysis with PREfast, and program verification with ESC/Java) and a bigger group project looking at a web application.
You MUST seriously participate in the project work to take the exam, and do all individual exercises. Final grade will be based on the exam (50%) and results on the projects (where project grades are weighed: 5% PREfast, 40% group project, 5% ESC), but you will have to pass the exam to pass the course. Should it ever happen that anyone fails the course because of low grades for the individual exercises (which has never happened) we will arrange an ad-hoc solution to redo these.
If you are completely new to things like SQL injection, XSS, etc., it is useful to look through The 24 Deadly Sins of Software Security. There is a copy of this book in the library of the Faculty of Science. You can't take it out, but you can always read it there. More information on typical security issues can be found in the OWASP TOp 10 and CWE/SANS Top 25 Most Dangerous Programming Errors.