Course details
Secure Coding
SCO Acad. year 2024/2025 Winter semester 5 credits
This course introduces the principles and practices of secure coding. Secure coding means writing programs in a secure manner to avoid vulnerabilities that can be exploited by attackers. It also means making appropriate and effective use of security features provided by libraries, such as authentication and encryption. A range of programming platforms will be considered, from low-level programming (e.g. Android OS), to web programming (e.g. JavaScript and Python), to large-scale high-level languages (e.g. Java). New and emerging language security mechanisms will be explored, including methods for static and dynamic analysis.
Why is the course taught
Today, it is a growing problem that, thanks to imperfections in application code, an attacker can gain access to valuable data stored on a computer, or gain control of the computer altogether. The goal of this course is to both show how such a situation can occur completely unintentionally and to demonstrate how code can be written to prevent such attacks.
Exam prerequisites
Earning at least one point from each project and earning at least 10 points during the semester. Any form of plagiarism or non-independent work will result in no credit being awarded. Credit is awarded by the instructor.
Guarantor
Course coordinator
Language of instruction
Completion
Time span
- 26 hrs lectures
- 26 hrs projects
Assessment points
- 55 pts final exam (written part)
- 45 pts projects
Department
Lecturer
Kolář Dušan, doc. Dr. Ing. (DIFS)
Malinka Kamil, Mgr., Ph.D. (DITS)
Instructor
Learning objectives
The aim of the course is to introduce students to the basic principles of secure programming and to explain the general principles of vulnerabilities and defenses against them. To ensure that applications are correctly designed and implemented to meet security requirements, secure coding practices must be incorporated as a normal part of all phases of the software development process. A key step is to educate developers so that they know the essential basic principles of secure coding and can apply them, regardless of the environment in which they work.
Students will learn the general principles and practices of writing programs securely.
Study literature
- Fred Long et al. The Oracle/CERT Secure Coding Standard for Java, Addison-Wesley, 2011. Available online at http://www.cert.org/secure-coding/
- The OWASP web application security project: https://www.owasp.org/
- Mitigating the Risk of Software Vulnerabilities by Adopting a Secure Software Development Framework (SSDF), https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04232020.pdf
- Michael Howard, David LeBlanc: Writing Secure Code, Microsoft Press, Second Edition, ISBN-13: 978-0735617223
- John Viega, Matt Messier: Secure Programming Cookbook for C and C++, 2003, O'Reilly Media, Inc., ISBN: 9780596003944
- Michael Howard, Steve Lipner: The Security Development Lifecycle, 2006, Microsoft Press, ISBN: 0735622140
- Ross Anderson: Security Engineering: A Guide to Building Dependable Distributed Systems, 3rd Edition, ISBN: 978-1-119-64281-7
Syllabus of lectures
- Introduction, recapitulation of concepts (robust code, secure code, self-protecting code, reentrant code, intermediate code, binary code, binary code for VMs, OS role, VM role, ...).
- Attacker targets, sandbox escape, privilege elevation, path from vulnerability to exploit, CVE.
- Basic vulnerabilities of compiled languages - buffer overflow, strings, integer overflow.
- Memory protection mechanisms, stack protection, return oriented programming, ASLR. Basic vulnerabilities of interpreted languages - memory handling, use after free.
- Usable security and the impact of UX on system security. Protocol implementation security, IoT, API security.
- Input validation, testing, fuzzing.
- Static and dynamic analysis.
- Standards for secure coding, OWASP, SSDF.
- Secure random number generation.
- Seminar - Attack on javascript and how to defend against it.
- Seminar - Attack on Java and how to defend against it.
- Seminar - Attack on binary executable and how to defend against it.
- Seminar - Demonstration of interesting projects, solutions.
Syllabus - others, projects and individual work of students
Individual projects solved independently by each student without any further collaboration.
Progress assessment
Scoring of the results of the developed projects.
Interim control and evaluation of projects, final exam. In order to obtain points from the exam, the exam must be prepared in such a way that it is evaluated with more than 20 points. Otherwise, the exam will be scored 0 points.
Schedule
| Day | Type | Weeks | Room | Start | End | Capacity | Lect.grp | Groups | Info |
|---|---|---|---|---|---|---|---|---|---|
| Mon | lecture | 1., 6., 8., 13. of lectures | G202 | 09:00 | 10:50 | 80 | 1MIT 2MIT | xx | Kolář |
| Mon | lecture | 2., 3., 4., 9. of lectures | G202 | 09:00 | 10:50 | 80 | 1MIT 2MIT | xx | Hanáček |
| Mon | lecture | 5., 10., 11., 12. of lectures | G202 | 09:00 | 10:50 | 80 | 1MIT 2MIT | xx | Malinka |
| Tue | exam | 2025-01-07 | E112 | 16:00 | 17:50 | 1. termín | |||
| Wed | exam | 2025-01-29 | E112 | 12:00 | 13:50 | 3. termín | |||
| Thu | lecture | 2024-10-17 | D0206 | 12:00 | 13:50 | 80 | 1MIT 2MIT | xx | Malinka |
| Fri | exam | 2025-01-17 | A112 | 14:00 | 15:50 | 2. termín |
Course inclusion in study plans