Software Security

COMP63342 Software Security 15 Semester 2 Postgraduate Taught Level 6 Lucas Cordeiro Unit coordinator Department of Computer Science 1 FHEQ level (Framework for Higher Education Qualifications) ' Masters/Integrated Masters P4 ' European Credit Transfer & Accumulation System Rating : 7.5 Software is subject to numerous forms of attack such as memory corruption, buffer overflows and injection; these flaws are often too complex or expressive to be manually detected by the software developer. Techniques and tools exist to prevent and detect software flaws, which are typically too hard to be manually found, e.g., modelling, code reviews, fuzzing, static and dynamic code analyses, program verification and code tainting.This course unit introduces students to basic and advanced approaches to formally build verified trustworthy software systems, where trustworthy comprise five attributes: reliability, availability, safety, resilience and security. Software is subject to numerous forms of attack such as memory corruption, buffer overflows and injection; these flaws are often too complex or expressive to be manually detected by the software developer. Techniques and tools exist to prevent and detect software flaws, which are typically too hard to be manually found, e.g., modelling, code reviews, fuzzing, static and dynamic code analyses, program verification and code tainting.This course unit introduces students to basic and advanced approaches to formally build verified trustworthy software systems, where trustworthy comprise five attributes: reliability, availability, safety, resilience and security. This course unit aims to familiarise students with basic and advanced approaches to formally building verified, trustworthy software systems. The course unit introduces methods, techniques, algorithms, and tools to prevent and detect software flaws that are typically too hard to find manually, such as modeling, code reviews, fuzzing, static and dynamic code analyses, program verification, and code tainting.Software is subject to numerous forms of attack such as memory corruption, buffer overflows and injection; these flaws are often too complex or expressive to be manually detected by the software developer. Techniques and tools exist to prevent and detect software flaws, which are typically too hard to be manually found, e.g., modelling, code reviews, fuzzing, static and dynamic code analyses, program verification and code tainting.This course unit introduces students to basic and advanced approaches to formally build verified trustworthy software systems, where trustworthy comprise five attributes: reliability, availability, safety, resilience and security. ILO 1: Apply risk management frameworks in broader contexts, including organisational processes, decision-making, stakeholder communication, and the systematic integration of security considerations into complex systems.ILO 2: Analyse and compare security properties to identify their relevance in specific development phases.ILO 3: Explain the foundational role of software vulnerabilities in cyber-attacks, analyse their impact on security, and apply key principles such as confidentiality, integrity, and availability to secure software development.ILO 4: Apply risk management processes and tools to identify, assess, and mitigate security risks throughout the software development lifecycle.ILO 5: Utilise industry-standard tools and frameworks, such as static and dynamic verification, to identify and mitigate security issues and simulate potential attack vectors in real-world scenarios to analyse their impact and improve software defences. Part I: Software Security Fundamentals<ul><li>Defining a Discipline</li><li>A Risk Management Framework</li><li>Vulnerability Assessment and Management</li><li>Overview on Traffic, Vulnerability and Malware Analysis</li></ul> Part II: Software Security<ul><li>Code Inspection for Finding Security Vulnerabilities and Exposures (ref: Mitre’s CVE)</li><li>Architectural Risk Analysis</li><li>Penetration Testing, Concolic Testing, Fuzzing, Automated Test Generation</li><li>Model Checking, Abstract Interpretation, Symbolic Execution</li><li>Risk-Based Security Testing and Verification</li><li>Software Security Meets Security Operations</li></ul> Part III: Software Security Grows Up<ul><li>Withstanding adversarial tactics and techniques defined in Mitre’s ATT&CK™ knowledge base</li><li>An Enterprise Software Security Program</li></ul> <ul> <li> Lectures</li> <li> Workshops</li> <li> Tutorials</li> <li> Labs/Practicals</li></ul>  1 Written exam 50% 2 Written assignment (inc essay) 50% <ul> <li> Lectures</li> <li> Workshops</li> <li> Tutorials</li> <li> Labs/Practicals</li></ul> <p style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Ubuntu, "Helvetica Neue", Helvetica, sans-serif; line-height: 1.5; text-size-adjust: 100%; font-size: 16px; margin: var(--universal-margin); color: rgb(17, 17, 17);">Fundamental programming skills, including familiarity with C and Python 3. In more detail:<ul> <li> For C, the student should at least know how pointers and dynamic memories work.</li> <li> For Python, the student should know how to develop basic algorithms/data structures and interact with the host system.</li></ul><p style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Ubuntu, "Helvetica Neue", Helvetica, sans-serif; line-height: 1.5; text-size-adjust: 100%; font-size: 16px; margin: var(--universal-margin); color: rgb(17, 17, 17);">Basic notions in Linux System Administration:<ul> <li> Create a web server.</li> <li> Understand the difference between user space and kernel space.</li></ul><p style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Ubuntu, "Helvetica Neue", Helvetica, sans-serif; line-height: 1.5; text-size-adjust: 100%; font-size: 16px; margin: var(--universal-margin); color: rgb(17, 17, 17);">Some interest/knowledge of logic and modelling:<ul> <li> Understand propositional and first-order logic.</li> <li> Understand linear-time temporal logic.  </li></ul> MSc Adv Computer Science MSc Adv Computer Science PGDT Taught Component Optional MSc Adv Computer Science MSc Artificial Intelligence PGDT Taught Component Optional MSc Adv Computer Science Computer Security PGDT Taught Component Mandatory MSc Adv Computer Science Data and Knowledge Management PGDT Taught Component Optional MSc Adv Computer Science Digital Biology PGDT Taught Component Optional N Software Security: Building Security In    Gary McGraw    Addison Wesley    2006    ISBN: <a href="https://www.librarysearch.manchester.ac.uk/discovery/search?query=isbn,contains,9780321356703&search_scope=MyInst_and_CI&sortby=rank&vid=44MAN_INST:MU_NUI&lang=en&mode=advanced&offset=0" target="_blank">9780321356703</a>The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities     Mark Dowd, John McDonald, Justin Schuh    Addison-Wesley —     ISBN: <a href="https://www.librarysearch.manchester.ac.uk/discovery/search?query=isbn,contains,0321444426&search_scope=MyInst_and_CI&sortby=rank&vid=44MAN_INST:MU_NUI&lang=en&mode=advanced&offset=0" target="_blank">0321444426</a> The art of software testing     Myers, Glenford J.,    John Wiley & Sons    2012    ISBN: <a href="https://www.librarysearch.manchester.ac.uk/discovery/search?query=isbn,contains,9781118133132&search_scope=MyInst_and_CI&sortby=rank&vid=44MAN_INST:MU_NUI&lang=en&mode=advanced&offset=0" target="_blank">9781118133132</a> Model checking     Clarke, E. M.    MIT Press    1999    ISBN: <a href="https://www.librarysearch.manchester.ac.uk/discovery/search?query=isbn,contains,0262032708&search_scope=MyInst_and_CI&sortby=rank&vid=44MAN_INST:MU_NUI&lang=en&mode=advanced&offset=0" target="_blank">0262032708</a> Model Checking    Edmund M. Clarke Jr. et al    MIT presss    2018    ISBN: <a href="https://www.librarysearch.manchester.ac.uk/discovery/search?query=isbn,contains,9780262038836&search_scope=MyInst_and_CI&sortby=rank&vid=44MAN_INST:MU_NUI&lang=en&mode=advanced&offset=0" target="_blank">9780262038836</a> Assessment written exam 2 Lectures 20 Practical classes & workshops 20 0 108