Software Security

COMP43342 Software Security 15 Semester 2 Undergraduate Level 4 Lucas Cordeiro Unit coordinator 1 FHEQ level (Framework for Higher Education Qualifications) ' Masters/Integrated Masters P4 ' European Credit Transfer & Accumulation System Rating : 7.5 Software is subject to numerous forms of attack such as memory corruption, buffer overflows and injection; these flaws are often too complex or expressive to be manually detected by the software developer. Techniques and tools exist to prevent and detect software flaws, which are typically too hard to be manually found, e.g., modelling, code reviews, fuzzing, static and dynamic code analyses, program verification and code tainting.This course unit introduces students to basic and advanced approaches to formally build verified trustworthy software systems, where trustworthy comprise five attributes: reliability, availability, safety, resilience and security. Software is subject to numerous forms of attack such as memory corruption, buffer overflows and injection; these flaws are often too complex or expressive to be manually detected by the software developer. Techniques and tools exist to prevent and detect software flaws, which are typically too hard to be manually found, e.g., modelling, code reviews, fuzzing, static and dynamic code analyses, program verification and code tainting.This course unit introduces students to basic and advanced approaches to formally build verified trustworthy software systems, where trustworthy comprise five attributes: reliability, availability, safety, resilience and security. On successful completion of this course unit, a student will be able to<ul> <li> Explain computer security problem and why broken software lies at its heart.</li> <li> Explain continuous risk management and how to put it into practice to ensure software security.</li> <li> Introduce security properties into the software development lifecycle.</li> <li> Use software validation and verification techniques to detect software vulnerabilities and mitigate against them.</li> <li> Relate security testing and verification to risk analysis to address continued resilience when a cyber-attack takes place.</li> <li> Develop case studies to think as an attacker and mitigate them using software verification and testing.</li></ul><p style="font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Ubuntu, "Helvetica Neue", Helvetica, sans-serif; line-height: 1.5; text-size-adjust: 100%; font-size: 16px; margin: var(--universal-margin); color: rgb(17, 17, 17);">  Part I: Software Security Fundamentals<ul> <li> Defining a Discipline</li> <li> A Risk Management Framework</li> <li> Vulnerability Assessment and Management</li> <li> Overview on Traffic, Vulnerability and Malware Analysis</li></ul> Part II: Software Security<ul> <li> Code Inspection for Finding Security Vulnerabilities and Exposures (ref: Mitre’s CVE)</li> <li> Architectural Risk Analysis</li> <li> Penetration Testing, Concolic Testing, Fuzzing, Automated Test Generation</li> <li> Model Checking, Abstract Interpretation, Symbolic Execution</li> <li> Risk-Based Security Testing and Verification</li> <li> Software Security Meets Security Operations</li></ul> Part III: Software Security Grows Up<ul> <li> Withstanding adversarial tactics and techniques defined in Mitre’s ATT&CK™ knowledge base</li> <li> An Enterprise Software Security Program</li></ul> <ul> <li> Lectures</li> <li> Workshops</li> <li> Tutorials</li> <li> Labs/Practicals</li></ul>  1 Written exam 30% 2 Written assignment (inc essay) 70% <ul> <li> Lectures</li> <li> Workshops</li> <li> Tutorials</li> <li> Labs/Practicals</li></ul> MSc Adv Computer Science MSc Adv Computer Science PGDT Taught Component Optional MSc Adv Computer Science Artificial Intelligence PGDT Taught Component Optional MSc Adv Computer Science Computer Security PGDT Taught Component Mandatory MSc Adv Computer Science Data and Knowledge Management PGDT Taught Component Optional MSc Adv Computer Science Digital Biology PGDT Taught Component Optional N Assessment written exam 2 Lectures 20 Practical classes & workshops 20 108