Description
This module develops an understanding of how security can be embedded in the software development lifecycle.
Aims
The aim of this Module is to introduce students to a range of tools and techniques for detecting and preventing security problems as part of the software development process.
Learning Outcomes
By the end of this module the student should be able to:
1. Analyse and critically evaluate a range of secure software engineering techniques, and critically select and apply these techniques in the context of real-world software projects.
Indicative Content
1 A Secure Development Process
Common vulnerabilities in software. Testing for security vs. testing in general. Sources of security faults within the software lifecycle. Learning from past mistakes: vulnerability databases. General design practices for security. Code review for security and secure coding guidelines. Handing security issue reports.
2 Static and Dynamic Analysis
What tools can and can't find. Static analysis: pattern-matching, reusing complier technology, control flow analysis. Dynamic analysis: compiler sanitisation, introduction to fuzzing, template-based fuzzing, coverage-directed fuzzing. Static/dynamic analysis and Cl.
3 Language and API Design for Security
Inherent security problems with widely-used languages, and why people still use them. Language-specific tools. Platfom differences. Undefined behaviour and complier optimisations. Improving security through better API design. Managing software dependencies.
3
Inherent security problems with widely-used languages, and why people still use them. Language-specific tools. Platfom differences. Undefined behaviour and complier optimisations. Improving security through better API design. Managing software dependencies.