Developing Secure Software (2015)
1h 26mIntermediate2020-08-07
Authors
Jungwoo Ryoo
Teaches IT, cybersecurity, and risk analysis at Penn State
Course details
Software developers are constantly told to use secure coding practices. Luckily, with today's tools, secure code doesn't take a lot of time or effort. There are security frameworks (authentication, authorization, etc.) developers can use as their own. There are also static and dynamic code analysis tools to test code. Plus, with security patterns that can be implemented at the design level—before coding ever begins—you can make sure you're not reinventing the wheel.
Jungwoo Ryoo is a faculty member teaching cybersecurity and information technology at Penn State. In this course, he introduces secure software development tools and frameworks and teaches secure coding practices such as input validation, separation of concerns, and single access point. He also shows how to recognize different kinds of security threats and fortify your code. Plus, he helps you put a system in place to test your software for any overlooked vulnerabilities.
Learning objectives
What is software security?
Analyzing different kinds of security threats
Designing secure software by adopting patterns and addressing vulnerabilities
Avoiding buffer overflows
Countering insecure direct object references
Securing sensitive data
Testing software security
Jungwoo Ryoo is a faculty member teaching cybersecurity and information technology at Penn State. In this course, he introduces secure software development tools and frameworks and teaches secure coding practices such as input validation, separation of concerns, and single access point. He also shows how to recognize different kinds of security threats and fortify your code. Plus, he helps you put a system in place to test your software for any overlooked vulnerabilities.
Learning objectives
What is software security?
Analyzing different kinds of security threats
Designing secure software by adopting patterns and addressing vulnerabilities
Avoiding buffer overflows
Countering insecure direct object references
Securing sensitive data
Testing software security
Skills covered
Software Development SecurityProjectCybersecurity
Concepts
Introduction
- Building security into software development
- What you should know
Understanding Software Security
- What is software security
- Significance of software security
- Software security vocabulary
- Software security risk management
- Software security resources
Software Security Threats
- Threats to software security
- Hardware-level threats
- Code-level threats
- Detailed design-level threats
- Architectural-level threats
- Requirements-level threats
- Threat modeling and tools
Secure Software Design
- Introduction to secure design
- Security tactics
- Security patterns
- Security vulnerabilities
- Architectural analysis for security
- Case study - Setting the Stage
- Case study - Tactic-Oriented Architectural Analysis
- Case study - Pattern-Oriented Architectural Analysis
- Case study - Vulnerability-Oriented Architectural Analysis
- Software security anti-patterns
Secure Coding
- Setting the stage
- Buffer overflow attacks
- Buffer overflow countermeasures
- Broken authentication and session management
- Broken authentication and session management countermeasures
- Insecure direct object references
- Insecure direct object references countermeasures
- Sensitive information exposure
- Sensitive data exposure countermeasures
- Other secure coding best practices
Testing for Security
- Testing for security
- Static analysis
- Exploring tools for static analysis
- Dynamic analysis
- Dynamic analysis tools
- Penetration testing
- Penetration testing tools
- Vulnerability management
- Vulnerability management tools
Recent Developments and Future Directions
- DevOps and software security
- Cloud security
- Developer-friendly software security
- IoT and software security
- Rules and regulations
- Software security certifications
Conclusion
- Next steps and additional resources