Software Security

Deprecated: The each() function is deprecated. This message will be suppressed on further calls in /home/zhenxiangba/zhenxiangba.com/public_html/phproxy-improved-master/index.php on line 456
Software Security

Software Security, Spring 2007

The course description in the on-line course description system can be found here.

This course is taught by Erik Poll and Marko van Eekelen.
Helping out with the project assignments are Thanh Son Nguyen and Ichiro Hasuo.

Prerequisites

Basic programming skills, incl. familiarity with C and Java.

Administratrivia

If you want to follow this course:

Sent an email to erikpoll[at]cs.ru.nl so that I have all your email addresses.
If you a student at the Radboud University, also subscribe to this course in Blackboard.

Schedule

Lecture: Fridays 10:45-12.30 in HFML0220

Lectures & obligatory reading material

slides

nr.	day	literature
1	Fri Feb 9	Introduction [1up] [6up]	Gary McGraw and Greg Morrisett, Attacking Malicious Code: A Report to the Infosec Research Council, IEEE Software, Vol. 17, No. 5, pp. 33-41, 2000. Available as PDF (requires IEEE access, works from ru.nl) or PDF (public preprint) Gary McGraw, Software security, Security & Privacy Magazine, IEEE, Vol 2, No. 2, pp. 80-83, 2004. Available as PDF (requires IEEE access, works from ru.nl) or PDF
2	Fri Feb 16	Access Control [1up] [6up]
	Fri Feb 23	No lecture: carnaval holidays
3	Fri March 2
4	Fri March 9
5	Fri March 16
6	Fri March 23
7	Fri March 30
	Fri April 6	No lecture: Good Friday
8	Fri April 13
9	Fri April 20
10	Fri April 27
	Fri May 4	No lecture: May holidays
11	Fri May 11
	Fri May 18	No lecture: Ascension Day
12	Fri May 25
13	Fri June 1
14	Fri June 8
15	Fri June 15
16	Fri June 22
17	Fri June 29

Recommended Literature

The articles listed above is obligatory reading material. For some additional background reading

Building Secure Software, by John Viega and Gary McGraw. Addison-Wesley, 2002.
The 19 Deadly Sins of Software Security, by Michael Howard, David LeBlanc and John Viega, McGraw-Hill, 2006. The chapter on Format String attacks is available online.
Secure Coding: Principles & Practices, by Mark G. Graff and Kenneth R. van Wyk. O'Reilly, 2003.
Writing Secure Code, by Michael Howard and David LeBlanc, Microsoft Press, 2002.

These books are available in the Nijmegen library.

On-line resources

There are some community efforts to collect information about software security on-line. Good sources of information:

Building Security In
Interesting material here includes the information on guidelines/principles for Software Security
OWASP (Open Web Application Security Project).
Interesting material here includes the Ten Most Critical Web Application Security Vulnerabilities.
Several sites offering information about vulnerabilities: