Fundamentals of Secure Software Development Training

• Assets to be protected
• Threats Expected
• Security Imperatives (int&external)
• Organization's Risk Appetite
• Security Terminology
• Organizational Security Policy
• Security Roles and Responsibilities
• Security Training for Roles
• Generic Security Goals & Requirements

Exercise: Our Own Security Context

• Project-Specific Security Terms
• Project-Related Assets & Security Goals
• Product Architecture Analysis
• Use Cases & MisUse/Abuse Cases
• Dataflows with Trust Boundaries
• Product Security Risk Analysis
• Elicit, Categorize, Prioritize SecRqts
• Validate Security Requirements

Exercise: Managing Security Requirements

• High-Level Design
  • Architectural Risk Analysis
  • Design Requirements
  • Analyze Attack Surface
  • Threat Modeling
  • Trust Boundaries
  • Eliminate Race Objects
• Detail-Level Design
  • Secure Design Principles
  • Use of Security Wrappers
  • Input Validation
  • Design Pitfalls
  • Validating Design Security
  • Pairing Mem Mgmt Functinos
  • Exclude User Input from format strings
  • Canonicalization
  • TOCTOU
  • Close Race Windows
  • Taint Analysis

Exercise: A Secure Software Design, Instructor Q & A

• Coding
  • Developer guidelines & checklists
  • Compiler Security Settings (per)
  • Tools to use
  • Coding Standards (per language)
  • Common pitfalls (per language)
  • Secure/Safe functions/methods
    • Stack Canaries
    • Encrypted Pointers
    • Memory Initialization
    • Function Retrun Checking (e.e. malloc)
    • Dereferencing Pointers
  • Integer type selection
    • Range Checking
    • Pre/post checking
  • Synchronization Primatives
  • Early Verification
  • Static Analysis (Code Review w/tools)
  • Unit & Dev Team Testing
  • Risk-Based Security Testing
  • Taint Analysis

Exercise: Securing Coding Q & A

• Assets to be protected
• Threats Expected
• Security Imperatives (int&external)
• Organization's Risk Appetite
• Static Analysis
• Dynamic Analysis
• Risk-Based Security testing
• Fuzz Testing (Whitebox vs Blackbox)
• Penetration Testing (Whitebox vs Blackbox)
• Attack Surface Review
• Code audits
• Independent Security Review

Exercise: Testing Software for Security

Releasing & Operating Secure Software

Exercise: A Secure Software Release

• Incident Response Planning
• Final Security Review
• Release Archive
• OS Protections:
  • Address Space Layout Randomization
  • Non-Executable Stacks
  • W^X
  • Data Execution Prevention
  • /ul>
  • Monitoring
  • Incident Response
  • Penetration Testing
• Process Review
• Getting Started
• Priorities

Exercise: Your Secure Software Plan