Introduction to Software Security

UW, UAB and TrustedCI logos

Introduction to Software Security

Elisa Heymann and Barton P. Miller

Contacts: elisa@cs.wisc.edu and bart@cs.wisc.edu.

© 2025 Elisa Heymann and Barton P. Miller.

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Instructors: You can find the Instructors' Page with teaching information and directions to access the active learning exercises and quizzes. You will need to request access permission from us for these resources.

Students: This is a free and open resource for you to use to help you learn about software security. If you would like to support this effort and help us keep it up to date and expand the content, please feel free to donate $5 - $10 - $20 - $50 - or click here to donate any amount you want.

Note about chapter numbering: In preparation for publishing our chapters in a book, over the next year chapter numbers will change. The current system of module.unit will change a simple chapter number. For example, existing Unit 5.2 will become Chapter 29. The page style and formatting is also being updated.

During this transition, this web page will continue to organize this page using the old numbering, but some of the chapters that you access will have the new numbers. Chapters that are written in the new style will have the new chapter number in parentheses after the old one, e.g., "5.2 (29)".

All new chapters will use the new number system. After we complete those chapters, we will start to move the existing units to the new chapter numbers. If you have links to individual units, then those will need to be updated.

Sorry for any confusion that this causes!

Module 1: Introduction

1 (1)
Welcome and Overview

1.2.1 (2)
Introduction (part 1)
Basic Terminology

English, Español

1.2.2 (2)
Introduction (part 2)
Threats

English, Español

1.2.3 (2)
Introduction (part 3)
Risks and Basic Concepts

English, Español

1.3 (3)
Thinking Like an Attacker: Owning the Bits

English, Español

Module 2: Thinking Like a Designer

2.1 (4)
Secure Design Principles

2.2 (5)
Overview of Threat Modeling

2.3 (6)
Microsoft Security Design Lifecycle and Threat Modeling Methodology

2.4 (7)
Microsoft DREAD Threat Categories

2.5 (8)
PASTA Threat Modeling Methodology

Module 3: Thinking Like an Programmer: Secure Programming

3.1 (9)
Pointers and Strings

English, Español

3.2 (10)
Numeric Errors: Integers

English, Español

(11)
Numeric Errors: Floating Point

English, Español

3.3 (12)
Directory Traversal

English, Español

3.4 (13)
Exceptions

English, Español

3.5 (14)
Serialization

English, Español

3.6
Privilege, Sandboxing, Environments

3.8 (15)
Introduction to Injection Attacks

English, Español

3.8.1 (16)
SQL Injections

English, Español

3.8.2 (17)
Command Injections

English, Español

3.8.3 (18)
Code Injections

English, Español

3.8.4 (19)
XML Injections

English, Español

3.9.1 (20)
Web Attacks:
Background

English, Español

3.9.2 (21)
Web Attacks:
Cross Site Scripting (XSS)

English, Español

3.9.3 (22)
Web Attacks:
Cross Site Request Forgery (CSRF)

English, Español

3.9.4 (23)
Web Attacks:
Session Management

English, Español

3.9.4b (24)
Web Attacks:
CORS

English

3.9.5
Web Attacks:
Redirection

English, Español

3.10.1 (25)
Mobile: Background

English, Español

3.10.2 (25)
Mobile: Attacks

English, Español

Module 4: Defensive Techniques

4.1 (26)
Address Space Layout Randomization

English

4.2 (27)
Memory Safety Checks

English

4.3 (28)
Control Flow Integrity Checks

Module 5: Thinking Like an Analyst: In-Depth Vulnerability Assessment

5.1 (29)
Introduction to FPVA, First Principles Vulnerability Assessment

English

5.2.1 (30)
FPVA Step 1: Architectural Analysis (part 1)

English

5.2.2 (30)
FPVA Step 1: Architectural Analysis (part 2)

English

5.3 (31)
FPVA Step 2: Resource Identification

English

5.4 (32)
FPVA Step 3: Trust and Privilege Analysis

English

5.5.1 (33)
FPVA Step 4: Component Analysis (part 1)

English

5.5.2 (33)
FPVA Step 4: Component Analysis (part 2)

English

5.5.3 (33)
FPVA Step 4: Component Analysis (part 3)

English

5.6 (34)
FPVA Step 5: Dissemination of Results

5.7 (35)
The Manager's Point of View: Responding to a Vulnerability

English

Module 6: Thinking Like an Analyst: Automated Assessment Tools

6.1
How Static Analysis Tools Work (part 1)

English

6.2
How Static Analysis Tools Work (part 2)

6.3
Tools for C and C++

6.4
Tools for Java

6.5.1
Dependency Analysis Tools: Conceptual Background

English

6.5.2
Dependency Tools: How to Use the Tools

English

6.6
Using Tools in the SWAMP

English

Module 7: Dynamic Techniques (Fuzz Testing and Other Checkers)

7.1
Introduction to Fuzz Testing

English

7.2.1
Classic Fuzz Testing
Section 1: Background

English

7.2.2
Classic Fuzz Testing
Section 2: Command Line Studies

English

7.2.3
Classic Fuzz Testing
Section 3: GUI-Based Studies

English

7.2.4
Classic Fuzz Testing
Sections 4 & 5: Other Studies, Commentary

English

7.3
Fuzz Testing with AFL

English

7.4
Memory Checking Tools

Module 8: Secure Use of Cryptography

8.1
Basic Cryptography Concepts

English

8.2
Java Crypto API Misuses and Cryptoguard

English

Supplementary Sections

Glossary of Terms

Last modified: Mon Apr 7 12:40:37 PM CDT 2025 by bart