Introduction to Software Security

Videos by Elisa Heymann and Barton P. Miller
Text by Elisa Heymann, Loren Kohnfelder and Barton P. Miller

Contacts: elisa@cs.wisc.edu and bart@cs.wisc.edu.

© 2020 Elisa Heymann, Barton P. Miller and Loren Kohnfelder. All rights reserved.

Module 1: Introduction

1.1 Welcome and Overview 1.2.1 Introduction Part 1: Basic Terminology English 1.2.2 Introduction Part 2: Threats English 1.2.3 Introduction Part 3: Risks and Basic Concepts English

1.3 Thinking Like an Attacker: Owning the Bits English

Module 2: Thinking Like a Designer

2.1 Secure Design Principles 2.2 Threat Modeling Overview and Goals 2.3 Threat Modeling Methodology

Module 3: Thinking Like an Programmer: Secure Programming

3.1 Pointers and Strings English 3.2 Numeric Errors English, Español 3.3 Directory Traversal English 3.4 Exceptions English, Español 3.5 Serialization English, Español 3.6 Privilege, Sandboxing, Environments 3.7 Host Name Authentication 3.8 Introduction to Injection Attacks English 3.8.1 SQL Injections English, Español 3.8.2 Command Injections English 3.8.3 Code Injections English 3.8.4 XML Injections English, Español 3.9.1 Web Attacks: Background English 3.9.2 Web Attacks: Cross Site Scripting (XSS) English 3.9.3 Web Attacks: Cross Site Request Forgery (CSRF) English 3.9.4 Web Attacks: Session Management English 3.9.5 Web Attacks: Redirection English 3.10.1 Mobile: Background English 3.10.2 Mobile: Attacks English

Module 4: Defensive Techniques

Module 5: Thinking Like an Analyst

5.1 Introduction to FPVA, First Principles Vulnerability Assessment English 5.2 FPVA Step 1: Architectural Analysis (part 1) English 5.2 FPVA Step 1: Architectural Analysis (part 2) English 5.3 FPVA Step 2: Resource Identification English 5.4 FPVA Step 3: Trust and Privilege Analysis English 5.5 FPVA Step 4: Component Analysis 5.6 FPVA Step 5: Dissemination of Results 5.7 The Manager's Point of View: Responding to a Vulnerability English

Module 6: Automated Assessment Tools

6.1 How Tools Work Part 1 English 6.2 How Tools Work Part 2 6.3 Tools for C and C++ 6.4 Tools for Java 6.5 Using Tools in the SWAMP English

Module 7: Dynamic Techniques (Fuzz Testing and Other Checkers)

7.1 Introduction to Fuzz Test English 7.2.1 Classic Fuzz Testing Section 1: Background 7.2.2 Classic Fuzz Testing Section 2: Command Line Studies 7.2.3 Classic Fuzz Testing Section 3: GUI-Based Studies

7.2.4 Classic Fuzz Testing Sections 4 & 5: Other Studies, Commentary 7.3 Fuzz Testing with AFL

Supplementary Sections

Glossary of Terms

Last modified: Tue Jan 26 15:27:00 CST 2021 by bart