Unit 1 Fundamentals of Secure Programming

10 lecture hours

• Introduction to Security: Security and CIA Triad
• Risk, and Attack
• Malware Overview: Viruses
• Types of Security Attacks: Active Attacks: IP Spoofing
• Tear Drop, DoS, DDoS, XSS, SQL Injection
• Format String Attack
• Passive Attacks: Eavesdropping
• Traffic Analysis
• Principles of Software Security: Introduction to Software Security
• Managing Software Security Risks
• Selecting Secure Software Development Technologies
• Guiding Principles for Secure Programming
• Open Source vs
• Closed Source Software Security
• Need for Secure Systems : Importance of proactive security development
• Secure Software Development Cycle (S-SDLC)
• Security Issues in Different Phases : SRS (Software Requirement Specification)
• Design Phase Security
• Development Phase Security
• Test Phase Security
• Maintenance Phase Security

Unit 2 Programming Errors and Software Vulnerabilities

8 lecture hours

• Introduction to Software Vulnerabilities: Software Security Fundamentals
• Common Programming Errors and Their Security Implications
• Programming Errors Leading to Vulnerabilities: Buffer Overflows
• Format String Problems
• Integer Overflow
• SQL Injection
• Command Injection
• Failure to Handle Errors Properly Types of Security Vulnerabilities: Invalidated Input
• Race Conditions
• Access-Control Problems
• Weaknesses in Authentication and Authorization
• Cryptographic Practice Vulnerabilities
• Access Control and Security Best Practices: Role-Based Access Control
• Principle of Least Privilege
• Mitigating Privilege Escalation

Unit 3 Security threats in Software & secure coding techniques

• Introduction to Software Security: Importance of security analysis
• Overview of security techniques and best practices
• Security Issues and Countermeasures: Anti-Tampering
• DoS/DDoS Protection
• Copy Protection Schemes
• Client-Side Security
• Database Security and SQL Injection Prevention
• Threat Modelling and Risk Assessment: Threat 08 25 GUJARAT TECHNOLOGICAL UNIVERSITY Program Name: Master of Engineering Level: PG Subject Code : ME02000381 Subject Name : Secure Coding w.e.f. 2024-25 https://syllabus.gtu.ac.in/ Page 3 of 4 Modelling and Attack Trees
• DREAD Rating for threat evaluation
• Risk Mitigation Techniques
• Authorization, and Defense Strategies: Authentication and Authorization Basics
• in Depth and Least Privilege
• Secure Coding Techniques: DoS Protection
• Secure Java Coding
• Preventing Application Failures and CPU Starvation
• Network and Remote Security: ARP Spoofing
• Socket Security
• Securing RPC and Server Hijacking Prevention

Unit 4 Database and Web-Specific Security Issues

7 lecture hours

• SQL Injection
• Race Conditions
• Time of Check vs Time of Use (TOC/TOU)
• Input Validation & Interposes Communication (IPC)
• Signal Handlers & File Operations
• Cross-Site Scripting (XSS)
• Bypassing XSS Filters
• Information Leakage
• Poor Usability
• Network Traffic Protection
• Improper Use of PKI, Trusting Network Name Resolution

Unit 5 Testing Secure Applications

10 lecture hours

• Security code overview
• secure software installation
• The Role of the Security Tester
• Building the Security Test Plan
• Testing HTTP-Based Applications
• Testing File-Based Applications
• Testing Clients with Rogue Servers
• Secure Testing Tools: Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Interactive Application Security Testing (IAST)
• Vulnerability assessment & Penetration testing (VAPT)