Coronavirus information for applicants and offer-holders

We understand that prospective students and offer-holders may have concerns about the ongoing coronavirus outbreak. The University is following the advice from Universities UK, Public Health England and the Foreign and Commonwealth Office.

Read our latest coronavirus information

MSc ACS: Computer Security

Year of entry: 2020

Course unit details:
Software Security

Unit code COMP63342
Credit rating 15
Unit level FHEQ level 7 – master's degree or fourth year of an integrated master's degree
Teaching period(s) Semester 2
Offered by Department of Computer Science
Available as a free choice unit? No

Overview

Software is subject to numerous forms of attack such as memory corruption, buffer overflows and injection; these flaws are often too complex or expressive to be manually detected by the software developer. Techniques and tools exist to prevent and detect software flaws, which are typically too hard to be manually found, e.g., modelling, code reviews, fuzzing, static and dynamic code analyses, program verification and code tainting.

This course unit introduces students to basic and advanced approaches to formally build verified trustworthy software systems, where trustworthy comprise five attributes: reliability, availability, safety, resilience and security.

Pre/co-requisites

Fundamental programming skills, including familiarity with C and Python 3. In more detail:

  • For C, the student should at least know how pointers and dynamic memories work.
  • For Python, the student should know how to develop basic algorithms/data structures and interact with the host system.

Basic notions in Linux System Administration:

  • Create a web server.
  • Understand the difference between user space and kernel space.

Some interest/knowledge of logic and modelling:

  • Understand propositional and first-order logic.
  • Understand linear-time temporal logic.
     

Learning outcomes

On successful completion of this course unit, a student will be able to

  • Explain computer security problem and why broken software lies at its heart.
  • Explain continuous risk management and how to put it into practice to ensure software security.
  • Introduce security properties into the software development lifecycle.
  • Use software validation and verification techniques to detect software vulnerabilities and mitigate against them.
  • Relate security testing and verification to risk analysis to address continued resilience when a cyber-attack takes place.
  • Develop case studies to think as an attacker and mitigate them using software verification and testing.

 

Syllabus

Part I: Software Security Fundamentals

  • Defining a Discipline
  • A Risk Management Framework
  • Vulnerability Assessment and Management
  • Overview on Traffic, Vulnerability and Malware Analysis


Part II: Software Security

  • Code Inspection for Finding Security Vulnerabilities and Exposures (ref: Mitre’s CVE)
  • Architectural Risk Analysis
  • Penetration Testing, Concolic Testing, Fuzzing, Automated Test Generation
  • Model Checking, Abstract Interpretation, Symbolic Execution
  • Risk-Based Security Testing and Verification
  • Software Security Meets Security Operations


Part III: Software Security Grows Up

  • Withstanding adversarial tactics and techniques defined in Mitre’s ATT&CK™ knowledge base
  • An Enterprise Software Security Program

Teaching and learning methods

  • Lectures
  • Workshops
  • Tutorials
  • Labs/Practicals

 

Assessment methods

Method Weight
Written exam 30%
Written assignment (inc essay) 70%

Feedback methods

  • Lectures
  • Workshops
  • Tutorials
  • Labs/Practicals

Recommended reading

References

The books used by this course are:

  • Rashid et al.: The Cyber Security Body of Knowledge, CyBOK, v1.0, 2019.
  • McGraw, Gary: Software Security: Building Security In, Addison-Wesley, 2006.
  • Hoglund, Greg: Exploiting Software: How to Break Code, Addison-Wesley, 2004.
  • Ransome, James and Misra, Anmol: Core Software Security: Security at the Source, CRC Press, 2014.
  • Edmund M. Clark Jr., Orna Grumberg, Daniel Kroening, Doron Peled, Helmut Veith: Model Checking, The MIT Press, 2018.
  • Mark Dowd , John McDonald, et al.: The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities, Addison-Wesley, 2006.
  • SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems, SEI - Carnegie Mellon University, 2016.

Software

The software used by this course are:

Useful Links

 

Study hours

Independent study hours
Independent study 0

Teaching staff

Staff member Role
Lucas Cordeiro Unit coordinator

Return to course details