Software Security

Catalog description

This course explores the fundamental concepts and engineering processes of software development and testing to produce software that is designed for security. This course is intended as a senior-level course for computational majors such as computer science and computer engineering since it covers the exploitation of programs based on computer architecture, systems, and software concepts. First, software engineering considerations associated with a variety of software vulnerabilities will be analyzed, along with defensive programming techniques to avoid such vulnerabilities. The next part of this course will introduce systematic software engineering principles for building secure software to defend its attack surface, such as reference monitors, privilege separation, information flow, and program verification. The third part will focus on methods for security testing of software including fuzz testing, symbolic execution, grey-box testing, and forensics. The final week of the course will examine adding security into the software engineering life cycle. The design and implementation of techniques to develop reference monitors, information-flow secure programs, testing mechanisms and enhancements, as well as defensive programming against prominent software vulnerabilities will be studied and analyzed. Upon completion of the course students will be able to critically analyze the design and implementation of software for security flaws and build security mechanisms to prevent exploitation of such flaws.