Topics in software security

CS-510 / 3 credits

Teacher: Payer Mathias Josef

Language: English

Summary

Memory corruption and type safety flaws dominate the threat landscape. We will approach current research from three dimensions: sanitization (finding flaws through runtime monitors); fuzzing (testing software automatically); and mitigation (protecting software at runtime).

Content

Unsafe languages like C/C++ are widely used for their great promise of performance. Unfortunately, these languages are prone to a large set of different types of memory and type errors that allow the exploitation of several attack vectors such as code reuse, privilege escalation, or information leaks.


On a high level memory and type safety (and type safety) would solve all these problems. Safe languages can (somewhat) cheaply enforce these properties.


Unfortunately, these guarantees come at a high cost if retrofitted onto existing languages.


When working with unsafe languages, three fundamental approaches exist to protect against software flaws: formal verification (proving the absence of bugs), software testing (finding bugs), and mitigation (protecting against the exploitation of bugs). In this seminar, we will primarily focus on the latter two approaches. Formal verification, while giving strong guarantees, struggles to scale to large software.


This seminar explores three areas: the understanding of attack vectors,approaches to software testing, and mitigation strategies. First you need to understand what kind of software flaws exist in low level software and how those flaws can be exploited.

Learning Prerequisites

Required courses

A security course like COM-301

An operating/systems course like CS-323

Recommended courses

COM-402 Information security and privacy

CS-412 Software security

Learning Outcomes

By the end of the course, the student must be able to:

  • Investigate select advanced concepts in software security
  • Promote their programming and systems skills in core security topics
  • Assess / Evaluate the contributions of a software security research paper
  • Investigate software security research papers
  • Present a research paper and lead the resulting discussion

Teaching methods

In this seminar course, students will read, prepare, and present recent research papers in the filed of software security. The papers will be discussed in class. The presenter will organize the discussion among their peers and prepare a set of discussion points.

Expected student activities

The students are expected to

  • Prepare and hold the presentation of their assigned research paper
  • Summarize the paper along with the class discussion after their presentation
  • Participate in the presentations and discussions of the other students

Assessment methods

  • Presentation : 40%
  • Summary/review : 50%
  • Class participation : 10%

Resources

Websites

Moodle Link

In the programs

  • Semester: Fall
  • Exam form: During the semester (winter session)
  • Subject examined: Topics in software security
  • Courses: 1 Hour(s) per week x 14 weeks
  • Exercises: 1 Hour(s) per week x 14 weeks
  • Type: optional
  • Semester: Fall
  • Exam form: During the semester (winter session)
  • Subject examined: Topics in software security
  • Courses: 1 Hour(s) per week x 14 weeks
  • Exercises: 1 Hour(s) per week x 14 weeks
  • Type: optional
  • Semester: Fall
  • Exam form: During the semester (winter session)
  • Subject examined: Topics in software security
  • Courses: 1 Hour(s) per week x 14 weeks
  • Exercises: 1 Hour(s) per week x 14 weeks
  • Type: optional
  • Semester: Fall
  • Exam form: During the semester (winter session)
  • Subject examined: Topics in software security
  • Courses: 1 Hour(s) per week x 14 weeks
  • Exercises: 1 Hour(s) per week x 14 weeks
  • Type: optional
  • Semester: Fall
  • Exam form: During the semester (winter session)
  • Subject examined: Topics in software security
  • Courses: 1 Hour(s) per week x 14 weeks
  • Exercises: 1 Hour(s) per week x 14 weeks
  • Type: optional
  • Semester: Fall
  • Exam form: During the semester (winter session)
  • Subject examined: Topics in software security
  • Courses: 1 Hour(s) per week x 14 weeks
  • Exercises: 1 Hour(s) per week x 14 weeks
  • Type: optional
  • Semester: Fall
  • Exam form: During the semester (winter session)
  • Subject examined: Topics in software security
  • Courses: 1 Hour(s) per week x 14 weeks
  • Exercises: 1 Hour(s) per week x 14 weeks
  • Type: optional

Reference week

Related courses

Results from graphsearch.epfl.ch.