Software security

Summary

This course focuses on software security fundamentals, secure coding guidelines and principles, and advanced software security concepts. Students learn to assess and understand threats, learn how to design and implement secure software systems, and get hands-on experience with security pitfalls.

Content

Learning Prerequisites

Required courses

• COM-402 Information security and privacy (or an equivalent security course)

• A systems programming course (with focus on C/C++)

• An operating systems course

Important concepts to start the course

Basic computer literacy like system administration, build systems, C/C++ programming skills, debugging, and development skills. Understanding of virtual machines and operating systems.

Teaching methods

The lectures are denser early in the semester, then tapering off before the end. They are backed up by PDF files of all the lecture material, as well as a few textbook recommendations.

The exercises sessions start slowly early in the semester but pick up and occupy all time towards the end. Homework exercises consist mostly of paper questions involving the analysis, critical review, and occasional correction of software. They include a reading, writing, and presentation assignment.

The labs focus on practical software security aspects and during the course the students will be assessed through their completion of several challenging "hands on" labs.

Assessment methods

The grade will be continuously evaluated through a combination of practical assignments in the form of labs during the semester and a final exam in the exam session. The labs account for 30% and the final exam for 70%. In addition, we will provide ungraded quizzes as training material.

Resources

Notes/Handbook

Software Security: Principles, Policies, and Protection (SS3P, by Mathias Payer)

https://nebelwelt.net/SS3P/

Moodle Link

• https://go.epfl.ch/CS-412