1. Engineering Secure Software
Course overview

2. Vulnerability of the Day
Each day, we will cover a different type of code-level vulnerability
Usually a demo
How to avoid, detect, and mitigate the issue
Most will link to the Common Weakness Enumeration

3. In-Class Activities Most days, we will cover a tool or technique
Many activities are interactive and collaborative in nature
…so attendance is necessary
Activities are for learning
Formative feedback, not summative
No submissions (usually) – instructor checks in class
Exams will have questions about those activities

4. Exams Exam 1, Exam 2, & Final exam Closed book Closed computer
Covers lecture material, VotD, textbook, and activities

5. Fuzz Testing Project We will have one larger programming project Goal:
Build a tool for automated security testing
Web applications
Continuous Integration
Individuals, not teams
Goal:
How do we automate exploratory testing?
What can be automated easily, what can’t?

6. Vulnerability History Project
What are the origins of past vulnerabilities?
What are the mistakes that led to a vulnerability being introduced and missed?
What can we learn from history?
Some writing, lots of investigation
Peer review process as well

7. Case Study Choose a large software project to study
Source code must be available (>10k SLOC)
Domain must have security risks
History of vulnerabilities must be available
Instructor approved
Paper with chapters on:
Security risks of the domain
Design risks
Code inspection results
Iterative paper writing
Multiple submissions
You are graded on the content and how you react to my feedback

8. Reading Quizzes
McGraw has a different approach and perspective worth seeing
Quizzes will be:
Done through myCourses
On your own time (i.e. open book)
Multiple choice
Multiple attempts