Topics
Introduction to Secure Coding
What is application security?
SDLC – Secure Development Lifecycle
Cyber security attacks
Secure design
Secure coding principles
Security testing
Attackers motivation
The defender’s approach
Buffer Overflows and Code Injections
Stack Overflows attacks
Heap overflows attacks
Array indexing attacks
Format strings attacks
Unsafe API’s
Safer API’s
Stack guards
Compiler checks
Better ways to manipulate strings and buffers
Integer Overflows
Int / Double overflows
Integer conversion rules
Signed and unsigned problems
Safe integer usage
Enforcing limits on integer values
Preventing lost or misinterpreted data due to conversion
Using secure integer libraries
Safe API
Dangerous and banned APIs
Real-World Risks
Using safe API’s
The ‘n’ Functions
Detecting Dangerous APIs
Alternatives
StrSafe
Input Validation
What is considered Input?
Common Errors
Black List VS. White List Validation
Attack scenario: Canonicalization
String Manipulation and Comparison
Data Type Conversion
Regular Expressions
Validation practices
Network Security
Introduction to Networking
Network attacks
Insecure Services
Application Layer Threats and attacks
Traffic Sniffing
Traffic Manipulation
Man-in-the-Middle
Avoiding Server Socket Hijacking
Firewall Friendly Application
Secure Memory Usage
Secure memory handling
Erasing Data
Secure pointer usage
Memory Dumps
Use smart pointers for resource management
Ensure pointer arithmetic
Avoid null pointer dereferencing
Ensure sensitive data is not paged to disk
Protecting Data at Rest
Goals of cryptography – CIA
Introduction to cryptography
Symmetric encryption
ECB vs. CBC
Message integrity
Hash vs. HMAC
Secure password storage
Salt
Protecting Data at Motion
Asymmetric Encryption
RSA
ECC
The SSL protocol
Digital signature
PKI
Digital certificates
Certificate authority
Challenge-response
Authentication
Key Management
Key generation
Key derivation
Key storage
TPM
Key exchange (DH)
Authentication & Authorization
Authentication scenarios
Common mistakes
Attack scenario: brute force
Authentication protocols
Attack scenario: weak passwords
Authorization models
Access Control List (ACL)
Role Based Access Control (RBAC)
Attack scenario: exposed functionality via anonymous authentication
Secure File Handling
Directory Traversal attacks
File canonicalization attacks
Creating files with correct ACLs
Ensure files are closed when no longer needed
Insecure usage of shared directories
Thread Safety
Concurrency & race conditions
Mutual exclusion
Deadlock
Time of Check/Time of Use (TOCTOU)
Files as Locks
Symbolic link attacks
Temporary files
Handling the race window
Controlling race objects
Using atomic operations
Application Denial of Service vulnerabilities
Application / OS crash
CPU starvation
Memory starvation
File system starvation
Resource starvation
Triggering high network bandwidth
User-level DoS
Exploiting a specific vulnerability to cause DoS
Secure Coding Tips
Prefer Streams to C-Style Input and Output
Avoid defining of macros
Do not ignore values returned by functions or methods
Secure defaults and initializations
The least privilege principle
The defense in depth principle
The segmentation principle
Avoiding hard coded secrets
Use Static Code Tools
Integrating security into the development lifecycle
Logging & Error Handling
Process uncaught and unexpected exceptions
Prevent sensitive information disclosure via errors
Declare new exception classes for security
Events you should and should not log
Log integration with exception management
Anti-Reversing
Eliminate “symbolic info”
Code Obfuscate and Code encryption
Anti-debugging tricks
Code checksums
Confusing a disassembler
Inlining and outlining sensitive code
Interleaving code
Existing tools
