Developing Secure Software

Build more secure software by leveraging architectural analysis for security, security frameworks, code analysis and risk analysis tools, and security patterns.

Software developers are constantly told to use secure coding practices. Luckily, with today's tools, secure code doesn't take a lot of time or effort. There are security frameworks (authentication, authorization, etc.) developers can use as their own. There are also static and dynamic code analysis tools to test code. Plus, with security patterns that can be implemented at the design level—before coding ever begins—you can make sure you're not reinventing the wheel.

Jungwoo Ryoo is a faculty member teaching cybersecurity and information technology at Penn State. In this course, he introduces secure software development tools and frameworks and teaches secure coding practices such as input validation, separation of concerns, and single access point. He also shows how to recognize different kinds of security threats and fortify your code. Plus, he helps you put a system in place to test your software for any overlooked vulnerabilities.

Introduction

• Building security into software development
• What you should know

1. Understanding Software Security

• What is software security?
• Significance of software security
• Software security vocabulary
• Software security risk management
• Software security resources

2. Software Security Threats

• Threats to software security
• Hardware-level threats
• Code-level threats
• Detailed design-level threats
• Architectural-level threats
• Requirements-level threats
• Threat modeling and tools

3. Secure Software Design

• Introduction to secure design
• Security tactics
• Security patterns
• Security vulnerabilities
• Architectural analysis for security
• Case study: Setting the Stage
• Case study: Tactic-Oriented Architectural Analysis
• Case study: Pattern-Oriented Architectural Analysis
• Case study: Vulnerability-Oriented Architectural Analysis
• Software security anti-patterns

4. Secure Coding

• Setting the stage
• Buffer overflow attacks
• Buffer overflow countermeasures
• Broken authentication and session management
• Broken authentication and session management countermeasures
• Insecure direct object references
• Insecure direct object references countermeasures
• Sensitive information exposure
• Sensitive data exposure countermeasures
• Other secure coding best practices

5. Testing for Security

• Testing for security
• Static analysis
• Exploring tools for static analysis
• Dynamic analysis
• Dynamic analysis tools
• Penetration testing
• Penetration testing tools
• Vulnerability management
• Vulnerability management tools

6. Recent Developments and Future Directions

• DevOps and software security
• Cloud security
• Developer-friendly software security
• IoT and software security
• Rules and regulations
• Software security certifications

Conclusion

• Next steps and additional resources