[an error occurred while processing this directive] [an error occurred while processing this directive]
[an error occurred while processing this directive]
[an error occurred while processing this directive]
Monash University

FIT5003 Software security - Semester 2, 2014

This unit aims to introduce the secure software development issues including secure software development life cycle, secure software design principles, secure coding practices, threat evaluation models, secure software testing, deployment and maintenance, software development and security policy integration. Students are provided with a range of practical exercises and tasks to reinforce their skills including: identification of security bugs in programs written in different programming languages, design, implementation, and testing of secure concurrent and networked applications, identification of vulnerabilities in networked and mobile/wireless applications. In addition, students will learn input validation techniques to minimise security risks, man-in-the-middle attack techniques to be able to build more secure networked applications, practical secure software testing techniques to be able to test applications for security bugs.

Mode of Delivery

Caulfield (Day)

Workload Requirements

Minimum total expected workload equals 12 hours per week comprising:

(a.) Contact hours for on-campus students:

  • Two hours of lectures
  • One 2-hour tutorial

(b.) Additional requirements (all students):

  • A minimum of 8 hours independent study per week for completing lab and project work, private study and revision.

Unit Relationships

Prerequisites

((FIT5131 or FIT9017) and (FIT5134 or FIT9018) and (FIT5132 or FIT9003 or FIT9019) and (FIT5135 or FIT9020) and (FIT5136 or FIT4037) and (FIT5130 or FIT9030)) or equivalent

Prerequisite knowledge: Programming experience, preferably in C or C++

Chief Examiner

Campus Lecturer

Caulfield

Dr Ron Steinfeld

Tutors

Caulfield

Dr Ron Steinfeld

Trung Quang Dinh

Guy Kijthaweesinpoon

Your feedback to Us

Monash is committed to excellence in education and regularly seeks feedback from students, employers and staff. One of the key formal ways students have to provide feedback is through the Student Evaluation of Teaching and Units (SETU) survey. The University’s student evaluation policy requires that every unit is evaluated each year. Students are strongly encouraged to complete the surveys. The feedback is anonymous and provides the Faculty with evidence of aspects that students are satisfied and areas for improvement.

For more information on Monash’s educational strategy, see:

www.monash.edu.au/about/monash-directions/ and on student evaluations, see: www.policy.monash.edu/policy-bank/academic/education/quality/student-evaluation-policy.html

Previous Student Evaluations of this Unit

This unit is being offered for the first time this year as part of the Master of Network and Security degree.

If you wish to view how previous students rated this unit, please go to
https://emuapps.monash.edu.au/unitevaluations/index.jsp

Academic Overview

Learning Outcomes

At the completion of this unit students will have an understanding of central issues and concepts involved in secure software development, including:
  • importance of security and risk assessment;
  • vulnerabilities versus threats;
  • common attack techniques (malicious input injection, buffer overflows);
  • malware;
  • common web application vulnerabilities and design aspects (cross-side scripting, SQL injection, cookies, session management, user authentication);
  • operating system security;
  • secure development principles and techniques (including principle of least privilege, input validation, tools for writing secure code);
  • software testing techniques (including bug discovery techniques, fuzzing),
  • software deployment and maintenance issues.

Unit Schedule

Week Activities Assessment
0   No formal assessment or activities are undertaken in week 0
1 Introduction to Software Security  
2 Threats, Vulnerabilities and Attacks  
3 Threat Modeling  
4 Secure (and Insecure) Coding Techniques I  
5 Secure (and Insecure) Coding Techniques II Part I of Assessment task 1 due
6 Web Application Security  
7 Security Testing Techniques Part II of Assessment task 1 due
8 Programming Languages and Security  
9 Programming Languages and Sandboxing Assessment task 2 due
10 Malware  
11 Implementation Pitfalls  
12 Summary and Revision Assessment task 3 due
  SWOT VAC No formal assessment is undertaken in SWOT VAC
  Examination period LINK to Assessment Policy: http://policy.monash.edu.au/policy-bank/
academic/education/assessment/
assessment-in-coursework-policy.html

*Unit Schedule details will be maintained and communicated to you via your learning system.

Teaching Approach

Lecture and tutorials or problem classes
This teaching and learning approach helps students to initially encounter information at lectures, discuss and explore the information during tutorials, and practice in a hands-on approach both in a lab environment as well as by accessing a server from outside the University.

Assessment Summary

Examination (2 hours): 50%; In-semester assessment: 50%

Assessment Task Value Due Date
Use of a Software Security Tool for Code Review 20% Week 5 and 7( Two part submission)
SQL injection Vulnerability 20% Week 9
Penetration Testing of Software 10% Week 12
Examination 1 50% To be advised

Assessment Requirements

Assessment Policy

Assessment Tasks

Participation

  • Assessment task 1
    Title:
    Use of a Software Security Tool for Code Review
    Description:
    Develop a concurrent program using threads for an application in C or C++ and identify its vulnerabilties using a source code review tool.

    More details will be provided on the assignment specification.
    Weighting:
    20%
    Criteria for assessment:

    Code develpment (40%)

    Installation of code review tool and the analysis of supplied source code for vulnerabilities (40%)

    Defend  or refute the identified vulnerabilities (20%)

    Due date:
    Week 5 and 7( Two part submission)
  • Assessment task 2
    Title:
    SQL injection Vulnerability
    Description:
    This assignment will develop code to demonstrate the SQL injection vulnerabilty. You will extend the program that is being discussed in the lab session so as to exploit the SQL injection while accessing  a database, and then implement sound countermeasure.
    Weighting:
    20%
    Criteria for assessment:

    Code development (30%)

    Successful exploitation and penetration of the code (40%)

    Countermeasures to fix the vulnerabilities (30%)

    Due date:
    Week 9
  • Assessment task 3
    Title:
    Penetration Testing of Software
    Description:
    Students will be given access to a software component and challenged to breach its security using techniques covered in the unit.
    Weighting:
    10%
    Criteria for assessment:

    Report contents will be marked on the following attributes:

    • Identification of vulnerabilities in the supplied software (40%);
    • Implementation of exploits for and countermeasures to vulnerabilities (40%); and
    • Quality of the submitted report (20%).
    Due date:
    Week 12

Examinations

  • Examination 1
    Weighting:
    50%
    Length:
    2 hours
    Type (open/closed book):
    Closed book
    Electronic devices allowed in the exam:
    None

Learning resources

Monash Library Unit Reading List (if applicable to the unit)
http://readinglists.lib.monash.edu/index.html

Faculty of Information Technology Style Guide

Feedback to you

Examination/other end-of-semester assessment feedback may take the form of feedback classes, provision of sample answers or other group feedback after official results have been published. Please check with your lecturer on the feedback provided and take advantage of this prior to requesting individual consultations with staff. If your unit has an examination, you may request to view your examination script booklet, see http://intranet.monash.edu.au/infotech/resources/students/procedures/request-to-view-exam-scripts.html

Types of feedback you can expect to receive in this unit are:

  • Informal feedback on progress in labs/tutes
  • Graded assignments without comments
  • Interviews

Extensions and penalties

Returning assignments

Assignment submission

It is a University requirement (http://www.policy.monash.edu/policy-bank/academic/education/conduct/student-academic-integrity-managing-plagiarism-collusion-procedures.html) for students to submit an assignment coversheet for each assessment item. Faculty Assignment coversheets can be found at http://www.infotech.monash.edu.au/resources/student/forms/. Please check with your Lecturer on the submission method for your assignment coversheet (e.g. attach a file to the online assignment submission, hand-in a hard copy, or use an online quiz). Please note that it is your responsibility to retain copies of your assessments.

Online submission

If Electronic Submission has been approved for your unit, please submit your work via the learning system for this unit, which you can access via links in the my.monash portal.

Other Information

Policies

Monash has educational policies, procedures and guidelines, which are designed to ensure that staff and students are aware of the University’s academic standards, and to provide advice on how they might uphold them. You can find Monash’s Education Policies at: www.policy.monash.edu.au/policy-bank/academic/education/index.html

Key educational policies include:

Faculty resources and policies

Important student resources including Faculty policies are located at http://intranet.monash.edu.au/infotech/resources/students/

Graduate Attributes Policy

Student Charter

Student services

Monash University Library

Disability Liaison Unit

Students who have a disability or medical condition are welcome to contact the Disability Liaison Unit to discuss academic support services. Disability Liaison Officers (DLOs) visit all Victorian campuses on a regular basis.

[an error occurred while processing this directive]