P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg titulka
PA193 Secure coding principles and practices
Overview of the subject
•Petr Švenda, Petr Ročkai, Milan Patnaik, Marek Sýs, Kamil Dudka, Mirek Jaroš, Martin Ukrop, Jan
Masarik
I      PA193 - Introductory info
1

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
PA193 Secure coding principles and practices
•Secure coding
–How to write code in a more secure way
–So that the program is harder to be attacked/exploited
–Selected basic building blocks of security applications
•2/2/2
–Lecture: 2 hours weekly
–Seminar: 2 hours weekly
–Homework: about 6-? hours/each
–Project: about 30-40 hours/person
I      PA193 - Introductory info
2

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
People
•Main contact: Petr Švenda (CRoCS@FI MU)
–Office hours: Tuesday 13:00-13:50, A406
–svenda@fi.muni.cz,    @rngsec
–https://keybase.io/petrs
–https://crocs.fi.muni.cz/people/svenda
•Other lectures and seminars
–Milan Patnaik (DRDO) Marek Sýs (FI), Jan Masrik (Kiwi) Kamil Dudka (RedHat), Mirek Jaroš (RedHat),
Martin Ukrop (FI)
–
3
I      PA193 - Introductory info
A picture containing clipart Description automatically generated

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
Aims of the subject
•To learn how to program in a way that the resulting application is more secure
–Decrease number of security related bugs
–Increase difficulty of exploitation
•To understand security consequences of decisions made by programmer
•Most issues are independent on particular programming language
–examples will be mostly based on C/C++ and Java
I      PA193 - Introductory info
4

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
Previous knowledge requirements
•Basic knowledge of (applied) cryptography and IT security
–symmetric vs. asymmetric cryptography, PKI
–block vs. stream ciphers and usage modes
–hash functions
–random vs. pseudorandom numbers
–basic cryptographic algorithms (AES, DES, RSA, EC, DH)
–risk analysis
•Basic knowledge in formal languages and compilers
•User-level experience with Windows and Linux OS
•Practical experience with C/C++/Java language
•
I      PA193 - Introductory info
5

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
Organization
•Lectures + seminars + assignments + project + exam
•Assignments
–10 homework assignments
–Individual work of each student
–Lab A403 available to students (except teaching hours)
•Project
–Team work (2-3 members)
–Details next week (cryptowallet derivation, CI, fuzzing…)
•Exam
–Written exam, open questions, pencil-only
•
I      PA193 - Introductory info
6

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
Grading
•Credits
–2+2+2 credits, plus 2 for the final exams
•Points [Notice minimal number of points required!]
–Homework (50) – [minimum 25 required]
–Project (20) – [minimum 10 required]
–Written exam (50) – [minimum 25 limit]
–Occasional bonuses J
–TLDR: must get at least half points from each area
•Grading 120 (max)
–A ≥ 110
–B ≥ 100
–C ≥ 90
–D ≥ 80
–E ≥ 65
–F < 65
–
•
I      PA193 - Introductory info
7

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
Attendance
•Lectures
–Attendance not obligatory, but highly recommended
•Seminars
–Attendance obligatory
–Absences must be excused at the department of study affairs
–2 absences are OK (even without excuse)
•Assignments and projects
–Done during student free time (e.g. at the dormitory)
–Access to network lab and CRoCS lab is possible
I      PA193 - Introductory info
8

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
Discussion forum in Information System
•Discussion forum in Information System (IS)
–https://is.muni.cz/auth/cd/1433/podzim2019/PA193/
•Mainly for discussion among the students
–Not observed by stuff all the time!
–Write us email if necessary
•What to ask?
–OK to ask about ambiguities in assignment
–NOT OK to ask for the solution
–NOT OK to post your own code and ask what is wrong
9
I      PA193 - Introductory info

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
Plagiarism
•Homeworks
–Must be worked out independently by each student
•Projects
–Must be worked out by a team of 3 students
–Every team member must show his/her contribution
•Plagiarism, cut&paste, etc. is not tolerated
–Plagiarism is use of somebody else words/programs or ideas without proper citation
–Automatic tools used to recognize plagiarism
–If plagiarism is detected student is assigned -7 points
–More serious cases handled by the Disciplinary committee
I      PA193 - Introductory info
10
opisovani

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
Reuse of existing code
•Code reuse is generally great thing, but..
•NOT in homework or assignments!
•It is NOTOK:
–Take any code from web when you should create code completely on your own (project - parser)
–Share code of your solution with others (homework)
11
I      PA193 - Introductory info

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
12
I      PA193 - Introductory info

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
13
I      PA193 - Introductory info

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
Course resources
•Lectures (PDF) available in IS
–IS = Information System of the Masaryk University
–https://is.muni.cz/auth/el/1433/podzim2019/PA193/
•Homeworks/assignments available in IS
–Submissions also done via IS (Homework vaults)
•Additional tutorials/papers/materials from time to time will also be provided in IS
–To better understand the issues discussed
•Recommended literatures
–To learn more …
I      PA193 - Introductory info
14

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
Recommended literature
•Ross Anderson - Security
engineering, Wiley
•Michael Howard, Steve Lipner - Secure Development Lifecycle, MS Press
•John Viega, Matt Messier - Secure
programming cookbook, O'Reilly
•Michael Howard - Writing
secure code, MS Press
•
book2coverlarge 0735637474 cat X
I      PA193 - Introductory info
15

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
Lectures and content
•16. 9. Intro, Language level vulnerabilities: Buffer overflow, type overflow, strings (PS)
•23. 9. Security testing: blackbox vs. whitebox testing, static analysis (PS)
•30. 9. Security testing: dynamic analysis, fuzzing (PS)
•7. 10. Security code review, automata-based programming, securing API (PS, KD)
•14. 10. Exploits writing (MP)
•21. 10. Return-oriented Programming (MP)
16
I      PA193 - Introductory info
PS – Petr Švenda, KD – Kamil Dudka, MP – Milan Patnaik

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
Lectures and content
•28. 10. Security primitives: secure channel, secure storage, key management (PS)
•4. 11. Web programming security, 3rd party libs security, patch management (JM)
•11. 11. Integrity of modules, parameters, temp files (PR)
•18. 11. Proper use of (pseudo)-random data (MS)
•25. 11. Defense in depth (PR)
•2. 12. Concurrent issues: IPC, race conditions (PR)
•9. 12. Access control, privilege separation (PR)
•
17
I      PA193 - Introductory info
PS – Petr Švenda, JM – Jan Masarik, PR – Petr Ročkai, MS – Marek Sýs
National holidays, no lecture

P:\CRCS\2012_0178_Redesign_loga_a_JVS\PPT_prezentace\sablona\pracovni\normalni.jpg
•
18
I      PA193 - Introductory info
question
Questions