C/C++ Secure Coding

#text-block-10 { margin-bottom:0px; text-align:left; }

IT security and secure coding

* Nature of security
* IT security related terms
* Definition of risk
* IT security vs. secure coding
* From vulnerabilities to botnets and cyber crime
* Classification of security flaws

Security relevant C/C++ programming bugs and flaws

* Exploitable security flaws
* Protection principles
* x86 machine code, memory layout, stack operations

Buffer overflow

* Buffer overflow
* Stack overflow
* Protection against stack overflow
* Stack smashing protection
* Address Space Layout Randomization (ASLR)
* Non executable memory areas – the NX bit
* Return-to-libc attack – Circumventing the NX bit
* Return oriented programming (ROP)
* Heap overflow

#text-block-11 { margin-bottom:0px; text-align:left; }

Common coding errors and vulnerabilities

* Input validation
* Improper use of security features
* Improper error and exception handling
* Time and state problems
* Code quality problems

Advices and principles

* Matt Bishop’s principles of robust programming
* The security principles of Saltzer and Schroeder

Knowledge sources

* Secure coding sources – a starter kit
* Vulnerability databases