Lectures and Artifacts
Lecture materials and artifacts in the following categories are available for use in a software assurance program or track. For more information, contact us by mail at swa-education [@] sei.cmu.edu.
SQUARE
Security Quality Requirements Engineering (SQUARE) is a nine-step process to help organizations build security into the early stages of the production lifecycle. The following five lectures with notes are available for download.
- Lecture 1: Security in Software Engineering defines secure software engineering and explains the importance of considering security issues throughout the
software development lifecycle, particularly during requirements engineering
- Lecture 2: SQUARE Overview explains how the SQUARE process is conducted and gives brief descriptions of each of its nine steps
- Lecture 3: SQUARE in Detail, Part 1 describes SQUARE Steps 1 through 4 in detail
- Lecture 4: SQUARE in Detail, Part 2 describes SQUARE Steps 5 through 9 in detail
- Lecture 5: SQUARE for Acquisition describes how SQUARE can be easily tailored and modified for various acquisition scenarios.
Secure Programming
The Secure Programming course provides a detailed explanation of common programming errors in C and C++ and describes how these errors can lead to software systems that are vulnerable to exploitation. Identifying the root causes of software vulnerabilities and developing secure coding practices may enable software producers to prevent introduction of vulnerabilities into deployed software systems, thereby producing greater software assurance. The course concentrates on security issues intrinsic to the C and C++ programming languages and associated libraries. It does not emphasize security issues involving interactions with external systems such as databases and web servers, as these are rich topics on their own. Topics to be covered include the secure and insecure use of integers, arrays, strings, dynamic memory, formatted input/output functions, and file I/O.
An online demonstration version of the integer module of the secure coding course can be accessed at http://oli.web.cmu.edu. You must register as a student to view the material by entering the course key seccode. This material is in the book Secure Coding in C and C++ by Robert C. Seacord. If you don’t have the book, or if you want to see the technology in action, you may find this demonstration version of interest.
Secure Software Management
This course, taught by Dan Shoemaker at the University of Detroit Mercy, is rooted in the fundamental organizing principles and control techniques delineated by the ISO/IEEE 12207 (.0) and the ISO 15288 Standard. These two standards array the basic elements of the software process into an infrastructure for the strategic management of software organizations. However, while they define the processes that underlie all forms of development, maintenance and operation, they do not provide a specific approach for ensuring capable performance of software work. Since there are internationally recognized standards that serve this purpose, several will be examined in-depth. These include CMM, CMMi and ISO 15504 (SPICE) and the PSP/TSP. The course materials are available for download in ZIP format. The lecture slides are in PDF format; if you would like the PowerPoint files, please contact Dan at dan.shoemaker [@] att.net.
Software Security Engineering
This course was taught by Dr. Nancy Mead at Carnegie Mellon University. Lectures, case studies, and homework assignments in a .zip file are available for download.
Course description: It is increasingly important for software engineers to understand how to develop secure software. Because software systems are increasingly under attack, methods for developing secure systems need to be considered at each stage of development. This course focuses on methods and practices for the development of secure software systems, including lifecycle process models; risk management; requirements engineering; architecture and design; coding and testing; and governance and management. As time permits, acquisition of newly developed and COTS software will also be discussed. Students will acquire an understanding of the fundamental concepts for developing secure systems and access to resources for more detailed follow-up studies. Prerequisite: Prior software engineering or computer security course, or instructor permission.
Case Studies
Altran Praxis developed a case study for the National Security Agency that demonstrates correct software by construction using formal specification and verification. With the proper tools (which are available to academic users for free), you can compile and execute the implementation, which uses a subset of Ada. In addition, you can use the verification tools to check the formal proofs. For more information, go to the Altran Praxis website or review the case study report.
The University of Virginia provides links to several case studies that cover system safety case concepts in a variety of domains: Eurocontrol air navigation and airspace, electrical current limiting devices on power distribution networks, a geological repository for radioactive waste, and the London Underground railway system. The university site also provides link to several papers that cover dependability, survivability, and security.
Static Analysis for Software Quality
This seminar from Carnegie Mellon University Associate Professor Jonathan Aldrich enables attendees to
- understand the benefits of analysis and how it complements techniques like testing or inspection
- grasp the basics of static analysis technology
- know some analysis tools that are available and properties of others that are on the horizon
- evaluate current and future commercial analysis tools for use in their organization
- develop a plan for introducing analysis into their organization
Insider Threat
|
|
