CS412 Software Security
Mathias Payer -- Spring semester 2019, 6 ECTS
course.
Course overview
This course focuses on software security fundamentals, secure coding guidelines
and principles, and advanced software security concepts. Students will learn to
assess and understand threats, learn how to design and implement secure software
systems, and get hands-on experience with common security pitfalls.
The course consists of three lectures per week (45 minutes each), a two hour lab,
and a one hour practice session for Q&A. Refer to the EPFL CS412 Moodle for Q&A,
information about the project, and other discussions.
Book for the course: Software Security: Principles, Policies, and Protection
- Class: Tuesday 10:15 to 13:00 in INF 119 (from Feb 19 to May 28).
- Exercises: Thursday 15:15 to 16:00 in INJ 218
- Practical work: Thursday 16:15 to 17:00 in INJ 218
Course objectives
Software running on current systems is exploited by attackers despite many
deployed defence mechanisms and best practices for developing new software. In
this course students will learn about current security threats, attack vectors,
and defence mechanisms on current systems. The students will work with real
world problems and technical challenges of security mechanisms (both in the
design and implementation of programming languages, compilers, and runtime
systems).
Learning outcomes
Students who complete the course will have demonstrated the ability to do the
following:
- Explain the top 20 most common weaknesses in software security (CWE top 20) and
understand how such problems can be avoided in software.
- Identify common security threats, risks, and attack vectors for software
systems.
- Evaluate and assess current security best practices and defense mechanisms for
current software systems. Become aware of limitations of existing defense
mechanisms and how to avoid them.
- Identify security problems in source code and binaries, assess the associated
risks, and reason about their severity and exploitability.
- Assess the security of given source code or applications.
Grading
- Lab assignments (CTF): 25%
- Programming project: 25%
- Midterm exam: 20%
- Final exam: 30%
Course policies
This course will be run under the "reasonable adults" policy wherein it is
assumed that all students are reasonable adults that want to benefit the most of
the course by attending the course regularly, completing the homework
assignments and projects on time, asking questions during the course and if they
run into problems, and checking back with the instructor and the TA regularly to
ensure good progress.
In short: (i) you are expected to attend all classes (modulo good reasons), (ii)
you are supposed to hand in all work before the deadlines (late hand-ins receive
no credit), (iii) if you need special treatment or have special circumstances,
talk to the instructor or TA.
References and Reading Assignments