Software Security

Learning Outcomes

This course provides students with theoretical and practical knowledge for designing, developing, testing and maintaining secure software. It covers the secure software development lifecycle, threat modeling, secure coding, web/API security, developer-oriented cryptography, security testing, software supply chain security, DevSecOps and secure deployment in cloud/container environments.

Upon successful completion of the course, students will be in position to:

• Explain confidentiality, integrity and availability goals, and correctly use the concepts of threat, vulnerability, exploit and risk.
• Integrate security requirements, abuse cases, secure design reviews and security gates into SDLC, agile and DevOps processes.
• Produce threat models using STRIDE, attack trees, data-flow diagrams, trust boundaries and justified risk ranking.
• Identify and fix secure coding mistakes
• Analyze common vulnerability classes, including memory safety bugs, injection, XSS, broken access control, CSRF, session flaws and cryptographic misuse.
• Use safe libraries for password hashing, encryption, TLS and key management, avoiding unsafe custom cryptography.
• Apply verification techniques such as code review, SAST, DAST, SCA, fuzzing, ASVS-based testing and CWE mapping, and triage findings by severity.
• Evaluate software supply chain, CI/CD, container, cloud IAM and IaC misconfiguration risks and propose appropriate mitigations.

Professionally document a security finding and present a threat model, controlled exploit, fix and security report.

Course Contents

The main objective of the course is to familiarize students with the principles, methods and tools required to build secure software throughout its lifecycle. The course combines theory, analysis of real-world vulnerabilities and hands-on laboratory work in isolated environments, emphasizing risk understanding, secure implementation, verification and documented remediation.

More specifically, the course content is the following:

1. Introduction to Software Security: confidentiality, integrity, availability, threat, vulnerability, exploit, risk, ethics and legal boundaries.
2. Secure Software Development Lifecycle: security requirements, abuse cases, secure design reviews, NIST SSDF and security gates in agile/DevOps.
3. Threat Modeling: STRIDE, attack trees, trust boundaries, data-flow diagrams and risk ranking.
4. Secure Coding Foundations: input validation, output encoding, error handling, logging, fail-safe defaults and secure coding standards.
5. Memory Safety and Low-Level Vulnerabilities: buffer overflows, use-after-free, integer bugs, format strings and memory-safe languages.
6. Web Security I – Injection and XSS: SQL/NoSQL/command injection, cross-site scripting, template injection, sanitization versus encoding.
7. Web Security II – Authentication, Sessions and Access Control: authentication, authorization, session management, CSRF, broken access control, MFA and password storage.
8. Cryptography for Developers: hashing, password hashing, symmetric/asymmetric cryptography, TLS, key management and common crypto mistakes.
9. API and Microservice Security: REST/GraphQL security, OAuth 2.0/OIDC basics, JWT mistakes, rate limiting and service-to-service authentication.
10. Security Testing and Verification: SAST, DAST, SCA, fuzzing, code review, ASVS-based testing and CWE mapping.
11. Software Supply Chain and DevSecOps: dependency risks, SBOMs, package compromise, CI/CD security, secrets scanning and signed builds.
12. Cloud, Container and Deployment Security: container images, Kubernetes basics, IaC misconfigurations, cloud IAM, logging and monitoring.

Emerging Topics: AI/LLM application security, secure maintenance, vulnerability disclosure and incident response.

Suggested bibliography

1. McGraw, G. (2006). Software Security: Building Security In. Addison-Wesley.
2. Howard, M., LeBlanc, D. and Viega, J. (2010). 24 Deadly Sins of Software Security. McGraw-Hill.
3. Seacord, R. C. (2013). Secure Coding in C and C++, 2nd ed. Addison-Wesley.