SWE 781

George Mason University
Department of Information and Software Engineering
SWE 781 - Secure Software Design and Programming

Spring 2007
Dr. Edward Schneider

(703) 845-6626 (Office) / ESchneider@ise.gmu.edu

Final exam, nominally due by email at noon on Thursday, 10 May, but I will accept it until 10:00 with no penalty.

Some possible presentation topics are: Virtual Machine Security, Misuse Cases, Automated Tools, Secure Web Application Input, Federated Identity Management, Business Case for Software Assurance, Software Assurance Measures
The DHS site BuildSecurityIn is a good reference and some other ideas.

Topics:

24 January: Introduction to Software Assurance.
- Viega and McGraw: Chapter 1.
- David A. Wheeler. Secure Programmer: Developing Secure Programs. IBM developerWorks, August 2003.
- Class slides.
31 January: Managing Risk, Common Criteria.
- Viega and McGraw: Chapter 2.
- Wheeler: Chapter 4.
- Common Criteria Part 3, v3.0.
- NIST. Risk Management Guide for Information Technology Systems. SP 800-30, July 2002.
- Class slides.
7 February: Selecting Technologies.
- Viega and McGraw: Chapters 3 and 4.
- Wheeler: Section 2.4.
- David A. Wheeler. Why Open Source Software / Free Software (OSS/FS, FLOSS, or FOSS)? Look at the Numbers!. November 2005.
- Class slides.
- Information Assurance Directorate, National Security Agency. U.S. Government Protection Profile for Separation Kernels in Environments Requiring High Robustness. Draft version .621, July 2004
14 February: Principles of Software Assurance
- Viega and McGraw: Chapter 5.
- Jerome H. Saltzer, and Michael D. Schroeder. The Protection of Information in Computer Systems (invited tutorial paper). Proceedings of the IEEE 63,9 (September 1975), 1278-1308.
- Benzel, T. V., Irvine, C. E., Levin, T. E., Bhaskara, G., Nguyen, T. D., and Clark, P. C. Design Principles for Security. NPS-CS-05-010, Naval Postgraduate School, September 2005.
- NIST. Engineering Principles for Information Technology Security. SP 800-27A, June 2004.
- Class slides.
21 February: Buffer Overflows
- Viega and McGraw: Chapter 7.
- Wheeler: Chapter 6.
- David A. Wheeler. Secure Programmer: Countering Buffer Overflows. IBM developerWorks, January 2004.
- Class slides.
28 February: Access Control, Input Validation
- Viega and McGraw: Chapters 8 and 12.
- Wheeler: Chapter 5.
- David A. Wheeler. Secure Programmer: Validating Input. IBM developerWorks, October 2003.
- David A. Wheeler. Secure Programmer: Keep an Eye on Inputs. IBM developerWorks, December 2003.
- Class slides.
7 March: Midterm exam. Open book and notes.
14 March: Spring Break.
21 March: Review exam, password, Databases.
- Viega and McGraw: Chapters 13 and 14.
- Wheeler: Section 11.1.
- Class slides.
28 March: Race Conditions
- Viega and McGraw: Chapter 9.
- Wheeler: Section 7.11.
- David A. Wheeler. Secure Programmer: Prevent Race Conditions. IBM developerWorks, October 2004.
- Class slides.
4 April: Cryptography and Randomness.
- Viega and McGraw: Chapters 10 and 11.
11 April: Seven Touchpoints.
- Viega and McGraw: Chapter 6.
- Gary McGraw. Software Security: Building Security In. Pillar chart. Touchpoint chart.
18 April: Formal Methods
- Class slides.
25 April: Presentations
2 May: Presentations

Syllabus

The September issue of CrossTalk is a special issue on Software Assurance.

An article that is appropriate for the class:

Gary Anthes. DOD Report to Detail Dangers of Foreign Software. Computerworld, 27 November 2006.