USF Sarasota-Manatee CIS 3615: Secure Software Development Spring 2014 Wednesdays 6:00 9:00 PM EST

Transcription

1 USF Sarasota-Manatee CIS 3615: Secure Software Development Spring 2014 Wednesdays 6:00 9:00 PM EST Instructor: John Collins Office: N/A Office Hours: By Appointment Canvas will be used in this class for all sessions. Group chat rooms, assignments, announcements, etc. will be handled via this application and the tools listed on it. Classes are Asynchronous and students are not required to attend live classes but are required to view the classes. Students must attend the first class or they will be automatically dropped. COURSE DESCRIPTION AND PURPOSE: Information is power. It also has value. Thus, there is an incentive for unscrupulous individuals to steal information. This course covers a number of different techniques to help developers to build enterprise-level systems that are secure and safe. The goal of this course is to provide students with the knowledge and skills to develop enterprise-level systems that are safer and more secure. The techniques presented here will increase the effort needed by hackers to successfully launch attacks on enterprise software applications. COURSE LEARNING OUTCOMES: On completing this course, students will: Understand vulnerability and the variety of possible attacks Be able to apply the Security Development Lifecycle Be able to construct secure UNIX/Linux-based programs Understand Networking and SOA-based Security Be able to implement Java Client-Side Security Be able to implement Mobile Application Security Be able to secure Web-Facing Applications Be able to implement Java Server-Side Security Be able to construct Secured Web Services TEXT AND MATERIALS: (Required) Asoke K. Talukder and Manish Chaitanya, Architecting Secure Software Systems. CRC Press, 2009 ISBN-13: (Required) Sunny Wear. Sunshine on Secure Software: Baking Security into your SDLC Process. GRADING, EVALUATION AND ATTENDANCE POLICIES: Student performance will be evaluated based on the practical assignments due. This is a hands on class and skills must be demonstrated. A grade will be determined based on the total of possible points earned, as follows: A A A B

2 B B C C C D D D F Notice: permission to sell or redistribute notes or tapes of class lectures is forbidden. Do not replicate or pass along any items related to this course. COP 3515 Requirements and Program Design; COP 3601 Systems Programming (Java EE) COURSE SCHEDULE: Week 1 (Jan 8) Course Introduction Talukder Chapter 1, Security in Software Systems Week 2 (Jan 15) Assignments due by end of class (10 points): * Setup an Eclipse IDE. Be sure to include - ProGuard - FindBugs - EclEmma -Tomcat If you are not able to attend the lab class me a screenshot of your IDE, with the Help > About Eclipse. There should be a set of tool icons. Also attach a screen shot of the Tomcat server running. This is due before the conclusion of class. Week 3 (Jan 22) Talukder Chapter 2, Architecting Secure Software Systems Talukder Chapter 3, Constructing Secured and Safe C/UNIX Programs Week 4 (Jan 29) Talukder Chapter 5, Networking and SOA-Based Security 2

3 Week 5 (Feb 5) Assignments due by the conclusion of class (20 points): * In Java, Create a class with a main method, which takes a String object, converts it to an integer and returns the result. Validate that the integer is between 1 to 10. * Create unit tests for bounds testing. Be sure to check negative infinity, a large negative, a small negative, everything on and next to the low bounds, a midrange value, etc. Don't forget to use encoded, nonprintable, and character data in unit tests. What is notable about infinite numbers in Java? * Use Eclipse and Provide a screen shot and analysis of Eclemma * Go find or make some poor code that causes results in FindBugs to generate results. Week 6 (Feb 12) Talukder Chapter 6, Java Client-Side Security Week 7 (Feb 19) Talukder Chapter 7, Security in Mobile Applications Week 8 (Feb 26) Assignments due by the conclusion of class (20 points): Research how to sign a JAR with jar signer (part of the JDK). Write up the instructions for deployment of a signed JAR. Explain why you would do this and look at any issues that users may encounter. * Create an example of SQL Injection and Cross Site Scripting. Once you are done, encode the attacks using UTF-8 and URL encoding. Week 9 (Mar 5) Talukder Chapter 8, Security in Web-Facing Applications Week 10 (Mar 12) Spring Break No Class, next week's homework is somewhat involved. I recommend getting started soon. 3

4 Week 11 (Mar 19) *** LAST DAY TO DROP WITH A W IS MAR !!! *** Week 12 (Mar 26) Assignments due by end of class (20 points): The Servlet API states that Servlets are single threaded. Write a Servlet that demonstrates how improperly scoped variables can expose user data, test your code with 2 browser sessions to see if you can get one sessions data from the other. Submit the code and a screen shot. Talukder Chapter 9, Server-Side Java Security Week 13 (Apr 2) Assignments due by end of class (10 points): * Create a self signed certificate and add it to your Browser s trust store, provide the instructions you used and a screen shot. *Create a server certificate and configure the Web Server with it to allow for HTTPS. Include creation steps and provide all the instructions used. * Configure HTTPS SSL Client Authentication. Include a screen shot of the HTTPS connection to the server. Provide a screen shot of the 2 way SSL connection. Week 14 (Apr 9) Talukder Chapter 10, Constructing Secured Web Services Week 15 (Apr 16) Course Wrap-up and final assignments due by end of class (20 points): * Create a project that uses RBAC and a login page that uses a JDBC realm. Submit the deployment. RELIGIOUS OBSERVANCES: The University recognizes the right of students and faculty to observe major religious holidays. Students who anticipate the necessity of being absent from class for a major religious observance must provide notice of the date(s) to the instructor, in writing, by the second week of classes. DISABILITIES ACCOMMODATION: Students are responsible for registering with the Office of Students with Disabilities Services (SDS) in order to receive academic accommodations. Reasonable notice must be given to the 4

5 SDS office (typically 5 working days) for accommodations to be arranged. It is the responsibility of the student to provide each instructor with a copy of the official Memo of Accommodation. Contact Information: Pat Lakey, Coordinator plakey@sar.usf.edu ACADEMIC DISHONESTY: The University considers any form of plagiarism or cheating on exams, projects, or papers to be unacceptable behavior. Please be sure to review the university s policy in the catalog, USFSM Undergraduate Catalog or USFSM Graduate Catalog and the USF Student Code of Conduct. Undergraduate: Graduate: USF Student Code of Conduct: ACADEMIC DISRUPTION: The University does not tolerate behavior that disrupts the learning process. The policy for addressing academic disruption is included with Academic Dishonesty in the catalog:, USFSM Undergraduate Catalog or USFSM Graduate Catalog and the USF Student Code of Conduct. Undergraduate: Graduate: USF Student Code of Conduct: CONTINGENCY PLANS: In the event of an emergency, it may be necessary for USFSM to suspend normal operations. During this time, USFSM may opt to continue delivery of instruction through methods that include but are not limited to: CANVAS, Elluminate, Skype, and messaging and/or an alternate schedule. It s the responsibility of the student to monitor the class site for each class for course specific communication, and the main USFSM and College websites, s, and MoBull messages for important general information. The USF hotline at 1 (800) is updated with pre-recorded information during an emergency. EMERGENCY PREPAREDNESS: It is strongly recommended that you become familiar with the USF Sarasota-Manatee Emergency Action Plan on the Safety Preparedness site FIRE ALARM INSTRUCTIONS: At the beginning of each semester please note the emergency exit maps posted in each classroom. These signs are marked with the primary evacuation route (red) and secondary evacuation route (orange) in case the building needs to be evacuated. 5