Hide menu

TDDC90 Software Security (6 ECTS)


Literature - Mandatory

The literature for this course is a collection of papers. Some papers may be accessible only via the university library's website. All papers listed below and the lecture notes are manadory reading for the exam. There is also a separate list of additional material to give you a deeper understanding of the topics (not required for the exam).

Lecture 1: Introduction

      K. M. Goertzel. Introduction to software security
      D. Wheeler. Secure Programmer: Developing Secure Programs

Lectures 2 and 3: Vulnerabilities, exploits and prevention

We are mainly concerned with the principles. Note that some of the required papers may cover attacks on protection mechanisms. You will be expected to understand both the principles of the protection mechanisms and the principles of the attack.

      J. Pincus, B. Baker. Beyond stack smashing: recent advances in exploiting buffer overruns. IEEE Security & Privacy. 2004.
      blexim. Basic Integer Overflows
      D. Wheeler. Secure Programmer: Prevent Race Conditions (link updated 2013-11-14)
      A. I. Sotirov. Automatic Vulnerability Detection Using Static Source Code Analysis. Master's Thesis, University of Alabama, 2005. Read chapters 1-3 only
    S. Alexander. Defeating compiler-level buffer overflow protection. ;login:, June 2005.

Lecture 4: Secure software development

      G. McGraw. The 7 Touchpoints of Software Security
      N. Davis. Secure Software Development LifeCycle Processes
      P. Hope, S. Lavenhar, G. Peterson. Architectural Risk Analysis (link updated 2013-08-16)
      G. McGraw. Risk Management Framework (link updated 2013-08-16)
      N. Mead. Security Requirements Engineering (link updated 2013-08-16)
      N. Mead. SQUARE Process (link updated 2013-08-16)
      C. Dougherty, K. Sayre, R. C. Seacord, D. Svoboda, K. Tagashi. Secure Design Patterns. Technical Report CMU/SEI-2009-TR-010.
        B. Schneier. Attack trees: modeling security threats. Dr.Dobb's Journal, December 1999.
        G. Sindre, A. Opdahl. Capturing Security Requirements through Misuse Cases
        L. Røstad. An extended misuse case notation: Including vulnerabilities and the insider threat. In Proceedings of the 12th Working Conference on Requirements Engineering: Foundation for Software Quality (REFSQ'06), 2006.

Lecture 5: Software engineering reviews

There is no mandatory reading for this lecture, except the slides, but we reccommend that you read the additional material on code inspections before this lecture.

Lecture 6 and 7: Static analysis

      P. Emanuelsson, U. Nilsson. A comparative study of industrial static analysis tools (extended version).
      V. B. Livshits, M. Lam. Finding Security Vulnerabilities in Java Applications with Static Analysis

Lecture 8: Web security


Lecture 9: Accreditation

There is no mandatory material, except the slides, for the guest lecture on common criteria (lecture 9), but we reccommend that you look at the additional material for this topic.

Lecture 10: Security testing

Some of the papers in this section describe specific tools. These tools are representative of a class of approaches to static or dynamic analysis. You will be expected to understand the principles and ideas behind the tools, but you are not required to remember details about individual tools.

      P. Oehlert. Violating assumptions with fuzz testing. IEEE Security & Privacy, 2005.

From the following paper you need to understand the concept and use of whitebox fuzz testing. You do not need to understand the specific algorithm. Read section 1 and the conclusions of section 4 and 6. Skim through the rest of ther material to get an overview.

      P. Godefroid, M. Levin, D. Molnar. Automated Whitebox Fuzz Testing. Microsoft Research Technical Report MSR-TR-2007-58.
      N. Provos, M. Friedl, P. Honeyman. Preventing privilege escalation. In Proceedings of the 12th USENIX Security Symposium. August 2003.
      D. Wheeler. Secure Programmer: Validating Input (link updated 2013-11-14)
      D. Wheeler. Secure Programmer: Keep an Eye on Inputs (link updated 2013-11-14)

Page responsible: Nahid Shahmehri
Last updated: 2014-10-30