SE 6310 : Secure Software Engineering

SE 6310: Secure Software Engineering

Semester Hours:   3.0
Contact Hours:   3
Coordinator:   Yan Wu
Text:   Software Security: Building Security In
Author(s):   Gary McGraw
Year:   2006

SPECIFIC COURSE INFORMATION

Catalog Description

Techniques for creating software that is secure. Topics include secure design principles, risk analysis, secure application architectures, modeling tools, common software vulnerabilities, assurance techniques, secure programming, code reviews, and security testing. Prerequisite: Full Admission to MS in CS program or consent of department is required for enrollment.

Course type: ELECTIVE

SPECIFIC COURSE GOALS

• I understand the distinction between software engineering and secure software engineering.
• I am able to compare and contrast various secure software life-cycle models.
• I understand the secure software engineering guidelines and cite examples of their application.
• I know how to identify certain security risks of applications through code reviews and software tools.
• I am able to explain security vulnerabilities of software constructs and applications, as well as the mechanisms for countering them.
• I have an appreciation for use of models in helping one understand vulnerabilities and attack patterns.
• I understand the security impact of applications - desktop, mobile, web or cloud.
• I know the limits of program testing.
• I can critically analyze a software project from security perspective and express the findings in written and oral form.

LIST OF TOPICS COVERED

• Introduction
• Process life cycles
• Impact on security
• Secure Development
  • Secure life cycles
  • Comparison with traditional methods
  • Principles of secure software engineering
• Software Vulnerabilities
  • Language based security
  • Static Analysis
• Software Security Architecture
  • Cloud computing
  • Mobile applications
  • Web applications
• Tools
  • Testing and least common mechanisms
  • Code Inspection
• Modeling
  • Attack trees
  • Threat Modeling
  • Risk Analysis
• Information Assurance