Microsoft SDL Core Training Course

Day 1

IT Security and Secure Coding for Government

• Nature of Security in the Public Sector
• Key Terms Related to IT Security
• Definition of Risk for Government Operations
• Various Aspects of IT Security for Government Systems
• Requirements for Different Application Areas in the Public Sector
• Distinction Between IT Security and Secure Coding
• From Vulnerabilities to Botnets and Cybercrime
  • Nature of Security Flaws in Government Systems
  • Reasons for the Complexity of Security Challenges
  • Progression from an Infected Computer to Targeted Attacks on Government Networks
• Classification of Security Flaws
  • Landwehr’s Taxonomy for Government Use
  • The Seven Pernicious Kingdoms in Government Systems
  • OWASP Top Ten 2013 for Government Applications
  • Comparison of OWASP Top Ten from 2003 to 2013 for Government Context

Introduction to the Microsoft® Security Development Lifecycle (SDL) for Government

• Agenda
• Applications Under Attack in the Public Sector...
  • Evolution of Cybercrime Targeting Government Systems
  • Increasing Focus on Application-Level Attacks in the Public Sector
  • Prevalence of Vulnerabilities in Smaller ISV Applications Used by Government Agencies
• Origins of the Microsoft SDL for Government...
  • Security Timeline at Microsoft for Government Use
  • Which Government Applications Are Required to Follow SDL?
• Microsoft Security Development Lifecycle (SDL) for Government
  • Overview of the Microsoft SDL for Government
  • Pre-SDL Requirements: Security Training for Government Personnel
  • Phase One: Requirements Gathering and Analysis
  • Phase Two: Design and Architecture Review
  • Phase Three: Implementation and Development
  • Phase Four: Verification and Testing
  • Phase Five: Release – Response Plan for Government Systems
  • Phase Five: Release – Final Security Review for Government Applications
  • Phase Five: Release – Archiving of Documentation
  • Post-SDL Requirement: Ongoing Response and Maintenance
  • SDL Process Guidance for Line-of-Business (LOB) Apps in Government
  • SDL Guidance for Agile Methodologies in Government Projects
  • Importance of Process Improvement in Secure Software Development for Government

Secure Design Principles for Government Systems

• Attack Surface Management
  • Reducing the Attack Surface of Government Systems
  • Example of Attack Surface Reduction in a Government Application
  • Analyzing the Attack Surface of Government Networks
  • Examples of Effective Attack Surface Reduction Strategies
• Privacy Considerations for Government Applications
  • Ensuring Privacy in Government Systems
  • Understanding Application Behaviors and Privacy Concerns in the Public Sector
• Defense in Depth Strategy for Government Security
  • Core Principle of SDL: Defense In Depth for Government Systems
  • Example of Implementing Defense in Depth in a Government Application
• Least Privilege Principle for Government Applications
  • Example of Applying the Least Privilege Principle in Government Systems
• Secure Defaults for Government Software
  • Examples of Implementing Secure Defaults in Government Applications

Secure Implementation Principles for Government Systems

• Agenda
• Microsoft Security Development Lifecycle (SDL) for Government
• Buffer Overflow Basics for Government Developers
  • Intel 80x86 Processors – Main Registers in Government Systems
  • Memory Address Layout in Government Applications
  • Function Calling Mechanism in C/C++ on x86 for Government Use
  • Local Variables and the Stack Frame in Government Software
  • Stack Overflow Vulnerabilities in Government Systems
    • Buffer Overflow on the Stack in Government Applications
    • Exercises – Introduction to Stack Overflows in Government Systems
    • Exercise BOFIntro – Determining the Stack Layout in a Government Application
    • Exercise BOFIntro – A Simple Exploit for Government Systems
• Input Validation for Government Applications
  • Concepts of Input Validation in Government Software
  • Integer Problems in Government Systems
    • Representation of Negative Integers in Government Code
    • Integer Overflow Vulnerabilities in Government Applications
    • Arithmetic Overflow – Predicting the Output in a Government Context
    • Exercise IntOverflow – Identifying and Mitigating Integer Overflows in Government Systems
    • What is the Value of Math.Abs(int.MinValue) in a Government Application?
  • Mitigation Strategies for Integer Problems in Government Software
    • General Approaches to Mitigating Integer Problems in Government Applications
    • Avoiding Arithmetic Overflow – Addition in Government Code
    • Avoiding Arithmetic Overflow – Multiplication in Government Systems
    • Detecting Overflow with the Checked Keyword in C# for Government Use
    • Exercise – Using the Checked Keyword in C# for Government Applications
    • Handling Exceptions Triggered by Overflows in C# for Government Systems
  • Case Study – Integer Overflow Vulnerability in .NET for Government Applications
    • A Real-World Integer Overflow Example in a Government System
    • Exploiting the Integer Overflow Vulnerability in Government Software
  • Path Traversal Vulnerabilities and Mitigation Strategies for Government Systems
    • Preventing Path Traversal Attacks in Government Applications

Day 2

Secure Implementation Principles for Government Systems

• Injection Vulnerabilities in Government Software
  • Common SQL Injection Attack Methods in Government Databases
  • Blind and Time-Based SQL Injection Techniques in Government Applications
  • Methods for Protecting Against SQL Injection in Government Systems
  • Command Injection Vulnerabilities in Government Software
• Broken Authentication and Password Management in Government Systems
  • Exercise – Identifying Weaknesses in Hashed Passwords for Government Applications
  • Best Practices for Password Management and Storage in the Public Sector
  • Special Purpose Hash Algorithms for Secure Password Storage in Government Systems
• Cross-Site Scripting (XSS) Vulnerabilities in Government Applications
  • Understanding Cross-Site Scripting (XSS) in Government Software
  • CSS Injection Vulnerabilities in Government Systems
  • Exploiting XSS Through Other HTML Tags in Government Applications
  • Preventing XSS Attacks in Government Software
• Missing Function-Level Access Control in Government Systems
  • Strategies for Filtering File Uploads in Government Applications
• Practical Cryptography for Government Applications
  • Providing Confidentiality with Symmetric Cryptography in Government Systems
  • Overview of Symmetric Encryption Algorithms for Government Use
  • Block Ciphers – Modes of Operation in Government Software
  • Hash Functions or Message Digests for Government Applications
  • Hashing Algorithms for Government Systems
  • Message Authentication Codes (MAC) for Government Use
  • Ensuring Integrity and Authenticity with Symmetric Keys in Government Software
  • Providing Confidentiality with Public-Key Encryption for Government Applications
  • Rule of Thumb – Possession of Private Keys in Government Systems
  • Common Mistakes in Password Management for Government Applications
  • Exercise – Identifying Hard-Coded Passwords in Government Software
  • Conclusion on Cryptographic Best Practices for Government Use

Secure Verification Principles for Government Systems

• Differentiating Functional Testing from Security Testing in the Public Sector
• Identifying and Addressing Security Vulnerabilities in Government Applications
• Prioritizing Security Issues in Government Systems
• Integrating Security Testing into the SDLC for Government Projects
• Steps of Test Planning (Risk Analysis) for Government Software
• Scoping and Information Gathering for Government Applications
  • Identifying Stakeholders in Government Projects
  • Assessing Assets in Government Systems
  • Analyzing the Attack Surface of Government Networks
  • Defining Security Objectives for Testing in Government Applications
• Threat Modeling for Government Systems
  • Overview of Threat Modeling for Government Use
  • Developing Attacker Profiles for Government Applications
  • Threat Modeling Using Attack Trees in Government Software
  • Threat Modeling Based on Misuse/Abuse Cases in Government Systems
  • Example of Misuse/Abuse Cases in a Simple Web Shop for Government Use
  • STRIDE Per Element Approach to Threat Modeling – MS SDL for Government
  • Identifying Security Objectives Through Threat Modeling in Government Applications
  • Diagramming Techniques and Examples of DFD Elements for Government Use
  • Example of a Data Flow Diagram (DFD) for Government Systems
  • Enumerating Threats Using MS SDL’s STRIDE and DFD Elements in Government Software
  • Risk Analysis – Classifying Threats in Government Applications
  • The DREAD Threat/Risk Ranking Model for Government Use
• Security Testing Techniques and Tools for Government Systems
  • General Approaches to Security Testing in the Public Sector
  • Techniques for Various Steps of the SDLC in Government Projects
• Code Review for Secure Software Development in Government
  • Conducting Code Reviews for Security in Government Applications
  • Performing Taint Analysis in Government Systems
  • Applying Heuristics to Identify Security Issues in Government Code
• Static Code Analysis for Government Applications
  • Overview of Static Code Analysis for Government Use
  • Exercise – Utilizing Static Code Analysis Tools in Government Projects
• Testing the Implementation Phase of Government Systems
  • Conducting Manual Run-Time Verification for Government Applications
  • Comparing Manual and Automated Security Testing in Government Software
  • Performing Penetration Testing on Government Systems
  • Stress Testing Government Applications
• Fuzzing for Automated Security Testing in Government Systems
  • Introduction to Fuzzing for Government Use
  • Challenges of Implementing Fuzzing in Government Applications
• Web Vulnerability Scanners for Government Systems
  • Exercise – Using a Vulnerability Scanner in a Government Application
• Checking and Hardening the Environment for Government Systems
  • Understanding the Common Vulnerability Scoring System (CVSS) for Government Use
  • Utilizing Vulnerability Scanners in Government Networks
  • Accessing Public Databases for Security Information in the Public Sector
• Case Study – Forms Authentication Bypass in Government Applications
  • NULL Byte Termination Vulnerability in Government Systems
  • Identifying the Forms Authentication Bypass Vulnerability in Government Code
  • Exploiting the Forms Authentication Bypass in a Government Application

Knowledge Sources for Secure Coding in Government Systems

• Secure Coding Resources – A Starter Kit for Government Developers
• Vulnerability Databases for Government Use
• .NET Secure Coding Guidelines at MSDN for Government Applications
• .NET Secure Coding Cheat Sheets for Government Use
• Recommended Books on .NET and ASP.NET Security for Government Developers