Duration
2 days
Overview
InfoSec Institute’s Secure Coding in C/C++ Course explains in details the mechanisms underlying typical C/C++ security relevant programming bugs – the common security vulnerabilities. The root causes of the problems are explained through a number of easy-to-understand source code examples, which at the same time make clear how to find and correct these problems in practice. The real strength of the course lays in numerous hands-on exercises, which help the participants understand how easy it is to exploit these vulnerabilities by the attackers.
Course Objectives
- Understand basic concepts of security, IT security and secure coding
- Realize the severe consequences of non-secure buffer handling
- Understand the architectural protection techniques and their weaknesses
- Learn about typical coding mistakes and how to avoid them
- Be informed about recent vulnerabilities in various platforms, frameworks and libraries
Who Need to Attend
C/C++ developers, software architects and testers
Course Outline
1 - IT security and secure coding
- Nature of security
- IT security related terms
- Definition of risk
- IT security vs. secure coding
- From vulnerabilities to botnets and cyber crime
- Classification of security flaws
2 - Security relevant C/C++ programming bugs and flaws
- Exploitable security flaws
- Protection principles
- x86 machine code, memory layout, stack
- Return-to-libc attack – Circumventing the NX bit
- Return oriented programming (ROP)
- Heap overflow
3 - Common coding errors and vulnerabilities
- Input validation
- Improper error and exception handling
- Time and state problems
4 - Buffer overflow
- Stack overflow
- Protection against stack overflow
- Stack smashing protection
- Non executable memory areas – the NX bit
- Improper use of security features
- Code quality problems
5 - Advices and principles
- Matt Bishop’s principles of robust programming
- The security principles of Saltzer and Schroeder
6 - Knowledge sources
- Secure coding sources – a starter kit
- Vulnerability databases
- Recommended books – C/C++
Programme scope, delivery arrangements and suitability are confirmed during enquiry.