FIT5003 Software security - Semester 1 , 2007 unit guide

Semester 1, 2007

Chief Examiner

Professor B Srinivasan


Caulfield : Professor B Srinivasan


029901 Security Science

The unit includes coverage of the following topics:

  • Software threat modelling
  • Software security principles
  • Access control, least privileges users
  • Cost of fixing security vulnerabilities
  • Securing applications, security and the web, web browser vulnerabilities
  • Proactive security development processes: security testing, code reviews, secure software installation
  • Secure data, secure user input
  • Denial of Service, exception management, buffer overflows/overruns
  • Software authentication and authorisation
  • Malicious software, spyware


    At the completion of this unit students will have


  • O1. A detailed knowledge of the importance of secure software systems
  • O2. Understanding of various ways software can be compromised
  • O3. Understanding of the techniques and tools used to discover compromised systems
  • O4. Practical experience with building secure applications


    You should have knowledge of

    Sound knowledge in an object oriented programming language (e.g. Java or C#)

    Unit relationships

    FIT5003 is a elective unit in the Masters of IT, MAIT, MNC. prerequisite/corequisite for You should have knowledge of

    Sound knowledge in an object oriented programming language (e.g. Java or C#)



    You may not study this unit and


    in your degree.


    Texts and software

    Required text(s)



    Textbook availability

    Text books are available from the Monash University Book Shops. Availability from other suppliers cannot be assured. The Bookshop orders texts in specifically for this unit. You are advised to purchase your text book early.

    Software requirements

    It is expected that you have access to a Windows XP machine with administraor access rights.

    Hardware requirements

    Students studying off-campus are required to have the minimum system configuration specified by the Faculty as a condition of accepting admission, and regular Internet access. On-campus students, and those studying at supported study locations may use the facilities available in the computing labs. Information about computer use for students is available from the ITS Student Resource Guide in the Monash University Handbook. You will need to allocate up to n hours per week for use of a computer, including time for newsgroups/discussion groups.

    See 7.3

    There is no scheduled labs for this unit. However you are provided with some practical exercises which you need to try in the Faculty labs at your own pace. These exercises are not graded. However performing these exercises will be useful in developing a solution to the second assessment componet - which is a programming exercise.

    Recommended reading


  • Howard, M. and David LeBlanc, Writing Secure Code, Second Edition, Microsoft, ISBN 0-7356-1722-8
  • Graff, M. G., K. R. van Wyk, Secure Coding Principles and Practices, O'Reilly, ISBN 0-596-00242-4
  • Swiderski, F., W. Snyder, Threat Modelling, Microsoft, ISBN 0-7356-1991-3

    Library access

    You may need to access the Monash library either personally to be able to satisfactorily complete the subject.  Be sure to obtain a copy of the Library Guide, and if necessary, the instructions for remote access from the library website.

    Study resources

    Study resources for FIT5003 are:

    Web sites contains all the teaching materials.

    Unit website

    Structure and organisation

    Week Topics
    1 Introduction
    2 Security vs Software Security
    3 Threat Modelling
    4 Security Architecture
    5 Secure Coding Principles I
    6 Secure Coding Principles II
    Non teaching week
    7 Exception (error) handling
    8 Secure Database Access
    9 Secure Web Applications
    10 Software Security Tools I -Presentation
    11 Software Security tools - Presentation II
    12 Security Evaluation
    13 Revison


    The timetable for on-campus classes for this unit can be viewed in Allocate+


    Assessment weighting

    Assessmen t for the unit consists of 2 assignments with a weighting of x% and an examination with a weighting of y%. Read this section VERY carefully.

    See 14.4 below.

    Assessment Policy

    To pass this unit you must:

    You must get at least 40% in each assessment components and an overall of 50% or more.

    Your score for the unit will be calculated by:

    Addition of three assessment components.

    Assessment Requirements

    Assessment Due Date Weighting
    Evaluation of Software Security Tool (Individual with a presentation in weeks 10 and 11) Week 11 25%
    Development and analysis of applicaiton with respect to software Security (Group assessment) week 12 25 %
    The exam is 2 hours long and is closed book. Exam period (S1/07) starts on 07/06/07 50 %

    Assignment specifications will be made available Tthough the unit web site.

    Assignment Submission

    Assignments will be submitted by paper copy to the lecturer.


    Extensions and late submissions

    Late submission of assignments

    Late submissions will not be accepted and will result a zero mark for the asssessment they by failing the unit (see 14.2 - Assessment Policy)

    This policy is strict because comments or guidance will be given on assignments as they are returned, and sample solutions may also be published and distributed, after assignment marking or with the returned assignment. 


    It is your responsibility to structure your study program around assignment deadlines, family, work and other commitments. Factors such as normal work pressures, vacations, etc. are seldom regarded as appropriate reasons for granting extensions. 

    Requests for extension should be submitted either by email or in person to the lecturer at least two days before the due date with the supporting documentations. You will be asked to forward original medical certificates in cases of illness, and may be asked to provide other forms of documentation where necessary. A copy of the email or other written communication of an extension must be attached to the assignment submission.

    Grading of assessment

    Assignments, and the unit, will be marked and allocated a grade according to the following scale:

    Grade Percentage/description
    HD High Distinction - very high levels of achievement, demonstrated knowledge and understanding, skills in application and high standards of work encompassing all aspects of the tasks.
    In the 80+% range of marks for the assignment.
    D Distinction - high levels of achievement, but not of the same standards. May have a weakness in one particular aspect, or overall standards may not be quite as high.
    In the 70-79% range.
    C Credit - sound pass displaying good knowledge or application skills, but some weaknesses in the quality, range or demonstration of understanding.
    In the 60-69% range.
    P Pass acceptable standard, showing an adequate basic knowledge, understanding or skills, but with definite limitations on the extent of such understanding or application. Some parts may be incomplete.
    In the 50-59% range.
    N Not satisfactory failure to meet the basic requirements of the assessment.
    Below 50%.

    Assignment return

    We will aim to have assignment results made available to you within two weeks after assignment receipt.


    Feedback to you

    You will receive feedback on your work and progress in this unit. This feedback may be provided through your participation in tutorials and class discussions, as well as through your assignment submissions. It may come in the form of individual advice, marks and comments, or it may be provided as comment or reflection targeted at the group. It may be provided through personal interactions, such as interviews and on-line forums, or through other mechanisms such as on-line self-tests and publication of grade distributions.

    Feedback from you

    You will be asked to provide feedback to the Faculty through a Unit Evaluation survey at the end of the semester. You may also be asked to complete surveys to help teaching staff improve the unit and unit delivery. Your input to such surveys is very important to the faculty and the teaching staff in maintaining relevant and high quality learning experiences for our students.

    And if you are having problems

    It is essential that you take action immediately if you realise that you have a problem with your study. The semester is short, so we can help you best if you let us know as soon as problems arise. Regardless of whether the problem is related directly to your progress in the unit, if it is likely to interfere with your progress you should discuss it with your lecturer or a Community Service counsellor as soon as possible.

    Plagiarism and cheating

    Plagiarism and cheating are regarded as very serious offences. In cases where cheating  has been confirmed, students have been severely penalised, from losing all marks for an assignment, to facing disciplinary action at the Faculty level. While we would wish that all our students adhere to sound ethical conduct and honesty, I will ask you to acquaint yourself with Student Rights and Responsibilities and the Faculty regulations that apply to students detected cheating as these will be applied in all detected cases.

    In this University, cheating means seeking to obtain an unfair advantage in any examination or any other written or practical work to be submitted or completed by a student for assessment. It includes the use, or attempted use, of any means to gain an unfair advantage for any assessable work in the unit, where the means is contrary to the instructions for such work. 

    When you submit an individual assessment item, such as a program, a report, an essay, assignment or other piece of work, under your name you are understood to be stating that this is your own work. If a submission is identical with, or similar to, someone else's work, an assumption of cheating may arise. If you are planning on working with another student, it is acceptable to undertake research together, and discuss problems, but it is not acceptable to jointly develop or share solutions unless this is specified by your lecturer. 

    Intentionally providing students with your solutions to assignments is classified as "assisting to cheat" and students who do this may be subject to disciplinary action. You should take reasonable care that your solution is not accidentally or deliberately obtained by other students. For example, do not leave copies of your work in progress on the hard drives of shared computers, and do not show your work to other students. If you believe this may have happened, please be sure to contact your lecturer as soon as possible.

    Cheating also includes taking into an examination any material contrary to the regulations, including any bilingual dictionary, whether or not with the intention of using it to obtain an advantage.

    Plagiarism involves the false representation of another person's ideas, or findings, as your own by either copying material or paraphrasing without citing sources. It is both professional and ethical to reference clearly the ideas and information that you have used from another writer. If the source is not identified, then you have plagiarised work of the other author. Plagiarism is a form of dishonesty that is insulting to the reader and grossly unfair to your student colleagues.


    Communication methods

    Discussions during and after the lectures as well as in the discussion classes (the tutorial classes).


    Notices related to the unit during the semester will be placed on the Notices Newsgroup in the Unit Website. Check this regularly. Failure to read the Notices newsgroup is not regarded as grounds for special consideration.

    Consultation Times

    Mondays 2-6 PM

    If direct communication with your unit adviser/lecturer or tutor outside of consultation periods is needed you may contact the lecturer and/or tutors at:

    This person's profile is not available.Image of this person is not available.

    All email communication to you from your lecturer will occur through your Monash student email address. Please ensure that you read it regularly, or forward your email to your main address. Also check that your contact information registered with the University is up to date in My.Monash.

    Last updated: Mar 7, 2007