[an error occurred while processing this directive] [an error occurred while processing this directive]
[an error occurred while processing this directive]
[an error occurred while processing this directive]

FIT5003 Software security - Semester 1, 2014

This unit aims to introduce the secure software development issues including secure software development life cycle, secure software design principles, secure coding practices, threat evaluation models, secure software testing, deployment and maintenance, software development and security policy integration. Students are provided with a range of practical exercises and tasks to reinforce their skills including: identification of security bugs in programs written in different programming languages, design, implementation, and testing of secure concurrent and networked applications, identification of vulnerabilities in networked and mobile/wireless applications. In addition, students will learn input validation techniques to minimise security risks, man-in-the-middle attack techniques to be able to build more secure networked applications, practical secure software testing techniques to be able to test applications for security bugs.

Mode of Delivery

Caulfield (Evening)

Workload Requirements

Minimum total expected workload equals 12 hours per week comprising:

(a.) Contact hours for on-campus students:

  • Two hours of lectures
  • One 2-hour tutorial

(b.) Additional requirements (all students):

  • A minimum of 8 hours independent study per week for completing lab and project work, private study and revision.

Unit Relationships

Prerequisites

((FIT5131 or FIT9017) and (FIT5134 or FIT9018) and (FIT5132 or FIT9003 or FIT9019) and (FIT5135 or FIT9020) and (FIT5136 or FIT4037) and (FIT5130 or FIT9030)) or equivalent

Prerequisite knowledge: Programming experience, preferably in C or C++

Chief Examiner

Campus Lecturer

Caulfield

Professor Bala Srinivasan

Tutors

Caulfield

Professor Bala Srinivasan

Ilankaikone Senthooran

Guy Kijthaweesinpoon

Your feedback to Us

Monash is committed to excellence in education and regularly seeks feedback from students, employers and staff. One of the key formal ways students have to provide feedback is through the Student Evaluation of Teaching and Units (SETU) survey. The University’s student evaluation policy requires that every unit is evaluated each year. Students are strongly encouraged to complete the surveys. The feedback is anonymous and provides the Faculty with evidence of aspects that students are satisfied and areas for improvement.

For more information on Monash’s educational strategy, see:

www.monash.edu.au/about/monash-directions/ and on student evaluations, see: www.policy.monash.edu/policy-bank/academic/education/quality/student-evaluation-policy.html

Previous Student Evaluations of this Unit

This unit is being offered for the first time as part of the Master of Network and Security degree.

If you wish to view how previous students rated this unit, please go to
https://emuapps.monash.edu.au/unitevaluations/index.jsp

Academic Overview

Learning Outcomes

At the completion of this unit students will have an understanding of central issues and concepts involved in secure software development, including:
  • importance of security and risk assessment;
  • vulnerabilities versus threats;
  • common attack techniques (malicious input injection, buffer overflows);
  • malware;
  • common web application vulnerabilities and design aspects (cross-side scripting, SQL injection, cookies, session management, user authentication);
  • operating system security;
  • secure development principles and techniques (including principle of least privilege, input validation, tools for writing secure code);
  • software testing techniques (including bug discovery techniques, fuzzing),
  • software deployment and maintenance issues.

Unit Schedule

Week Activities Assessment
0   No formal assessment or activities are undertaken in week 0
1 Introduction to Software Security  
2 Threat and Attacks  
3 Threat Modeling  
4 Security Architecture  
5 Code Review Part I of Assessment task 1 due
6 Touch Points  
7 Penetraton Testing Part II of Assessment task 1 due
8 Risk Based Testing  
9 Exception Handling Assessment task 2 due
10 Applications Specific Security I  
11 Applications Specific Security II  
12 Summary and Revision Assessment task 3 due
  SWOT VAC No formal assessment is undertaken in SWOT VAC
  Examination period LINK to Assessment Policy: http://policy.monash.edu.au/policy-bank/
academic/education/assessment/
assessment-in-coursework-policy.html

*Unit Schedule details will be maintained and communicated to you via your learning system.

Teaching Approach

Lecture and tutorials or problem classes
This teaching and learning approach helps students to initially encounter information at lectures, discuss and explore the information during tutorials, and practice in a hands-on approach both in a lab environment as well as by accessing a server from outside the University.

Assessment Summary

Examination (2 hours): 50%; In-semester assessment: 50%

Assessment Task Value Due Date
Use of a Software Security Tool for Code Review 20% Week 5 and 7( Two part submission)
SQL injection Vulnerability 20% Week 9
Review of a Vulnerabiilty tool 10% Week 12
Examination 1 50% To be advised

Assessment Requirements

Assessment Policy

Assessment Tasks

Participation

  • Assessment task 1
    Title:
    Use of a Software Security Tool for Code Review
    Description:
    Develop a concurrent program using threads for an application in C or C++ and idenfity its vulnerabilties using a  source code review tool.

    More details will be provided on the assignment specification.
    Weighting:
    20%
    Criteria for assessment:

    Code develpment - 40%

    Installation of code review tool and the anlsysis of supplied soruce code for vulnerabilites - 40%

    Defend  or refute the identified vulnerabilites - 20%

    Due date:
    Week 5 and 7( Two part submission)
  • Assessment task 2
    Title:
    SQL injection Vulnerability
    Description:
    This assignment will devlop  code to demonstrate the SQL injection vulnerabilty. You will extend the program that is being disucssed in the lab session so as to exploit the SQL injection while accessing  a database.
    Weighting:
    20%
    Criteria for assessment:

    Code development - 30%

    Successful exploitation and penetration of the code - 40%

    Patches to fix the vulneabilites - 30%

    Due date:
    Week 9
  • Assessment task 3
    Title:
    Review of a Vulnerabiilty tool
    Description:
    Study of a tool applicable to software secuity.
    Weighting:
    10%
    Criteria for assessment:

    Report contents will be marked on the following attributes:

    • Functional description of the tool (40%);
    • Critical evaluation of the tool with respect to software security and comparison with one  other tool which has similar functionalities  (40%); and
    • Quality of the submitted report  (20%).
    Due date:
    Week 12

Examinations

  • Examination 1
    Weighting:
    50%
    Length:
    2 hours
    Type (open/closed book):
    Closed book
    Electronic devices allowed in the exam:
    None

Learning resources

Monash Library Unit Reading List (if applicable to the unit)
http://readinglists.lib.monash.edu/index.html

Faculty of Information Technology Style Guide

Feedback to you

Examination/other end-of-semester assessment feedback may take the form of feedback classes, provision of sample answers or other group feedback after official results have been published. Please check with your lecturer on the feedback provided and take advantage of this prior to requesting individual consultations with staff. If your unit has an examination, you may request to view your examination script booklet, see http://intranet.monash.edu.au/infotech/resources/students/procedures/request-to-view-exam-scripts.html

Types of feedback you can expect to receive in this unit are:

  • Informal feedback on progress in labs/tutes
  • Graded assignments without comments
  • Interviews

Extensions and penalties

Returning assignments

Assignment submission

It is a University requirement (http://www.policy.monash.edu/policy-bank/academic/education/conduct/student-academic-integrity-managing-plagiarism-collusion-procedures.html) for students to submit an assignment coversheet for each assessment item. Faculty Assignment coversheets can be found at http://www.infotech.monash.edu.au/resources/student/forms/. Please check with your Lecturer on the submission method for your assignment coversheet (e.g. attach a file to the online assignment submission, hand-in a hard copy, or use an online quiz). Please note that it is your responsibility to retain copies of your assessments.

Online submission

If Electronic Submission has been approved for your unit, please submit your work via the learning system for this unit, which you can access via links in the my.monash portal.

Other Information

Policies

Monash has educational policies, procedures and guidelines, which are designed to ensure that staff and students are aware of the University’s academic standards, and to provide advice on how they might uphold them. You can find Monash’s Education Policies at: www.policy.monash.edu.au/policy-bank/academic/education/index.html

Key educational policies include:

Faculty resources and policies

Important student resources including Faculty policies are located at http://intranet.monash.edu.au/infotech/resources/students/

Graduate Attributes Policy

Student Charter

Student services

Monash University Library

Disability Liaison Unit

Students who have a disability or medical condition are welcome to contact the Disability Liaison Unit to discuss academic support services. Disability Liaison Officers (DLOs) visit all Victorian campuses on a regular basis.

[an error occurred while processing this directive]