MTech Secured Programming syllabus for 2 Sem 2020 scheme 20SFC23

Validating all input & Designing secure programs:

Command line and environment variables, File descriptors, names and contents, Web based application inputs, Locale selection and character encoding, Filtering represent able URIs, preventing cross site malicious input content, Forbidding HTTP Input to perform non-queries. Good security design principles: Securing the interface, separation of data and control. Minimize privileges: Granted, time, modules, resources etc, Using chroot, careful use of setuid/setgid, Safe default value and load initializations. Avoid race conditions, Trustworthy channels and trusted path, Avoiding semantics and algorithmic complexity attacks.

Declarations and Initializations and Expressions:

Declare objects with appropriate storage durations, Identifier declaration with conflict linkage classifications, Using correct syntax for declaring flexible array member, Avoiding information leakage in structure padding, Incompatible declarations of same function or object. Dependence on evaluation order for side effects: Reading uninitialized memory and dereferencing null pointers, Modifying objects with temporary lifetime, Accessing variable through (pointer) incompatible type, Modifying constant objects and comparing padding data.

Integers and Floating Points:

Wrapping of unsigned integers, Integer conversions and misrepresented data, Integer overflow and divide by zero errors, Shifting of negative numbers, Using correct integer precisions, Pointer conversion to integer and vice versa. Floating point values for counters: Domain and range errors in math functions, Floating point conversions and preserving precision.

Arrays , Strings and Memory Management:

Out of bounds subscripts and valid length arrays, Comparing array pointers, Pointer arithmetic for non-array object, scaled integer, Modifying string literals, Space allocation for strings (Null terminator), Casting large integers as unsigned chars, Narrow and wide character strings and functions. Accessing freed memory: Freeing dynamically allocated memory, Computing memory allocation for an object, Copying structures containing flexible array members, Modifying object alignment by using realloc.

I/O, Signals and Error Handing:

User input and format strings, Opening an pre-opened file, Performing device operations appropriate for files, Dealing with EOF, WEOF, Copying FILE object, Careful use of fgets, fgetws, getc, putc, putwc. Use of fsetops and fgetops, Accessing closed files. Using asynchronous safe functions and signal handlers: Shared objects and signal handlers, Using signal() within interruptible signal handlers, Returning computation exception signal handler. Using errno: check and set, Depending upon indeterminate values of errno, Handling standard library errors.

Course outcomes:

At the end of the course the student will be able to:

• How to respond to security alerts which identifies software issues Identify possible security programming errors
• Define methodology for security testing and use appropriate tools in its implementation
• Apply new security-enhanced programming models and tools

Question paper pattern:

The SEE question paper will be set for 100 marks and the marks scored will be proportionately reduced to 60.

• The question paper will have ten full questions carrying equal marks.
• Each full question is for 20 marks.
• There will be two full questions (with a maximum of four sub questions) from each module.
• Each full question will have sub question covering all the topics under a module.
• The students will have to answer five full questions, selecting one full question from each module.

Textbook/ Textbooks

1 The CERT ® C Coding Standard: 98 Rules for Developing Safe, Reliable, and Secure Systems Robert C. Seacord Addison Wesley Professional Second Edition 2014

2 Secure Programming for Linux and Unix HowTo David Wheeler Linux Documentation project 2004

Reference Books

1 Secure Programming Cookbook for C and C++ JohnViega, Matt Messier O'Reilly Media 2003