[an error occurred while processing this directive]

FIT5003 Software security - Semester 1 , 2008

Unit leader :

Professor Bala Srinivasan

Lecturer(s) :

Clayton

  • Professor Bala Srinivasan

Introduction

Unit synopsis

029901 Security Science

The unit includes coverage of the following topics:

  • Software threat modelling
  • Software security principles
  • Access control, least privilege users
  • Cost of fixing security vulnerabilities
  • Securing applications, security and the web, web browser vulnerabilities
  • Proactive security development processes: security testing, code reviews,  secure software installation
  • Secure data,  user input
  • Denial of Service, exception management, buffer overflows/overruns
  • Software authentication and authorisation
  • Malicious software, spyware

    • Learning outcomes

    At the completion of this unit students will have understanding on

  • O1. the importance and properties of secure software
  • O2. various ways that software security can be compromised;
  • O3. techniques and tools for the development and measurement of security of software; and
  • O4. some case study  experience in building secure software.

    • Workload

    For on campus students, workload commitments are:

    • two-hour lecture and
    • two-hour tutorial/discussion class  which involves group activity, discussion and presentation to the class; this would require prior preparation before coming to the tutorial/discussion class; (in other words advance preparation is necessary);
    • a minimum of 2-3 hours of personal study per one hour of lecture  in order to satisfy the reading and assignment expectations.
    • You will need to allocate  an average of up to 5 hours per week for various activities.

    Unit relationships

    Prerequisites

     You should have knowledge  and/or appreciation  of
    • Computer and information security;
    • Operating systems and how it interacts with processes (preferably the knowledge  of Windows XP or Unix operating systems);
    • Understanding of higher level programming language constructs such as C or C++ or .NET or Java.

    Relationships

    FIT5003 is an elective unit in the Master of IT, MAIT, MNC, MDC and Master of  Telecommunications.

    You need have the pre-requisite knowledge that is listed above.

    Although there is no prerequisite unit(s) for this unit, it is expected that you have done at least one unit in information security and another one in  programming.

    Continuous improvement

    Monash is committed to ‘Excellence in education' and strives for the highest possible quality in teaching and learning. To monitor how successful we are in providing quality teaching and learning Monash regularly seeks feedback from students, employers and staff. Two of the formal ways that you are invited to provide feedback are through Unit Evaluations and through Monquest Teaching Evaluations.

    One of the key formal ways students have to provide feedback is through Unit Evaluation Surveys. It is Monash policy for every unit offered to be evaluated each year. Students are strongly encouraged to complete the surveys as they are an important avenue for students to "have their say". The feedback is anonymous and provides the Faculty with evidence of aspects that students are satisfied and areas for improvement.

    Student Evaluations

    The Faculty of IT administers the Unit Evaluation surveys online through the my.monash portal, although for some smaller classes there may be alternative evaluations conducted in class.

    If you wish to view how previous students rated this unit, please go to http://www.monash.edu.au/unit-evaluation-reports/

    Over the past few years the Faculty of Information Technology has made a number of improvements to its courses as a result of unit evaluation feedback. Some of these include systematic analysis and planning of unit improvements, and consistent assignment return guidelines.

    Monquest Teaching Evaluation surveys may be used by some of your academic staff this semester. They are administered by the Centre for Higher Education Quality (CHEQ) and may be completed in class with a facilitator or on-line through the my.monash portal. The data provided to lecturers is completely anonymous. Monquest surveys provide academic staff with evidence of the effectiveness of their teaching and identify areas for improvement. Individual Monquest reports are confidential, however, you can see the summary results of Monquest evaluations for 2006 at http://www.adm.monash.edu.au/cheq/evaluations/monquest/profiles/index.html

    Unit staff - contact details

    Unit leader

    Professor Balasubramaniam Srinivasan
    Professor, and Head of School
    Phone +61 3 990 31333 +61 3 990 55222
    Fax +61 3 990 55157

    Lecturer(s) :

    Professor Balasubramaniam Srinivasan
    Professor, and Head of School
    Phone +61 3 990 31333 +61 3 990 55222
    Fax +61 3 990 55157

    Teaching and learning method

    Communication, participation and feedback

    Monash aims to provide a learning environment in which students receive a range of ongoing feedback throughout their studies. You will receive feedback on your work and progress in this unit. This may take the form of group feedback, individual feedback, peer feedback, self-comparison, verbal and written feedback, discussions (on line and in class) as well as more formal feedback related to assignment marks and grades. You are encouraged to draw on a variety of feedback to enhance your learning.

    It is essential that you take action immediately if you realise that you have a problem that is affecting your study. Semesters are short, so we can help you best if you let us know as soon as problems arise. Regardless of whether the problem is related directly to your progress in the unit, if it is likely to interfere with your progress you should discuss it with your lecturer or a Community Service counsellor as soon as possible.

    Unit Schedule

    Week Topic Key dates
    1 Introduction  
    2 Security vs Software Security  
    3 Threat Modelling  
    4 Security Architecture  
    Mid semester break
    5 Secure Coding Principles I  
    6 Secure Coding Principles II  
    7 Exception (error) handling  
    8 Secure Database Access  
    9 Secure Web Applications  
    10 Software Security Tools -Presentation I  
    11 Software Security Tools - Presentation II  
    12 Security Evaluation  
    13 Revision  

    Unit Resources

    Prescribed text(s) and readings

    Text books are available from the Monash University Book Shops. Availability from other suppliers cannot be assured. The Bookshop orders texts in specifically for this unit. You are advised to purchase your text book early.

    No prescribed text book, however you are expected to read a number of books that are available in the library. Three important books are  suggested as recommended books. 

    Recommended text(s) and readings

  • Howard, M. and LeBlanc, D., Writing Secure Code, Second Edition, Microsoft, ISBN 0-7356-1722-8
  • Graff, M. G., and . van Wyk, K. R., Secure Coding Principles and Practices, O'Reilly, ISBN 0-596-00242-4
  • Swiderski, F. and  Snyder, W., Threat Modelling, Microsoft, ISBN 0-7356-1991-3

    • Required software and/or hardware

    It is expected that you have access to a Windows XP machine with administrator access rights.

    Equipment and consumables required or provided

     Students studying off-campus are required to have the minimum system configuration specified by the Faculty as a condition of accepting admission, and regular Internet access. On-campus students, and those studying at supported study locations may use the facilities available in the computing labs. Information about computer use for students is available from the ITS Student Resource Guide in the Monash University Handbook.

    See 7.3

    There are no scheduled labs for this unit. However you are provided with practical exercises which you will need to try, either on your personal machine or in the Faculty labs,  at your own pace. The required software will be made available during the lectures.

    Study resources

    Study resources we will provide for your study are:

    • Lecture slides
    • Discussion sheets
    • Assignment description

    Library access

    The Monash University Library site contains details about borrowing rights and catalogue searching. To learn more about the library and the various resources available, please go to http://www.lib.monash.edu.au.  Be sure to obtain a copy of the Library Guide, and if necessary, the instructions for remote access from the library website.

    Monash University Studies Online (MUSO)

    All unit and lecture materials are available through MUSO (Monash University Studies Online). Blackboard is the primary application used to deliver your unit resources. Some units will be piloted in Moodle.

    You can access MUSO and Blackboard via the portal (http://my.monash.edu.au).

    Click on the Study and enrolment tab, then Blackboard under the MUSO learning systems.

    In order for your Blackboard unit(s) to function correctly, your computer needs to be correctly configured.

    For example :

    • Blackboard supported browser
    • Supported Java runtime environment

    For more information, please visit

    http://www.monash.edu.au/muso/support/students/downloadables-student.html

    You can contact the MUSO Support by: Phone: (+61 3) 9903 1268

    For further contact information including operational hours, please visit

    http://www.monash.edu.au/muso/support/students/contact.html

    Further information can be obtained from the MUSO support site:

    http://www.monash.edu.au/muso/support/index.html

    If your unit is piloted in Moodle, you will see a link from your Blackboard unit to Moodle at http://moodle.med.monash.edu.au.
    From the Faculty of Information Technology category, click on the link for your unit.

    Assessment

    Unit assessment policy

    Two assignments and an examination.

    In each assessment component you need to  get at least 40%  and an overall of 50% or more   for a pass.

    Assignment tasks

    • Assignment Task

      Title : Use of a Software Security Tool

      Description :

      Weighting : 20 marks

      Criteria for assessment :

      Due date : Week 10

    • Assignment Task

      Title : Study of a tool related to software security and present it to the class in weeks 10 and 11

      Description :

      Weighting : 30 marks

      Criteria for assessment :

      Report - 20 marks and Presentation - 10 marks.

      Report contents will be marked on the following attributes:

      • functional description of the tool (7 marks);
      • critical evaluation of the tool with respect to software security and comparison with at least two other tools which has similar functionality  (10marks); and
      • quality of report writing (3 marks).

      Presentation marks are divided into three components:

      • Content and  quality  of presentation (6 marks);
      • Question answering (2 marks); and
      • Participation in the class (2 marks) 

      Due date : Report due in week 12

    Examinations

    • Examination

      Weighting : 50%

      Length : 2 hours

      Type ( open/closed book ) : Closed book

    Assignment submission

    Assignments will be submitted by paper copy to the lecturer.

     

    University and Faculty policy on assessment

    Due dates and extensions

    The due dates for the submission of assignments are given in the previous section. Please make every effort to submit work by the due dates. It is your responsibility to structure your study program around assignment deadlines, family, work and other commitments. Factors such as normal work pressures, vacations, etc. are seldom regarded as appropriate reasons for granting extensions. Students are advised to NOT assume that granting of an extension is a matter of course.

    Late submissions are NOT allowed unless there is a provable reason. Need to seek permission from the lecturer.

    Late assignment

    Return dates

    Students can expect assignments to be returned within two weeks of the submission date or after receipt, whichever is later.

    Assessment for the unit as a whole is in accordance with the provisions of the Monash University Education Policy at http://www.policy.monash.edu/policy-bank/academic/education/assessment/

    We will aim to have assignment results made available to you within two weeks after assignment receipt.

    Plagiarism, cheating and collusion

    Plagiarism and cheating are regarded as very serious offences. In cases where cheating  has been confirmed, students have been severely penalised, from losing all marks for an assignment, to facing disciplinary action at the Faculty level. While we would wish that all our students adhere to sound ethical conduct and honesty, I will ask you to acquaint yourself with Student Rights and Responsibilities (http://www.infotech.monash.edu.au/about/committees-groups/facboard/policies/studrights.html) and the Faculty regulations that apply to students detected cheating as these will be applied in all detected cases.

    In this University, cheating means seeking to obtain an unfair advantage in any examination or any other written or practical work to be submitted or completed by a student for assessment. It includes the use, or attempted use, of any means to gain an unfair advantage for any assessable work in the unit, where the means is contrary to the instructions for such work. 

    When you submit an individual assessment item, such as a program, a report, an essay, assignment or other piece of work, under your name you are understood to be stating that this is your own work. If a submission is identical with, or similar to, someone else's work, an assumption of cheating may arise. If you are planning on working with another student, it is acceptable to undertake research together, and discuss problems, but it is not acceptable to jointly develop or share solutions unless this is specified by your lecturer. 

    Intentionally providing students with your solutions to assignments is classified as "assisting to cheat" and students who do this may be subject to disciplinary action. You should take reasonable care that your solution is not accidentally or deliberately obtained by other students. For example, do not leave copies of your work in progress on the hard drives of shared computers, and do not show your work to other students. If you believe this may have happened, please be sure to contact your lecturer as soon as possible.

    Cheating also includes taking into an examination any material contrary to the regulations, including any bilingual dictionary, whether or not with the intention of using it to obtain an advantage.

    Plagiarism involves the false representation of another person's ideas, or findings, as your own by either copying material or paraphrasing without citing sources. It is both professional and ethical to reference clearly the ideas and information that you have used from another writer. If the source is not identified, then you have plagiarised work of the other author. Plagiarism is a form of dishonesty that is insulting to the reader and grossly unfair to your student colleagues.

    Register of counselling about plagiarism

    The university requires faculties to keep a simple and confidential register to record counselling to students about plagiarism (e.g. warnings). The register is accessible to Associate Deans Teaching (or nominees) and, where requested, students concerned have access to their own details in the register. The register is to serve as a record of counselling about the nature of plagiarism, not as a record of allegations; and no provision of appeals in relation to the register is necessary or applicable.

    Non-discriminatory language

    The Faculty of Information Technology is committed to the use of non-discriminatory language in all forms of communication. Discriminatory language is that which refers in abusive terms to gender, race, age, sexual orientation, citizenship or nationality, ethnic or language background, physical or mental ability, or political or religious views, or which stereotypes groups in an adverse manner. This is not meant to preclude or inhibit legitimate academic debate on any issue; however, the language used in such debate should be non-discriminatory and sensitive to these matters. It is important to avoid the use of discriminatory language in your communications and written work. The most common form of discriminatory language in academic work tends to be in the area of gender inclusiveness. You are, therefore, requested to check for this and to ensure your work and communications are non-discriminatory in all respects.

    Students with disabilities

    Students with disabilities that may disadvantage them in assessment should seek advice from one of the following before completing assessment tasks and examinations:

    Deferred assessment and special consideration

    Deferred assessment (not to be confused with an extension for submission of an assignment) may be granted in cases of extenuating personal circumstances such as serious personal illness or bereavement. Information and forms for Special Consideration and deferred assessment applications are available at http://www.monash.edu.au/exams/special-consideration.html. Contact the Faculty's Student Services staff at your campus for further information and advice.