This unit aims to introduce the secure software development issues including secure software development life cycle, secure software design principles, secure coding practices, threat evaluation models, secure software testing, deployment and maintenance, software development and security policy integration. Students are provided with a range of practical exercises and tasks to reinforce their skills including: identification of security bugs in programs written in different programming languages, design, implementation, and testing of secure concurrent and networked applications, identification of vulnerabilities in networked and mobile/wireless applications. In addition, students will learn input validation techniques to minimise security risks, man-in-the-middle attack techniques to be able to build more secure networked applications, practical secure software testing techniques to be able to test applications for security bugs.
Minimum total expected workload equals 12 hours per week comprising:
(a.) Contact hours for on-campus students:
(b.) Additional requirements (all students):
See also Unit timetable information
(FIT9131 or FIT5131 or FIT9017) or equivalent
Prerequisite knowledge: Programming experience, preferably in C or C++
Dr Ron Steinfeld
Guy Kijthaweesinpoon
Monash is committed to excellence in education and regularly seeks feedback from students, employers and staff. One of the key formal ways students have to provide feedback is through the Student Evaluation of Teaching and Units (SETU) survey. The University’s student evaluation policy requires that every unit is evaluated each year. Students are strongly encouraged to complete the surveys. The feedback is anonymous and provides the Faculty with evidence of aspects that students are satisfied and areas for improvement.
For more information on Monash’s educational strategy, see:
www.monash.edu.au/about/monash-directions/ and on student evaluations, see: www.policy.monash.edu/policy-bank/academic/education/quality/student-evaluation-policy.html
More practical demonstrations and explanations of software hacking have been added in response to student iSETU feedback requests.
Student feedback has highlighted the usefulness of learning resources in this unit.
If you wish to view how previous students rated this unit, please go to
https://emuapps.monash.edu.au/unitevaluations/index.jsp
| Week | Activities | Assessment |
|---|---|---|
| 0 | No formal assessment or activities are undertaken in week 0 | |
| 1 | Introduction to Software Security | |
| 2 | Secure Software Development Principles and Approaches | |
| 3 | Threat Modeling and Mitigation Techniques | |
| 4 | Secure (and Insecure) Coding Techniques I | |
| 5 | Secure (and Insecure) Coding Techniques II | Part I of Assessment task 1 due |
| 6 | Security Testing | |
| 7 | More on Security Testing | Part II of Assessment task 1 due |
| 8 | Web Application Security I | |
| 9 | Web Application Security II | Assessment task 2 due |
| 10 | Web Application Security III and Language-Based Security I | |
| 11 | Language-Based Security II | |
| 12 | Software Security in a Nutshell | Assessment task 3 due |
| SWOT VAC | No formal assessment is undertaken in SWOT VAC | |
| Examination period | LINK to Assessment Policy: http://policy.monash.edu.au/policy-bank/ academic/education/assessment/ assessment-in-coursework-policy.html |
*Unit Schedule details will be maintained and communicated to you via your learning system.
Examination (2 hours): 50%; In-semester assessment: 50%
| Assessment Task | Value | Due Date |
|---|---|---|
| Use of a Software Security Tool for Code Review | 20% | Week 5 and 7 (two part submission) |
| SQL Injection Vulnerability | 20% | Week 9 |
| Penetration Testing of Software | 10% | Week 12 |
| Examination 1 | 50% | To be advised |
Faculty Policy - Unit Assessment Hurdles (http://intranet.monash.edu.au/infotech/resources/staff/edgov/policies/assessment-examinations/assessment-hurdles.html)
Academic Integrity - Please see resources and tutorials at http://www.monash.edu/library/skills/resources/tutorials/academic-integrity/
Report contents will be marked on the following attributes:
Textbooks that we will refer to include:
1. G McGraw, Software Security, Addison-Wesley Software Security Series, 2006 (referred to as "McGraw" in reading lists on Moodle). Copy available at the Monash library.
2. M Howard and D LeBlanc, Writing Secure Code, Microsoft Press, 2nd Edition, 2003. (referred to as "HowLe" in reading lists on Moodle). Available online via Monash library.
3. J Erickson, Hacking: The Art of Exploitation, No Starch Press, 2008. Available online via Monash library. (referred to as "Erick" in reading lists on Moodle).
4. D Stuttard and M Pinto, The Web Application Hacker’s Handbook, Wiley, 2nd Edition, 2011. Available at Monash library. (referred to as "StuPint" in reading lists on Moodle).
Monash Library Unit Reading List (if applicable to the unit)
http://readinglists.lib.monash.edu/index.html
Types of feedback you can expect to receive in this unit are:
Submission must be made by the due date otherwise penalties will be enforced.
You must negotiate any extensions formally with your campus unit leader via the in-semester special consideration process: http://www.monash.edu.au/exams/special-consideration.html
It is a University requirement (http://www.policy.monash.edu/policy-bank/academic/education/conduct/student-academic-integrity-managing-plagiarism-collusion-procedures.html) for students to submit an assignment coversheet for each assessment item. Faculty Assignment coversheets can be found at http://www.infotech.monash.edu.au/resources/student/forms/. Please check with your Lecturer on the submission method for your assignment coversheet (e.g. attach a file to the online assignment submission, hand-in a hard copy, or use an electronic submission). Please note that it is your responsibility to retain copies of your assessments.
Monash has educational policies, procedures and guidelines, which are designed to ensure that staff and students are aware of the University’s academic standards, and to provide advice on how they might uphold them. You can find Monash’s Education Policies at: www.policy.monash.edu.au/policy-bank/academic/education/index.html
Important student resources including Faculty policies are located at http://intranet.monash.edu.au/infotech/resources/students/
The University provides many different kinds of support services for you. Contact your tutor if you need advice and see the range of services available at http://www.monash.edu.au/students. For Malaysia see http://www.monash.edu.my/Student-services, and for South Africa see http://www.monash.ac.za/current/.
The Monash University Library provides a range of services, resources and programs that enable you to save time and be more effective in your learning and research. Go to www.lib.monash.edu.au or the library tab in my.monash portal for more information. At Malaysia, visit the Library and Learning Commons at http://www.lib.monash.edu.my/. At South Africa visit http://www.lib.monash.ac.za/.