CS2013-final-report

11. Discuss the importance of usability in security mechanism design. [Familiarity]
12. Describe security issues that arise at boundaries between multiple components. [Familiarity]
13. Identify the different roles of prevention mechanisms and detection/deterrence mechanisms. [Familiarity]
IAS/Defensive Programming
[1 Core-Tier1 hour, 1 Core-Tier2 hour]
Topics in defensive programming are generally not thought about in isolation, but applied to
other topics particularly in SDF, SE and PD Knowledge Areas.
Topics:
[Core-Tier1]
• Input validation and data sanitization (cross-reference SDF/Development Methods/Program Correctness)
• Choice of programming language and type-safe languages
• Examples of input validation and data sanitization errors (cross-reference SDF/Development
Methods/Program Correctness and SE/Software Construction/Coding Practices)
o Buffer overflows
o Integer errors
o SQL injection
o XSS vulnerability
• Race conditions (cross-reference SF/Parallelism/Parallel programming and PD/Parallel Architecture/Shared
vs. distributed memory and PD/Communication and Coordination/Shared Memory and PD/Parallelism
Fundamentals/Programming errors not found in sequential programming)
• Correct handling of exceptions and unexpected behaviors (cross-reference SDF/Development
Methods/program correctness)
[Core-Tier2]
• Correct usage of third-party components (cross-reference SDF/Development Methods/program correctness
and Operating System Principles/Concepts of application program interfaces (APIs)
• Effectively deploying security updates (cross-reference OS/Security and Protection/Security methods and
devices)
[Electives]
• Information flow control
• Correctly generating randomness for security purposes
• Mechanisms for detecting and mitigating input and data sanitization errors
• Fuzzing
• Static analysis and dynamic analysis
• Program verification
• Operating system support (e.g., address space randomization, canaries)
• Hardware support (e.g., DEP, TPM)
- 104 -