Microsoft SDL Core Training Course

Day 1

IT security and secure coding

• The nature of security.
• Terminology related to IT security.
• Defining risk.
• Various dimensions of IT security.
• Requirements across different application domains.
• Distinguishing between IT security and secure coding.
• From vulnerabilities to botnets and cybercrime.
  • The nature of security flaws.
  • Factors contributing to complexity.
  • Progression from infected computers to targeted attacks.
• Classifying security flaws.
  • Landwehr’s taxonomy.
  • The Seven Pernicious Kingdoms.
  • OWASP Top Ten 2013.
  • Comparison of OWASP Top Ten lists from 2003 to 2013.

Introduction to the Microsoft® Security Development Lifecycle (SDL)

• Agenda.
• Applications under attack.
  • The evolution of cybercrime.
  • The increasing focus on application-layer attacks.
  • The prevalence of vulnerabilities in smaller ISV applications.
• The origins of the Microsoft SDL.
  • Microsoft's security timeline.
  • Which applications are mandated to follow SDL.
• Microsoft Security Development Lifecycle (SDL) details.
  • Overview of the Microsoft Security Development Lifecycle (SDL).
  • Pre-SDL Requirement: Security Training.
  • Phase One: Requirements.
  • Phase Two: Design.
  • Phase Three: Implementation.
  • Phase Four: Verification.
  • Phase Five: Release – Response Plan.
  • Phase Five: Release – Final Security Review.
  • Phase Five: Release – Archive.
  • Post-SDL Requirement: Response.
  • SDL Process Guidance for Line-of-Business (LOB) Apps.
  • SDL Guidance for Agile Methodologies.
  • The necessity of process improvement for secure software development.

Secure design principles

• Attack surface.
  • Reducing the attack surface.
  • Illustrative examples of attack surfaces.
  • Conducting attack surface analysis.
  • Practical examples of attack surface reduction.
• Privacy.
  • Concepts of privacy.
  • Understanding application behaviors and privacy concerns.
• Defense in depth.
  • SDL Core Principle: Defense In Depth.
  • Examples of defense in depth implementation.
• Least privilege principle.
  • Examples of least privilege application.
• Secure defaults.
  • Examples of secure default configurations.

Secure implementation principles

• Agenda.
• Reference to Microsoft Security Development Lifecycle (SDL).
• Fundamentals of buffer overflows.
  • Intel 80x86 Processors – primary registers.
  • Memory address layout.
  • Function calling mechanisms in C/C++ on x86.
  • Local variables and the stack frame.
  • Stack overflow.
    • Buffer overflows on the stack.
    • Exercise introduction.
    • Exercise BOFIntro.
    • Exercise BOFIntro – determining the stack layout.
    • Exercise BOFIntro – executing a simple exploit.
• Input validation.
  • Core concepts of input validation.
  • Integer issues.
    • Representation of negative integers.
    • Integer overflow.
    • Arithmetic overflow – predicting output.
    • Exercise IntOverflow.
    • Determining the value of Math.Abs(int.MinValue).
  • Mitigating integer issues.
    • Strategies for integer problem mitigation.
    • Preventing arithmetic overflow in addition.
    • Preventing arithmetic overflow in multiplication.
    • Detecting overflow using the checked keyword in C#.
    • Exercise – Utilizing the checked keyword in C#.
    • Exceptions triggered by overflows in C#.
  • Case study – Integer overflow in .NET.
    • A real-world integer overflow vulnerability.
    • Exploiting the integer overflow vulnerability.
  • Path traversal vulnerability.
    • Mitigating path traversal risks.

Day 2

Secure implementation principles

• Injection attacks.
  • Common SQL Injection attack methods.
  • Blind and time-based SQL injection.
  • SQL Injection protection techniques.
  • Command injection.
• Broken authentication and password management.
  • Exercise – Weaknesses of hashed passwords.
  • Password management and storage practices.
  • Specialized hash algorithms for password storage.
• Cross-Site Scripting (XSS).
  • Overview of Cross-Site Scripting (XSS).
  • CSS injection.
  • Exploitation via injection through other HTML tags.
  • XSS prevention strategies.
• Lack of function-level access control.
  • Filtering file uploads.
• Practical cryptography.
  • Achieving confidentiality via symmetric cryptography.
  • Symmetric encryption algorithms.
  • Block ciphers – modes of operation.
  • Hashing or message digests.
  • Hash algorithms.
  • Message Authentication Code (MAC).
  • Ensuring integrity and authenticity with symmetric keys.
  • Achieving confidentiality via public-key encryption.
  • Best practices for managing private keys.
  • Common errors in password management.
  • Exercise – Hard-coded passwords.
  • Conclusions.

Secure verification principles

• Differences between functional and security testing.
• Identifying security vulnerabilities.
• Prioritization strategies.
• Integrating security testing into the SDLC.
• Test planning steps (risk analysis).
• Scoping and information gathering.
  • Stakeholders.
  • Assets.
  • The attack surface.
  • Security objectives for testing.
• Threat modeling.
  • Fundamentals of threat modeling.
  • Attacker profiles.
  • Threat modeling using attack trees.
  • Threat modeling based on misuse/abuse cases.
  • Misuse/abuse cases – a simple web shop example.
  • STRIDE per element approach to threat modeling – MS SDL.
  • Identifying security objectives.
  • Diagramming – examples of DFD elements.
  • Data flow diagram – example.
  • Threat enumeration – MS SDL’s STRIDE and DFD elements.
  • Risk analysis – classifying threats.
  • The DREAD threat/risk ranking model.
• Security testing techniques and tools.
  • General testing approaches.
  • Techniques applicable to various SDLC stages.
• Code review.
  • Code review for software security.
  • Taint analysis.
  • Heuristics.
• Static code analysis.
  • Overview of static code analysis.
  • Exercise – Utilizing static code analysis tools.
• Testing the implementation.
  • Manual runtime verification.
  • Manual versus automated security testing.
  • Penetration testing.
  • Stress tests.
• Fuzzing.
  • Automated security testing – fuzzing.
  • Challenges associated with fuzzing.
• Web vulnerability scanners.
  • Exercise – Using a vulnerability scanner.
• Environment checking and hardening.
  • Common Vulnerability Scoring System – CVSS.
  • Vulnerability scanners.
  • Public databases.
• Case study – Forms Authentication Bypass.
  • NULL byte termination vulnerability.
  • The Forms Authentication Bypass vulnerability in code.
  • Exploiting the Forms Authentication Bypass.

Knowledge sources

• Secure coding resources – a starter kit.
• Vulnerability databases.
• .NET secure coding guidelines on MSDN.
• .NET secure coding cheat sheets.
• Recommended books – .NET and ASP.NET.