Microsoft SDL Core Training Course

Day 1

IT Security and Secure Coding

• The nature of security
• Key terminology in IT security
• Defining risk
• Various dimensions of IT security
• Security requirements across different application domains
• Distinguishing between IT security and secure coding
• From vulnerabilities to botnets and cybercrime
  • The nature of security flaws
  • Why security flaws are difficult to manage
  • Progression from infected systems to targeted attacks
• Classification of security flaws
  • Landwehr’s taxonomy
  • The Seven Pernicious Kingdoms
  • OWASP Top Ten 2013
  • Comparison of OWASP Top Ten: 2003 vs 2013

Introduction to the Microsoft® Security Development Lifecycle (SDL)

• Agenda
• Applications under attack
  • The evolution of cybercrime
  • Shift in attack focus toward applications
  • Prevalence of vulnerabilities in smaller ISV applications
• Origins of the Microsoft SDL
  • Microsoft’s security timeline
  • Which applications are mandated to follow the SDL?
• The Microsoft Security Development Lifecycle (SDL)
  • Overview of the Microsoft SDL
  • Pre-SDL Requirement: Security Training
  • Phase One: Requirements
  • Phase Two: Design
  • Phase Three: Implementation
  • Phase Four: Verification
  • Phase Five: Release – Response Plan
  • Phase Five: Release – Final Security Review
  • Phase Five: Release – Archiving
  • Post-SDL Requirement: Response
  • SDL Process Guidance for LOB Applications
  • SDL Guidance for Agile Methodologies
  • The need for process improvement in secure software development

Secure Design Principles

• Attack Surface
  • Strategies for reducing the attack surface
  • Illustrative example of attack surface
  • Conducting an attack surface analysis
  • Examples of attack surface reduction
• Privacy
  • Principles of privacy
  • Understanding application behaviors and privacy concerns
• Defense in Depth
  • Core SDL Principle: Defense in Depth
  • Example of defense in depth
• Principle of Least Privilege
  • Example of least privilege implementation
• Secure Defaults
  • Examples of secure default settings

Secure Implementation Principles

• Agenda
• Microsoft Security Development Lifecycle (SDL) context
• Fundamentals of Buffer Overflows
  • Intel 80x86 Processors – Main Registers
  • Memory address layout
  • Function calling mechanisms in C/C++ on x86
  • Local variables and the stack frame
  • Stack Overflow
    • Buffer overflow on the stack
    • Introduction to exercises
    • Exercise: BOFIntro
    • Exercise: BOFIntro – Determining the stack layout
    • Exercise: BOFIntro – Creating a simple exploit
• Input Validation
  • Concepts in input validation
  • Integer Issues
    • Representation of negative integers
    • Integer overflow
    • Arithmetic overflow – Output prediction challenge
    • Exercise: IntOverflow
    • Evaluating the result of Math.Abs(int.MinValue)
  • Mitigating Integer Issues
    • Strategies for integer problem mitigation
    • Preventing arithmetic overflow – Addition
    • Preventing arithmetic overflow – Multiplication
    • Detecting overflow using the `checked` keyword in C#
    • Exercise – Utilizing the `checked` keyword in C#
    • Exceptions raised by overflows in C#
  • Case Study – Integer Overflow in .NET
    • Analysis of a real-world integer overflow vulnerability
    • Exploiting the integer overflow vulnerability
  • Path Traversal Vulnerability
    • Mitigation techniques for path traversal

Day 2

Secure Implementation Principles

• Injection Attacks
  • Common SQL Injection attack methods
  • Blind and time-based SQL injection
  • Protection methods against SQL Injection
  • Command injection
• Broken Authentication and Password Management
  • Exercise – Weaknesses in hashed passwords
  • Best practices for password management and storage
  • Specialized hash algorithms for password storage
• Cross-Site Scripting (XSS)
  • Overview of Cross-Site Scripting (XSS)
  • CSS injection
  • Exploitation techniques via other HTML tags
  • XSS prevention strategies
• Missing Function Level Access Control
  • Filtering file uploads
• Practical Cryptography
  • Achieving confidentiality with symmetric cryptography
  • Symmetric encryption algorithms
  • Block ciphers and their modes of operation
  • Hashing and message digests
  • Hashing algorithms
  • Message Authentication Codes (MAC)
  • Ensuring integrity and authenticity with symmetric keys
  • Achieving confidentiality with public-key encryption
  • Best practice – Safeguarding private keys
  • Common errors in password management
  • Exercise – Issues with hard-coded passwords
  • Summary and conclusions

Secure Verification Principles

• Distinction between functional and security testing
• Identifying security vulnerabilities
• Prioritization of risks
• Integrating security testing into the SDLC
• Steps in test planning (risk analysis)
• Scoping and information gathering
  • Identifying stakeholders
  • Identifying assets
  • Defining the attack surface
  • Setting security objectives for testing
• Threat Modeling
  • Fundamentals of threat modeling
  • Attacker profiles
  • Threat modeling using attack trees
  • Threat modeling based on misuse/abuse cases
  • Misuse/abuse cases – Simple web shop example
  • STRIDE per element approach to threat modeling (MS SDL)
  • Identifying security objectives
  • Diagramming – Examples of DFD elements
  • Data flow diagram – Example
  • Threat enumeration using MS SDL’s STRIDE and DFD elements
  • Risk analysis – Classification of threats
  • The DREAD threat/risk ranking model
• Security Testing Techniques and Tools
  • General testing approaches
  • Techniques applicable to various SDLC stages
• Code Review
  • Code review for software security
  • Taint analysis
  • Heuristic methods
• Static Code Analysis
  • Overview of static code analysis
  • Exercise – Using static code analysis tools
• Testing the Implementation
  • Manual run-time verification
  • Manual versus automated security testing
  • Penetration testing
  • Stress testing
• Fuzzing
  • Automated security testing via fuzzing
  • Challenges associated with fuzzing
• Web Vulnerability Scanners
  • Exercise – Using a vulnerability scanner
• Environment Checking and Hardening
  • Common Vulnerability Scoring System (CVSS)
  • Vulnerability scanners
  • Public vulnerability databases
• Case Study – Forms Authentication Bypass
  • NULL byte termination vulnerability
  • The Forms Authentication Bypass vulnerability in code
  • Exploiting the Forms Authentication Bypass

Knowledge Resources

• Secure coding resources – Starter kit
• Vulnerability databases
• .NET secure coding guidelines on MSDN
• .NET secure coding cheat sheets
• Recommended books on .NET and ASP.NET