Microsoft SDL Core Training Course

Day 1

IT Security and Secure Coding

• The nature of security
• Terminology related to IT security
• Defining risk
• Various dimensions of IT security
• Requirements across different application domains
• IT security versus secure coding
• Progressing from vulnerabilities to botnets and cybercrime
  • The nature of security flaws
  • Factors contributing to complexity
  • From compromised computers to targeted attacks
• Classifying security flaws
  • Landwehr’s taxonomy
  • The Seven Pernicious Kingdoms
  • OWASP Top Ten 2013
  • Comparison of OWASP Top Ten (2003 – 2013)

Introduction to the Microsoft® Security Development Lifecycle (SDL)

• Agenda overview
• Applications facing threats...
  • The evolution of cybercrime
  • Attacks increasingly target applications
  • Majority of vulnerabilities reside in smaller ISV applications
• The origins of Microsoft SDL...
  • Microsoft’s security timeline...
  • Which applications are mandated to follow SDL?
• Microsoft Security Development Lifecycle (SDL) details
  • Overview of the Microsoft Security Development Lifecycle (SDL)
  • Pre-SDL Requirements: Security Training
  • Phase One: Requirements
  • Phase Two: Design
  • Phase Three: Implementation
  • Phase Four: Verification
  • Phase Five: Release – Response Plan
  • Phase Five: Release – Final Security Review
  • Phase Five: Release – Archive
  • Post-SDL Requirement: Response
  • SDL Process Guidance for Line of Business (LOB) Apps
  • SDL Guidance for Agile Methodologies
  • The need for process improvement in secure software development

Secure Design Principles

• Attack surface
  • Reducing the attack surface
  • Attack surface – a case study
  • Analyzing the attack surface
  • Examples of attack surface reduction
• Privacy
  • Concepts of privacy
  • Understanding application behaviors and privacy concerns
• Defense in depth
  • SDL Core Principle: Defense In Depth
  • Defense in depth – illustrative example
• Principle of least privilege
  • Least privilege – practical example
• Secure defaults
  • Examples of secure defaults

Secure Implementation Principles

• Agenda
• Microsoft Security Development Lifecycle (SDL)
• Fundamentals of buffer overflows
  • Intel 80x86 Processors – primary registers
  • Memory address layout structure
  • Function calling mechanisms in C/C++ on x86
  • Local variables and stack frames
  • Stack overflow scenarios
    • Buffer overflows on the stack
    • Exercises – Introduction
    • Exercise BOFIntro
    • Exercise BOFIntro – Determining stack layout
    • Exercise BOFIntro – Creating a simple exploit
• Input validation
  • Core concepts of input validation
  • Integer handling issues
    • Representing negative integers
    • Integer overflow conditions
    • Arithmetic overflow – Predict the output
    • Exercise IntOverflow
    • Determining the value of Math.Abs(int.MinValue)
  • Mitigating integer issues
    • Strategies for mitigating integer problems
    • Preventing arithmetic overflow – Addition
    • Preventing arithmetic overflow – Multiplication
    • Detecting overflow using the checked keyword in C#
    • Exercise – Utilizing the checked keyword in C#
    • Exceptions resulting from overflows in C#
  • Case study – Integer overflow in .NET
    • Analyzing a real-world integer overflow vulnerability
    • Exploiting the integer overflow vulnerability
  • Path traversal vulnerabilities
    • Methods for mitigating path traversal

Day 2

Secure Implementation Principles

• Injection attacks
  • Common SQL Injection attack vectors
  • Blind and time-based SQL injection techniques
  • Methods for protecting against SQL Injection
  • Command injection risks
• Broken authentication and password management
  • Exercise – Weaknesses in hashed passwords
  • Best practices for password management and storage
  • Hash algorithms designed specifically for password storage
• Cross-Site Scripting (XSS)
  • Understanding Cross-Site Scripting (XSS)
  • CSS injection vectors
  • Exploitation: Injection via other HTML tags
  • Strategies for XSS prevention
• Lack of function-level access control
  • Filtering file uploads securely
• Practical cryptography
  • Ensuring confidentiality with symmetric cryptography
  • Symmetric encryption algorithms
  • Block ciphers – operational modes
  • Hashing or message digests
  • Various hash algorithms
  • Message Authentication Codes (MAC)
  • Ensuring integrity and authenticity using symmetric keys
  • Ensuring confidentiality with public-key encryption
  • Best practice – Managing private key possession
  • Common errors in password management
  • Exercise – Risks of hard-coded passwords
  • Key takeaways

Secure Verification Principles

• Distinction between functional and security testing
• Understanding security vulnerabilities
• Prioritization strategies
• Integrating security testing into the SDLC
• Steps in test planning (risk analysis)
• Defining scope and gathering information
  • Identifying stakeholders
  • Identifying assets
  • Analyzing the attack surface
  • Establishing security objectives for testing
• Threat modeling
  • Fundamentals of threat modeling
  • Profiling attackers
  • Threat modeling using attack trees
  • Threat modeling based on misuse/abuse cases
  • Misuse/abuse cases – Example of a simple web shop
  • STRIDE per element approach to threat modeling – MS SDL
  • Defining security objectives
  • Diagramming – Examples of DFD elements
  • Data flow diagram – Practical example
  • Threat enumeration – MS SDL’s STRIDE and DFD elements
  • Risk analysis – Categorizing threats
  • The DREAD threat/risk ranking model
• Security testing techniques and tools
  • General testing methodologies
  • Techniques for different stages of the SDLC
• Code review
  • Code review for software security purposes
  • Taint analysis techniques
  • Heuristics in code review
• Static code analysis
  • Overview of static code analysis
  • Exercise – Utilizing static code analysis tools
• Testing the implementation
  • Manual runtime verification
  • Comparing manual and automated security testing
  • Penetration testing
  • Stress testing
• Fuzzing
  • Automated security testing via fuzzing
  • Challenges associated with fuzzing
• Web vulnerability scanners
  • Exercise – Using a vulnerability scanner
• Environment checking and hardening
  • Common Vulnerability Scoring System – CVSS
  • Use of vulnerability scanners
  • Leveraging public databases
• Case study – Forms Authentication Bypass
  • NULL byte termination vulnerabilities
  • The Forms Authentication Bypass vulnerability in code
  • Exploiting the Forms Authentication Bypass

Knowledge Resources

• Starter kit for secure coding sources
• Vulnerability databases
• .NET secure coding guidelines on MSDN
• .NET secure coding cheat sheets
• Recommended books – .NET and ASP.NET