Microsoft SDL Core Training Course

Day 1

IT Security and Secure Coding

• The nature of security
• IT security terminology
• Defining risk
• Various aspects of IT security
• Requirements for different application areas
• IT security vs. secure coding
• From vulnerabilities to botnets and cybercrime
  • The nature of security flaws
  • Challenges in mitigation
  • From infected computers to targeted attacks
• Categorisation of security flaws
  • Landwehr’s taxonomy
  • The Seven Pernicious Kingdoms
  • OWASP Top Ten 2013
  • OWASP Top Ten comparison 2003 – 2013

Introduction to the Microsoft® Security Development Lifecycle (SDL)

• Agenda
• Applications under attack...
  • The evolution of cybercrime
  • Attacks are increasingly focusing on applications
  • Most vulnerabilities reside in smaller ISV apps
• Origins of the Microsoft SDL...
  • Security timeline at Microsoft...
  • Which applications are required to follow SDL?
• Microsoft Security Development Lifecycle (SDL)
  • Microsoft Security Development Lifecycle (SDL)
  • Pre-SDL Requirements: Security Training
  • Phase One: Requirements
  • Phase Two: Design
  • Phase Three: Implementation
  • Phase Four: Verification
  • Phase Five: Release – Response Plan
  • Phase Five: Release – Final Security Review
  • Phase Five: Release – Archive
  • Post-SDL Requirement: Response
  • SDL Process Guidance for LOB Apps
  • SDL Guidance for Agile Methodologies
  • Secure Software Development Requires Process Improvement

Secure Design Principles

• Attack surface
  • Reducing the attack surface
  • Attack surface – an example
  • Attack surface analysis
  • Attack surface reduction – examples
• Privacy
  • Privacy considerations
  • Understanding application behaviours and concerns
• Defence in depth
  • SDL Core Principle: Defence in Depth
  • Defence in depth – example
• Principle of least privilege
  • Least privilege – example
• Secure defaults
  • Secure defaults – examples

Secure Implementation Principles

• Agenda
• Microsoft Security Development Lifecycle (SDL)
• Buffer overflow basics
  • Intel 80x86 Processors – main registers
  • The memory address layout
  • The function calling mechanism in C/C++ on x86
  • Local variables and the stack frame
  • Stack overflow
    • Buffer overflow on the stack
    • Exercises – introduction
    • Exercise BOFIntro
    • Exercise BOFIntro – determine the stack layout
    • Exercise BOFIntro – a simple exploit
• Input validation
  • Concepts of input validation
  • Integer problems
    • Representation of negative integers
    • Integer overflow
    • Arithmetic overflow – guess the output!
    • Exercise IntOverflow
    • What is the value of Math.Abs(int.MinValue)?
  • Mitigating integer problems
    • Strategies for mitigating integer issues
    • Avoiding arithmetic overflow – addition
    • Avoiding arithmetic overflow – multiplication
    • Detecting overflow with the checked keyword in C#
    • Exercise – Using the checked keyword in C#
    • Exceptions triggered by overflows in C#
  • Case study – Integer overflow in .NET
    • A real-world integer overflow vulnerability
    • Exploiting the integer overflow vulnerability
  • Path traversal vulnerability
    • Mitigating path traversal

Day 2

Secure Implementation Principles

• Injection
  • Typical SQL Injection attack methods
  • Blind and time-based SQL injection
  • SQL Injection protection methods
  • Command injection
• Broken authentication - password management
  • Exercise – Weakness of hashed passwords
  • Password management and storage
  • Special purpose hash algorithms for password storage
• Cross-Site Scripting (XSS)
  • Cross-Site Scripting (XSS) overview
  • CSS injection
  • Exploitation: injection through other HTML tags
  • XSS prevention
• Missing function level access control
  • Filtering file uploads
• Practical cryptography
  • Providing confidentiality with symmetric cryptography
  • Symmetric encryption algorithms
  • Block ciphers – modes of operation
  • Hash or message digest
  • Hash algorithms
  • Message Authentication Code (MAC)
  • Providing integrity and authenticity with a symmetric key
  • Providing confidentiality with public-key encryption
  • Rule of thumb – possession of private key
  • Common mistakes in password management
  • Exercise – Hard coded passwords
  • Conclusion

Secure Verification Principles

• Functional testing vs. security testing
• Security vulnerabilities
• Prioritisation
• Security testing in the SDLC
• Steps of test planning (risk analysis)
• Scoping and information gathering
  • Stakeholders
  • Assets
  • The attack surface
  • Security objectives for testing
• Threat modelling
  • Overview of threat modelling
  • Attacker profiles
  • Threat modelling based on attack trees
  • Threat modelling based on misuse/abuse cases
  • Misuse/abuse cases – a simple Web shop example
  • STRIDE per element approach to threat modelling – MS SDL
  • Identifying security objectives
  • Diagramming – examples of DFD elements
  • Data flow diagram – example
  • Threat enumeration – MS SDL’s STRIDE and DFD elements
  • Risk analysis – classification of threats
  • The DREAD threat/risk ranking model
• Security testing techniques and tools
  • General testing approaches
  • Techniques for various steps of the SDLC
• Code review
  • Code review for software security
  • Taint analysis
  • Heuristics
• Static code analysis
  • Static code analysis overview
  • Exercise – Using static code analysis tools
• Testing the implementation
  • Manual run-time verification
  • Manual vs. automated security testing
  • Penetration testing
  • Stress tests
• Fuzzing
  • Automated security testing - fuzzing
  • Challenges of fuzzing
• Web vulnerability scanners
  • Exercise – Using a vulnerability scanner
• Checking and hardening the environment
  • Common Vulnerability Scoring System – CVSS
  • Vulnerability scanners
  • Public databases
• Case study – Forms Authentication Bypass
  • NULL byte termination vulnerability
  • The Forms Authentication Bypass vulnerability in the code
  • Exploiting the Forms Authentication Bypass

Knowledge Sources

• Secure coding sources – a starter kit
• Vulnerability databases
• .NET secure coding guidelines at MSDN
• .NET secure coding cheat sheets
• Recommended books – .NET and ASP.NET