• Level: ING3
  • Semester: Autumn
  • Duration: 15h
  • Language: French (English possible)
  • Teacher: Pierre Parrend

Summary

This course aims to teach the software development and deployment lifecycle, the categories of code vulnerabilities, and their instantiation in the C language. Design methodologies and development best practices are key tools for implementing these concepts in the software developed.

Application is achieved through hands-on practice of the concepts studied, and through the development of a library or user software that applies these concepts.

Objectives

After completing this course, students will be able to:

  • Propose a production cycle for an IT solution
  • Implement development best practices with security objectives
  • Recognize code containing an exploitable design flaw
  • Implement basic palliative measures in modern systems
  • Audit code
  • Describe and analyze the most common application security issues
  • Demonstrate their involvement within a team project

Lecture outline

  • Lectures
    • Cybersecurity threats and the role of code
    • Vulnerability discovery methodologies: audit, automated analysis, language models
    • The software deployment chain and its vulnerabilities
    • Continuous integration and security
    • C code vulnerabilities
    • Compiled C code vulnerabilities
    • Exploiting C code vulnerabilities: loading, use-after-free, format string, buffer overflow
    • Fixing C code vulnerabilities
    • The software development lifecycle, a security perspective
    • Palliative measures in modern operating systems
    • CVE case study
  • Practical work
    • C code vulnerabilities
    • Compiled C code vulnerabilities
    • Fixing C code vulnerabilities
  • Project
    • Team-based
    • Implementation of a secure continuous integration pipeline
    • For the development of a library or user software following secure development best practices
    • Including a code audit

References