Introduction to Secure Software Architecture

Links from the class materials and other supplemental information, grouped by chapter:

Chapter 1: Introduction

Chapter 2: Secure software architecture

Links from the text:

• NIST Computer Security Resource Center
• BSI English publications (the German equivalent of DHS)
• NSA CSS Security configuration guides
• DHS National Cybersecurity Division's Build Security In
• SearchSecurity Research Library
• IEEE Security and Privacy magazine
• AttackPrevention.com
• A translation of the 1995 FOCUS Magazine interview with Bill Gates where he states that their customers want features and not security
• Gene Spafford, a prominent security researcher, agrees
• Terry Brugger also agrees
• one take about programmers and security skills
• Bruce Schneier mentions security and money in the September 30, 2001 Crypto-Gram
• One of the WEP design flaws

Chapter 3: Threat models and risk management

Links from the text:

• Crypto-Gram
• the CERT OCTAVE approach to threat modeling
• Hacking The Hill by Shane Harris
• Storm worm dethroned by sex botnet in CIO magazine
• Kraken botnet entry in Wikipedia
• Blue Security folds under spammer's wrath by Robert Lemos
• Slashdot reaction
• the STRIDE model
• Another STRIDE document

Chapter 4: Cryptography Overview

Links from the text:

• Handbook of Applied Cryptography
• An excellent overview of cryptography
• The standards for the SHA series of hashes
• A program for finding collisions in MD5
• NIST and approved hash functions
• The American Bar Association Section of Science and Technology Information Security Committee Digital Signature Guidelines Tutorial
• Digital Signature Standard (DSS, also called DSA)
• using RSA for digital signatures
• 10 Risks of PKI
• the OpenSSL timing attack
• details about the WEP problems
• the TI transponder cracking
• OpenSSL timing attacks
• Why Cryptography Is Harder Than It Looks by Bruce Schneier
• Security Pitfalls in Cryptography by Bruce Schneier

Chapter 5: Programming Languages

Chapter 6: C

Chapter 7: Java

Chapter 8: JavaScript

Links from the text:

• About JavaScript
• A re-introduction to JavaScript
• JavaScript: The World's Most Misunderstood Programming Language
• Popularity by Brendan Eich
• JavaScript: How Did We Get Here? by Steve Champeon
• JavaScript history by Mark ``Tarquin'' Wilton-Jones
• JavaScript from Wikipedia
• Versions of JavaScript
• DOM Based Cross Site Scripting or XSS of the Third Kind by Amit Klein
• JavaScript---The Good Parts
• JavaScript threads
• Javascript to abuse privacy by stealing a user's browsing history
• Attacking Ajax Applications by Alex Stamos and Zane Lackey

Chapter 9: Operating Systems

Chapter 10: UNIX and Linux

Links from the text:

• The UNIX-HATERS Handbook edited by Simson Garfinkel, Daniel Weise and Steven Strassmann

Chapter 11: Microsoft Windows

Links from the text:

• Microsoft Vista's Endless Security Warnings by Bruce Schneier

Chapter 12: Network Servers

Chapter 13: Mail Transfer Agents (MTAs)

Links from the text:

• Wikipedia
• History of Microsoft Exchange by Caitlina Fuller
• Sendmail
• Exim
• qmail
• Postfix
• Microsoft Exchange
• Fingerprinting the World's Mail Servers by Ken Simpson and Stas Bekman
• Postfix---the Sendmail Replacement
• Postfix Architecture Overview
• Postfix Overview---Security
• technical information about Microsoft Exchange
• Exchange Security Documentation
• Qmail security guarantee
• Qmail documentation

Chapter 14: OpenSSH

Links from the text:

• details of the OpenSSH privilege separation
• picture of OpenSSH privilege separation

Chapter 15: Application Architecture

Chapter 16: Mozilla Firefox

Links from the text:

• Secure web browsing with the OP web browser by Chris Grier, Shuo Tang, and Samuel T. King

Chapter 17: Internet Explorer

Links from the text:

• Results of the Security in ActiveX Workshop from CERT

Additional links, not from the course text, or, software needed for the chapter:

Results of the Security in ActiveX Workshop (local copy)

Chapter 18: Microsoft Office

Chapter 19: Embedded system architecture

Chapter 20: Final lab

SkillBridge Training

Examples from the class notes (or, all as one file).

Selected Solutions from the class notes (no looking until you have solved the problems!). Note that all solutions are in an appendix of your course book. All solutions in a compressed tar file.

Evaluation form (if needed)