Microsoft SDL Core Training Course

Day 1

IT security and secure coding

• The nature of security
• Key terms in IT security
• Defining risk
• Various dimensions of IT security
• Requirements across different application domains
• IT security versus secure coding
• From vulnerabilities to botnets and cybercrime
  • The nature of security flaws
  • Factors contributing to complexity
  • The progression from infected computers to targeted attacks
• Classification of security flaws
  • Landwehr’s taxonomy
  • The Seven Pernicious Kingdoms
  • OWASP Top Ten 2013
  • Comparison of OWASP Top Ten lists from 2003 to 2013

Introduction to the Microsoft® Security Development Lifecycle (SDL)

• Agenda
• Applications under threat
  • The evolution of cybercrime
  • Focus on application-layer attacks
  • Prevalence of vulnerabilities in smaller ISV applications
• Origins of the Microsoft SDL
  • Microsoft’s security timeline
  • Applications required to adhere to SDL guidelines
• Microsoft Security Development Lifecycle (SDL)
  • Overview of the Microsoft Security Development Lifecycle (SDL)
  • Pre-SDL Requirement: Security Training
  • Phase One: Requirements
  • Phase Two: Design
  • Phase Three: Implementation
  • Phase Four: Verification
  • Phase Five: Release – Response Plan
  • Phase Five: Release – Final Security Review
  • Phase Five: Release – Archive
  • Post-SDL Requirement: Response
  • SDL Process Guidance for Line of Business (LOB) Applications
  • SDL Guidance for Agile Methodologies
  • The role of process improvement in secure software development

Secure design principles

• Attack surface
  • Reducing the attack surface
  • Attack surface – illustrative example
  • Attack surface analysis
  • Attack surface reduction – practical examples
• Privacy
  • Principles of privacy
  • Understanding application behaviors and privacy concerns
• Defense in depth
  • SDL Core Principle: Defense in Depth
  • Defense in depth – illustrative example
• Least privilege principle
  • Least privilege – illustrative example
• Secure defaults
  • Secure defaults – practical examples

Secure implementation principles

• Agenda
• Microsoft Security Development Lifecycle (SDL)
• Fundamentals of buffer overflows
  • Intel 80x86 Processors – main registers
  • Memory address layout
  • Function calling mechanisms in C/C++ on x86 architectures
  • Local variables and stack frames
  • Stack overflow
    • Buffer overflow on the stack
    • Exercises – introduction
    • Exercise BOFIntro
    • Exercise BOFIntro – determining the stack layout
    • Exercise BOFIntro – executing a simple exploit
• Input validation
  • Concepts of input validation
  • Integer-related issues
    • Representation of negative integers
    • Integer overflow
    • Arithmetic overflow – prediction exercise
    • Exercise IntOverflow
    • Evaluating the value of Math.Abs(int.MinValue)
  • Mitigation strategies for integer issues
    • Overview of integer problem mitigation
    • Preventing arithmetic overflow in addition operations
    • Preventing arithmetic overflow in multiplication operations
    • Detecting overflow using the checked keyword in C#
    • Exercise – Utilizing the checked keyword in C#
    • Handling exceptions triggered by overflows in C#
  • Case study – Integer overflow in .NET
    • Analyzing a real-world integer overflow vulnerability
    • Exploiting the integer overflow vulnerability
  • Path traversal vulnerability
    • Path traversal mitigation techniques

Day 2

Secure implementation principles

• Injection attacks
  • Common SQL Injection attack methods
  • Blind and time-based SQL injection
  • Methods for protecting against SQL Injection
  • Command injection
• Broken authentication and password management
  • Exercise – Vulnerabilities in hashed passwords
  • Password management and storage practices
  • Specialized hash algorithms for password storage
• Cross-Site Scripting (XSS)
  • Overview of Cross-Site Scripting (XSS)
  • CSS injection
  • Exploitation: injection via other HTML tags
  • XSS prevention techniques
• Missing function-level access control
  • Filtering file uploads
• Practical cryptography
  • Ensuring confidentiality with symmetric cryptography
  • Symmetric encryption algorithms
  • Block ciphers – modes of operation
  • Hashing or message digests
  • Hash algorithms
  • Message Authentication Codes (MAC)
  • Ensuring integrity and authenticity using symmetric keys
  • Ensuring confidentiality with public-key encryption
  • Best practices – private key management
  • Common errors in password management
  • Exercise – Hard-coded passwords
  • Conclusion

Secure verification principles

• Functional testing versus security testing
• Security vulnerabilities
• Prioritization strategies
• Integrating security testing into the SDLC
• Test planning steps (risk analysis)
• Scoping and information gathering
  • Stakeholders
  • Assets
  • The attack surface
  • Security objectives for testing
• Threat modeling
  • Introduction to threat modeling
  • Attacker profiles
  • Threat modeling based on attack trees
  • Threat modeling based on misuse/abuse cases
  • Misuse/abuse cases – simple web shop example
  • STRIDE per element approach to threat modeling – MS SDL
  • Identifying security objectives
  • Diagramming – examples of DFD elements
  • Data flow diagram – example
  • Threat enumeration – MS SDL’s STRIDE and DFD elements
  • Risk analysis – classification of threats
  • The DREAD threat/risk ranking model
• Security testing techniques and tools
  • General testing approaches
  • Techniques applicable to various SDLC stages
• Code review
  • Code review for software security
  • Taint analysis
  • Heuristics
• Static code analysis
  • Overview of static code analysis
  • Exercise – Using static code analysis tools
• Testing the implementation
  • Manual run-time verification
  • Manual versus automated security testing
  • Penetration testing
  • Stress tests
• Fuzzing
  • Automated security testing via fuzzing
  • Challenges associated with fuzzing
• Web vulnerability scanners
  • Exercise – Using a vulnerability scanner
• Checking and hardening the environment
  • Common Vulnerability Scoring System – CVSS
  • Vulnerability scanners
  • Public databases
• Case study – Forms Authentication Bypass
  • NULL byte termination vulnerability
  • The Forms Authentication Bypass vulnerability in code
  • Exploiting the Forms Authentication Bypass

Knowledge sources

• Secure coding resources – a starter kit
• Vulnerability databases
• .NET secure coding guidelines on MSDN
• .NET secure coding cheat sheets
• Recommended books – .NET and ASP.NET