COSC424-19S2 (C) Semester Two 2019

Secure Software

15 points
15 Jul 2019 - 10 Nov 2019

Description

This course provides students with skills to design and implement secure application programs, which are not vulnerable to malicious attacks.

This course provides students with skills to design and implement secure application programs, which are not vulnerable to malicious attacks. This course is concerned with designing and implementing secure application programs, that is, programs that are not vulnerable to malicious attacks. By the end of the course, students should be familiar with why security is important, what types of vulnerabilities can be present in software, how they can be exploited, and how to go about developing software that is sufficiently secure. The course involves significant practical work including a project.

Learning Outcomes

  • Students who successfully complete this course will be able to:
  • understand various types of vulnerabilities in software, how they can be exploited,
  • understand and explain how to develop sufficiently secure  software,
  • critique secure software design, implementation and evaluation in practice.
  • develop an ability to design, implement and test a secure software application

Pre-requisites

Subject to approval of the Head of Department.

Timetable 2019

Students must attend one activity from each section.

Lecture A
Activity Day Time Location Weeks
01 Wednesday 13:00 - 15:00 Ernest Rutherford 140 15 Jul - 25 Aug
9 Sep - 20 Oct
Computer Lab A
Activity Day Time Location Weeks
01 Thursday 09:00 - 11:00 West 732 15 Jul - 25 Aug
9 Sep - 20 Oct
02 Thursday 11:00 - 13:00 West 732 15 Jul - 25 Aug
9 Sep - 20 Oct
03 Friday 09:00 - 11:00 West 732 15 Jul - 25 Aug
9 Sep - 20 Oct
04 Friday 11:00 - 13:00 West 732 15 Jul - 25 Aug
9 Sep - 20 Oct
05 Friday 13:00 - 15:00 West 732 15 Jul - 25 Aug
9 Sep - 20 Oct

Course Coordinator

Richard Green

Lecturer

Ray Hunt

Assessment

Assessment Due Date Percentage 
Assignment 30%
Assignment 30%
Final Exam 40%


The final exam will be used to evaluate a student’s overall understanding of the theoretical and technical aspects discussed in the course.

An important component of this course is to gain skills in the testing and evaluation of software cybersecurity systems. Thus a set of labs will be run which are outlined below

1. Practical Network Software Security Policy Implementation and Testing:  Stateful packet inspection, cryptographic tools, Public Key Infrastructure, implementation and testing

This lab addresses the implementation and design of secure software infrastructure and develops a good knowledge of firewall security policy implementation and testing thus aiming to avoid cybersecurity disasters.

2. Penetration Testing and Intrusion Detection:  SSL Data Leakage - Heartbleed, SSL Interception - Man-In-The-Middle Vulnerabilities, Penetration Testing using Zenmap, Nessus and Snorby Graphical User Interface Intrusion Detection

There are two components to this lab. The first provides experience and expertise with industry Penetration Testing and Intrusion Detection systems and tools as used in practice in addressing issues in the software cybersecurity world. The second part addresses legal interception and provides skills used by software security intelligence services and the police.

3. Identity and Access Management Software for Cloud Services:  Active Directory, RSA multifactor authentication using hardware, software and mobile phone devices, smartcard identity, Gallagher cloud service security

This lab is extends the previous two and develops the tools necessary for linking many of these devices and systems together and for providing multifactor authentication as well as providing for implementation and testing.

4. Wireless and Mobile Software Security: Wireless LANs, Wireless Enterprise Architecture, Android, Bluetooth and NFC/RFID Smartcard security.

This lab focuses on graduates who will work in the area of wireless and mobile enterprise software engineering security and will be responsible for design, implementation and testing and will required to address key cybersecurity issues in this framework.

5. Application Forensics: TCP/IP, VoIP (Voice over IP) and Video – attacks, exploits and software forensic analysis, Analysing voice, image and video traffic with Wireshark

This lab is for those who intend to work in police forensics and security intelligence services and must address and understand cybersecurity attacks.

Textbooks / Resources

Information will be given in lectures on appropriate background reading material for each stage of this course.

Additional Course Outline Information

Grade moderation

The Computer Science department's grading policy states that in order to pass a course you must meet two requirements:
1. You must achieve an average grade of at least 50% over all assessment items.
2. You must achieve an average mark of at least 45% on invigilated assessment items.
If you satisfy both these criteria, your grade will be determined by the following University- wide scale for converting marks to grades: an average mark of 50% is sufficient for a C- grade, an average mark of 55% earns a C grade, 60% earns a B- grade and so forth. However if you do not satisfy both the passing criteria you will be given either a D or E grade depending on marks. Marks are sometimes scaled to achieve consistency between courses from year to year.

Students may apply for special consideration if their performance in an assessment is affected by extenuating circumstances beyond their control.

Applications for special consideration should be submitted via the Examinations Office website within five days of the assessment.

Where an extension may be granted for an assessment, this will be decided by direct application to the Department and an application to the Examinations Office may not be required.

Special consideration is not available for items worth less than 10% of the course.

Students prevented by extenuating circumstances from completing the course after the final date for withdrawing, may apply for special consideration for late discontinuation of the course. Applications must be submitted to the Examinations Office within five days of the end of the main examination period for the semester.

Tentative lecture schedule

Week 1 Network Software Security Policy Implementation and Testing (1)
Week 2 Network Software Security Policy Implementation and Testing (2)
Week 3 Penetration Testing and Intrusion Detection (1)
Week 4 Penetration Testing and Intrusion Detection (2)
Week 5 Identity and Access Management Software for Cloud Services (1)
Week 6 Identity and Access Management Software for Cloud Services (2)
Semester Break
Week 7 Software Security Assessment in Wireless, Mobile, Bluetooth and Smartcards (1)
Week 8 Software Security Assessment in Wireless, Mobile, Bluetooth and Smartcards (2)
Week 9 Software Security Assessment in Wireless, Mobile, Bluetooth and Smartcards (3)
Week 10 Application Forensics (1)
Week 11 Application Forensics (2)

Indicative Fees

Domestic fee $1,002.00

* Fees include New Zealand GST and do not include any programme level discount or additional course related expenses.

For further information see Computer Science and Software Engineering.

All COSC424 Occurrences

  • COSC424-19S2 (C) Semester Two 2019