SECURITY TESTING NATIVE CODE

Introducción:

To put it bluntly, writing C/C++ code can be a minefield for reasons ranging from memory management or dealing with legacy code to sharp deadlines and code maintainability. Yet, beyond all that, what if we told you that attackers were trying to break into your applications right now? How likely would they be to succeed?

After getting familiar with the common weaknesses and their consequences that can allow hackers to attack your system, participants learn about the general approach and the methodology for security testing, and the techniques that can be applied to reveal specific vulnerabilities. Security testing should start with information gathering about the system (ToC, i.e. Target of Evaluation), then a thorough threat modeling should reveal and rate all threats, arriving to the most appropriate risk analysis-driven test plan.

Security evaluations can happen at various steps of the SDLC, and so we discuss design review, code review, reconnaissance and information gathering about the system, testing the implementation and the testing and hardening the environment for secure deployment. Many different security testing techniques are introduced in details, like taint analysis and heuristics-based code review, static code analysis or fuzzing. Various types of tools are introduced that can be applied in order to automate security evaluation of software products, which is also supported by a number of exercises, where we execute these tools to analyze the already discussed vulnerable code.

This course prepares testers and QA staff to adequately plan and precisely execute security tests for applications written in C or C++, select and use the most appropriate tools and techniques to find even hidden security flaws, and thus gives essential practical skills that can be applied on the next day working day.

Having secure applications will give you a distinct edge over your competitors. It is your choice to be ahead of the pack – take a step and be a game-changer in the fight against cybercrime.

Audiencia:

C and C++ developers testers.

Objetivos:

• Understand basic concepts of security, IT security and secure coding
• Realize the severe consequences of unsecure buffer handling
• Understand the architectural protection techniques and their weaknesses
• Learn about typical coding mistakes and how to avoid them
• Be informed about recent vulnerabilities in various platforms, frameworks and libraries
• Learn about denial of service attacks and protections
• Understand security testing approaches and methodologies
• Get practical knowledge in using security testing techniques and tools
• Learn how to set up and operate the deployment environment securely
• Get sources and further readings on secure coding practices

Temario:

• IT security and secure coding
• x86 machine code, memory layout and stack operations
• Buffer overflow
• Common coding errors and vulnerabilities
• Denial of service
• Security testing
• Security testing techniques and tools
• Deployment environment
• Principles of security and secure coding
• Knowledge sources