IV Year - I Semester Code: 20CS7E05 L -3 T -0 P -0 C-3
SECURE CODING TECHNIQUES
Course Outcomes:
At the end of the Course, student will be able to:
Differentiate the objectives of information security
Understand the trend, reasons and impact of the recent Cyber attacks
Understand OWASP design principles while designing a web application
Understand Threat modelling
Importance of security in all phases of SDLC
Write secure coding using some of the practices in C/C++/Java and Python programming languages
UNIT I
Network and Information security Fundamentals: Network Basics, Network Components, Network
Types, Network Communication Types, Introduction to Networking Models, Cyber Security Objectives
and Services, Other Terms of Cyber Security, Myths Around Cyber Security, Myths Around Cyber
Security, Recent Cyber Attacks, Generic Conclusion about Attacks, Why and What is Cyber Security,
Categories of Attack
UNIT II
Introduction to Cyber security: Introduction to OWASP Top 10, A1 Injection, A1 Injection Risks
Root Causes and its Mitigation, A1 Injection, A2 Broken Authentication and Session Management, A7
Cross Site Scripting XSS,A3 Sensitive Data Exposure, A5 Broken Access Control, A4 XML External
Entity (XEE), A6 Security Misconfiguration, A7 Missing Function Level Access Control, A8 Cross
Site Request Forgery CSRF, A8 Insecure Deserialization, A9 Using Components With Known
Vulnerabilities, A10 Unvalidated Redirects and Forwards, A10 Insufficient Logging and Monitoring,
Secure Coding Practices, Secure Design Principles, Threat Modeling, Microsoft SDL Tool
UNIT III
Secure coding practices and OWASP Top 10: Declarative Security, Programmatic Security,
Concurrency, Configuration, Cryptography, Input and Output Sanitization, Error Handling, Input
Validation, Logging and auditing, Session Management, Exception Management, Safe APIs, Type
Safety, Memory Management, Tokenizing, Sandboxing, Static and dynamic testing, vulnerability
scanning and penetration testing
DEPARTMENT OF ELECTRONICS & COMMUNICATION ENGINEERING BR20 REGULATIONS
UNIT IV
Secure coding practices in C/C++ and Java: Potential Software Risks in C/C++, Defensive coding,
Preventative Planning, Clean Code, Iterative Design, Assertions, Pre Post Conditions, Low level design
inspections, Unit Tests
Java- Managing Denial of Service, Securing Information, Data Integrity, Accessibility and
Extensibility, Securing Objects, Serialization Security
UNIT V
Secure coding in Python: Interactive Python Scripting, Python Variables, Conditionals, Loops,
Functions, External Modules, File operations, Web requests
Text Books:
1. Networking Fundamentals, 2019 edition, Packt, Author: Gordon Davies
2. Principles of Information Security, Authors: Michael E. Whitman and Herbert J. Mattord, Course
technology incorp.
3. CSSLP SECURE SOFTWARE LIFECYCLE PROFESSIONAL ALL-IN-ONE EXAM GUIDE,
Third Edition, 3rd Edition, Authors: Wm. Arthur Conklin, Daniel Paul Shoemaker, Released February
2022,Publisher(s): McGraw-Hill,ISBN: 9781264258215
4. OCP Oracle Certified Professional Java SE 11 Programmer II Study Guide: Exam 1Z0-816 and
Exam 1Z0-817 Paperback – 6 August 2020, Authors: Scott Selikoff , Jeanne Boyarsky
5. OWASP 2017 Handbook,
[Link]
Web Reference : 1.[Link] myths-vs-reality/
2. [Link]
DEPARTMENT OF ELECTRONICS & COMMUNICATION ENGINEERING BR20 REGULATIONS
