Microsoft SDL Core Training Course

Day 1

IT Security and Secure Coding Fundamentals

• The intrinsic nature of security
• Terminology related to IT security
• Defining risk
• Multi-dimensional aspects of IT security
• Requirements across different application domains
• Distinguishing IT security from secure coding
• The progression from vulnerabilities to botnets and cybercrime
  • Characteristics of security flaws
  • Factors contributing to remediation difficulty
  • The trajectory from infected machines to targeted attacks
• Taxonomy of security flaws
  • Landwehr’s classification system
  • The Seven Pernicious Kingdoms
  • OWASP Top Ten 2013
  • Comparative analysis of OWASP Top Ten (2003 vs. 2013)

Overview of the Microsoft® Security Development Lifecycle (SDL)

• Session Agenda
• The landscape of application attacks...
  • The evolution of cybercrime
  • The increasing focus on application-level attacks
  • The prevalence of vulnerabilities in smaller ISV applications
• The origins of the Microsoft SDL...
  • Key moments in Microsoft's security history...
  • Identification of applications mandated to follow the SDL
• The Microsoft Security Development Lifecycle (SDL) Framework
  • Core components of the Microsoft SDL
  • Pre-SDL Requirements: Security Training
  • Phase One: Requirements Gathering
  • Phase Two: Design
  • Phase Three: Implementation
  • Phase Four: Verification
  • Phase Five: Release – Response Planning
  • Phase Five: Release – Final Security Review
  • Phase Five: Release – Archival
  • Post-SDL Requirement: Incident Response
  • SDL Process Guidance for Line of Business (LOB) Applications
  • SDL Guidelines for Agile Development Methodologies
  • The role of process improvement in secure software development

Core Principles of Secure Design

• Managing the attack surface
  • Strategies for reducing the attack surface
  • Illustrative examples of attack surface
  • Conducting an attack surface analysis
  • Practical examples of surface reduction techniques
• Privacy considerations
  • Fundamental privacy principles
  • Analyzing application behaviors and privacy concerns
• Defense in Depth
  • SDL Core Principle: The concept of Defense in Depth
  • Real-world example of Defense in Depth
• The Principle of Least Privilege
  • Demonstrating the Least Privilege principle
• Establishing Secure Defaults
  • Examples of implementing secure default configurations

Principles of Secure Implementation

• Session Agenda
• Review of the Microsoft Security Development Lifecycle (SDL)
• Fundamentals of Buffer Overflows
  • Intel 80x86 Processors – Primary Registers
  • Memory address structure layout
  • Function calling conventions in C/C++ on x86 architectures
  • Local variables and the stack frame structure
  • Stack overflows
    • Buffer overflows within the stack
    • Introduction to practical exercises
    • Exercise: BOFIntro Overview
    • Exercise: BOFIntro – Determining stack layout
    • Exercise: BOFIntro – Executing a basic exploit
• Input Validation Strategies
  • Core concepts of input validation
  • Integer-related issues
    • Representation of negative integers
    • Integer overflow mechanisms
    • Arithmetic overflow – Predicting the outcome
    • Exercise: IntOverflow Scenario
    • Evaluating the result of Math.Abs(int.MinValue)
  • Mitigation strategies for integer issues
    • Overview of integer problem mitigation
    • Preventing arithmetic overflow during addition
    • Preventing arithmetic overflow during multiplication
    • Detecting overflows using the 'checked' keyword in C#
    • Exercise – Implementing the 'checked' keyword in C#
    • Handling exceptions triggered by overflows in C#
  • Case Study – Integer Overflow in .NET
    • Analyzing a real-world integer overflow vulnerability
    • Exploiting the identified integer overflow flaw
  • Path Traversal Vulnerabilities
    • Techniques for mitigating path traversal attacks

Day 2

Advanced Secure Implementation Principles

• Injection Attacks
  • Common SQL Injection attack vectors
  • Blind and time-based SQL injection techniques
  • Protective measures against SQL Injection
  • Command Injection threats
• Broken Authentication and Password Management
  • Exercise – Exploring the weaknesses of hashed passwords
  • Best practices for password management and storage
  • Specialized hash algorithms for secure password storage
• Cross-Site Scripting (XSS)
  • Understanding Cross-Site Scripting (XSS)
  • CSS Injection vulnerabilities
  • Exploitation tactics: Injection via alternate HTML tags
  • Preventing XSS attacks
• Lack of Function-Level Access Control
  • Filtering mechanisms for file uploads
• Applied Cryptography
  • Achieving confidentiality via symmetric cryptography
  • Overview of symmetric encryption algorithms
  • Block ciphers – Operational modes
  • Hashing and message digests
  • Detailed review of hash algorithms
  • Message Authentication Code (MAC)
  • Ensuring integrity and authenticity using symmetric keys
  • Achieving confidentiality through public-key encryption
  • Best practice: Managing private key possession
  • Common errors in password management
  • Exercise – Risks of hardcoded passwords
  • Conclusions

Principles of Secure Verification

• Distinguishing functional testing from security testing
• Identifying security vulnerabilities
• Prioritization strategies
• Integrating security testing into the SDLC
• Key steps in test planning (Risk Analysis)
• Defining scope and gathering information
  • Identifying stakeholders
  • Cataloging assets
  • Mapping the attack surface
  • Establishing security objectives for testing
• Threat Modeling
  • Fundamentals of Threat Modeling
  • Developing attacker profiles
  • Threat modeling utilizing attack trees
  • Threat modeling based on misuse/abuse cases
  • Misuse/abuse cases – A simple web shop scenario
  • STRIDE per element approach in Microsoft SDL threat modeling
  • Defining security objectives
  • Diagramming – Examples of Data Flow Diagram (DFD) elements
  • Data flow diagram – Practical example
  • Threat enumeration – Integrating Microsoft SDL’s STRIDE with DFD elements
  • Risk analysis – Categorizing threats
  • The DREAD threat/risk ranking model
• Security Testing Techniques and Tools
  • General testing methodologies
  • Techniques applicable to various SDLC stages
• Code Review
  • Code review processes for software security
  • Taint analysis techniques
  • Utilizing heuristics in security reviews
• Static Code Analysis
  • Overview of Static Code Analysis
  • Exercise – Applying static code analysis tools
• Testing the Implementation
  • Manual runtime verification
  • Comparing manual and automated security testing
  • Penetration testing procedures
  • Conducting stress tests
• Fuzzing
  • Automated security testing via fuzzing
  • Challenges associated with fuzzing
• Web Vulnerability Scanners
  • Exercise – Operating a vulnerability scanner
• Environment Verification and Hardening
  • Common Vulnerability Scoring System (CVSS)
  • Utilizing vulnerability scanners
  • Leveraging public databases
• Case Study – Forms Authentication Bypass
  • NULL byte termination vulnerabilities
  • Identifying the Forms Authentication Bypass flaw in code
  • Exploiting the Forms Authentication Bypass vulnerability

Recommended Knowledge Sources

• Essential resources for secure coding – A starter guide
• Access to comprehensive vulnerability databases
• .NET secure coding guidelines available on MSDN
• .NET secure coding cheat sheets
• Recommended literature for .NET and ASP.NET