Software Security Presentation Dr. E. Benoist Spring Semester 2011 - - PowerPoint PPT Presentation

Berner Fachhochschule - Technik und Informatik

Software Security Presentation

• Dr. E. Benoist

Spring Semester 2011

Software Security Presentation 1

Presentation

◮ Emmanuel Benoist

• email: emmanuel.benoist(at)bfh.ch

◮ PhD at the University of Caen (France) ◮ Professor at the Berner Fachhochschule

• Teach Computer Science in Biel since 1999
• Specialties: Algorithmic, Web Programming and Web Security

◮ Web Security and Privacy protection on the Web

• Member of the Research Institute on Security in the

Information Societey (RISIS)

◮ Web Security ◮ Privacy Protection on the Web ◮ e-Health

• Member of the board : Certified Secure Web - CSW GmbH
• Member of the OWASP (Open Web Application Security

Platform) Swiss Chapter

Software Security Presentation 2

Course : Web and Software Security

◮ Goals of the course

• The students know the most important dangers for Internet

Web sites and their users.

• The students have an overview of the measures to take for

programming safe web sites.

• They can tell which are the basic-principles of Web security.
• They have applied these principles and can use them in real

applications.

• They know how buffer overflow work

◮ Part of the module 7263

• Web Security and Selected Security Topics

◮ Contact

• Emmanuel.Benoist (at) bfh.ch : Web Security
• Ulrich.Fiedler (at) bfh.ch : Buffer Overflow

Software Security Presentation 3

Control of Knowledge

◮ Pa Module

• Only one Exam
• No Homework, or experience Mark

◮ Examination

• Durring the examination week
• Details communicated later

Software Security Presentation 4

Schedule of the course 1

◮ Software Security

• Presentation of the problematic

◮ Web Security

• Owasp Top 10 (overview of the main problems)
• XSS - Cross Site Scripting,
• CSRF - Cross Site Request Forgery
• SQL Injection
• Other Injection flows

◮ Buffer Overflow

• Teached by Ulrich Fiedler

1Details are given on http://www.benoist.ch/SoftSec/ Software Security Presentation 5

Information about the Web Security course

◮ ◮ Web site of the course:

http://www.benoist.ch/SoftSec/

• Slides
• Examples
• Exercises
• Resources (bibliography and Internet)

Software Security Presentation 6

Bibliography

◮ OWASP Top 10 - 2010

http://www.owasp.org/index.php/Category: OWASP_Top_Ten_Project

◮ OWASP Developers Guide

http://www.owasp.org/index.php/Category: OWASP_Guide_Project

◮ Web Security Testing Cookbook Paco Hope and Ben

Walther, O’Reilly

◮ The Web Application Hacker’s Handbook Dafydd

Stuttard and Marcus Pinto, Wiley

◮ How to Break Web Software Mike Andrews and James A.

Whittaker, Addison Wesley

Software Security Presentation 7

Who are you?

◮ Proficiency in Web Programming? ◮ Proficiency in Security? ◮ German speaking / Frensh speaking ?

Software Security Presentation 8

Questions?

?

Software Security Presentation 9