Hello, and welcome to
this introductory course on
security problems in programming.
This is a second course in
the Secure Programming Specialization
offered by UC Davis.
My name is Sandra Escandor-O'Keefe,
and I have almost 10 years of combined experience working
both as a software developer
and then as a security engineer.
I started my career as
a software developer specializing in
systems level software development
using languages such as C and C++.
After five years as a software developer,
I then started on my specialization
as a security engineer.
As a security engineer,
I've had fun working on application security,
open-source code review, and vulnerability research.
I've also had the pleasure of giving talks
about security at ShmooCon and ThotCon,
and participate in a panel discussion on
DevSecOps at the RSA conference.
Over the next several weeks,
I will help you to build an understanding of
some of the fundamental concepts in secure program.
In the first module,
we'll discuss concepts in
threat modeling and cryptography.
You'll be able to start to create threat models and
think critically about the threat models
created by other people.
You will also gain a basic understanding of
applied cryptography such as
encryption and secure hashing.
In the second module,
we'll discuss issues with
improperly handling user-controlled data.
At the very least, it is
fascinating to understand how attackers can
exploit application vulnerabilities in
order to perform malicious activities.
But on a much more important level,
it helps those of us who work on creating and maintaining
application code to protect
the users who use our applications.
In this module, you will gain
a fundamental understanding of
injection problems in web applications.
You'll be able to discuss and describe
the three most common types of
injection problems: SQL injection,
Cross-site Scripting, and Command injection.
In the third module,
we'll discuss issues with
application authentication and session management.
Authentication is a major component
of a secure web application,
it ensures that only those users
who are properly identified and
allowed to use application are able
to access application resources.
Session management is the other side of the same coin,
since the authenticated state of
user requests need to be
properly handled and run as one session.
You'll be able to evaluate
a system to determine if it follows
the generally prescribed secure methods for
authentication and
session management in web applications.
You'll be able to distinguish
the relationship between authentication,
session management, and access control.
In the final module,
we'll discuss issues with sensitive data exposure.
Sensitive data exposure issues are important to
know so that you can help protect your customer's data.
You'll be able to understand how to effectively store
password-related information and not
to store the actual plain text passwords.
You will also have a hands-on coding assignment
that will help you to better
understand the mechanisms for
effectively storing password-related information.
Along the way, we'll discuss ways of watching out for
and mitigating these issues mentioned in these modules.
You will also be able to have some fun and exploit
two different vulnerabilities in
a web application that was designed
to be vulnerable, called WebGoat.
Software security is a really fascinating topic,
and I hope that you have a lot of fun learning
about software security during these several weeks.
We have a lot to cover. So let's dive in.