About this course: This course we will explore the foundations of software security. We will consider important software vulnerabilities and attacks that exploit them -- such as buffer overflows, SQL injection, and session hijacking -- and we will consider defenses that prevent or mitigate these attacks, including advanced testing and program analysis techniques. Importantly, we take a "build security in" mentality, considering techniques at each phase of the development cycle that can be used to strengthen the security of software systems. Successful learners in this course typically have completed sophomore/junior-level undergraduate work in a technical field, have some familiarity with programming, ideally in C/C++ and one other "managed" program language (like ML or Java), and have prior exposure to algorithms. Students not familiar with these languages but with others can improve their skills through online web tutorials.
Created by: 马里兰大学帕克分校
Taught by: Michael Hicks, Professor
Department of Computer Science
| Basic Info | Course 2 of 5 in the Cybersecurity Specialization |
| Commitment | 6 weeks of study, 3-5 hours/week |
| Language | English, Subtitles: Korean |
| How To Pass | Pass all graded assignments to complete the course. |
| User Ratings |
Syllabus
WEEK 1
OVERVIEW
Overview and expectations of the course
3 videos, 4 readings, 1 practice quiz
- Lecture: Introductory Reading
- Lecture: Syllabus
- Video: What is software security?
- Video: Tour of the course and expected background
- Quiz pour s'exercer: Qualifying Quiz
- Lecture: FAQ and Errata
- Lecture: Glossary
LOW-LEVEL SECURITY
Low-level security: Attacks and exploits
6 videos, 2 readings
- Lecture: Week 1 Reading
- Video: Memory Layout
- Video: Buffer Overflow
- Video: Code Injection
- Video: Other Memory Exploits
- Video: Format String Vulnerabilities
- Lecture: Project 1
Graded: Week 1 quiz
Graded: VM BOF quiz
WEEK 2
DEFENDING AGAINST LOW-LEVEL EXPLOITS
Defending against low-level exploits
7 videos, 1 reading
- Lecture: Week 2 Reading
- Video: Memory Safety
- Video: Type Safety
- Video: Avoiding Exploitation
- Video: Return Oriented Programming - ROP
- Video: Control Flow Integrity
- Video: Secure Coding
Graded: Week 2 quiz
WEEK 3
WEB SECURITY
Web security: Attacks and defenses
10 videos, 2 readings
- Lecture: Week 3 Reading
- Video: Web Basics
- Video: SQL Injection
- Video: SQL Injection Countermeasures
- Video: Web-based State Using Hidden Fields and Cookies
- Video: Session Hijacking
- Video: Cross-site Request Forgery - CSRF
- Video: Web 2.0
- Video: Cross-site Scripting
- Video: Interview with Kevin Haley
- Lecture: Project 2
Graded: BadStore quiz
Graded: Week 3 quiz
WEEK 4
SECURE SOFTWARE DEVELOPMENT
Designing and Building Secure Software
10 videos, 1 reading
- Lecture: Week 4 Reading
- Video: Threat Modeling, or Architectural Risk Analysis
- Video: Security Requirements
- Video: Avoiding Flaws with Principles
- Video: Design Category: Favor Simplicity
- Video: Design Category: Trust With Reluctance
- Video: Design Category: Defense in Depth, Monitoring/Traceability
- Video: Top Design Flaws
- Video: Case Study: Very Secure FTP daemon
- Video: Interview with Gary McGraw
Graded: Week 4 quiz
WEEK 5
PROGRAM ANALYSIS
Static Program Analysis
13 videos, 2 readings
- Lecture: Week 5 Reading
- Video: Static Analysis: Introduction part 2
- Video: Flow Analysis
- Video: Flow Analysis: Adding Sensitivity
- Video: Context Sensitive Analysis
- Video: Flow Analysis: Scaling it up to a Complete Language and Problem Set
- Video: Challenges and Variations
- Video: Introducing Symbolic Execution
- Video: Symbolic Execution: A Little History
- Video: Basic Symbolic Execution
- Video: Symbolic Execution as Search, and the Rise of Solvers
- Video: Symbolic Execution Systems
- Video: Interview with Andy Chou
- Lecture: Project 3
Graded: Project 3 quiz
Graded: Week 5 quiz
WEEK 6
PEN TESTING
Penetration and Fuzz Testing
5 videos, 1 reading
- Lecture: Week 6 Reading
- Video: Pen Testing
- Video: Fuzzing
- Video: Interview with Eric Eames
- Video: Interview with Patrice Godefroid
Graded: Week 6 quiz
FAQs
How It Works
Travail en cours
Chaque cours fonctionne comme un manuel interactif en proposant des vidéos préenregistrées, des quiz et des projets.
Aide de la part de vos pairs
Connectez-vous à des milliers d'autres étudiants et débattez sur des idées, discutez le contenu du cours et obtenez de l'aide pour en maîtriser les concepts.
Certificats
Obtenez une reconnaissance officielle pour votre travail et partagez votre réussite avec vos amis, vos collègues et vos employeurs.
Creators
马里兰大学帕克分校
The University of Maryland is the state's flagship university and one of the nation's preeminent public research universities. A global leader in research, entrepreneurship and innovation, the university is home to more than 37,000 students, 9,000 faculty and staff, and 250 academic programs. Its faculty includes three Nobel laureates, three Pulitzer Prize winners, 47 members of the national academies and scores of Fulbright scholars. The institution has a $1.8 billion operating budget, secures $500 million annually in external research funding and recently completed a $1 billion fundraising campaign.
Pricing
| Purchase Course | |
|---|---|
| Access to course materials | Available |
| Access to graded materials | Available |
| Receive a final grade | Available |
| Earn a shareable Course Certificate | Available |
Ratings and Reviews
I'm currently on week 5 of this course (almost done) and so far it has been excellent. Week 2 will really drop you in at the deep end if you haven't learned about or as in my case haven't studied for a while the C programming language and how its executed in memory. Just stick with it and you will learn a lot of useful information.
Very demanding but very good!
great course I recommend everybody to take it
Coursera provides universal access to the world’s best education,
partnering with top universities and organizations to offer courses online.
© 2018 Coursera Inc. All rights reserved.
AA
Excellent course, i'd recommend it highly.