Abstract

This class is planned and organized to provide students with relevant content and information about secure code, which is a critical theme for planning and evaluating software security in a corporate context.

We will present details about modern topics that covers secure code lifecycle management, and present all relevant aspects and concepts to be considered while design secure software for professional scope. Class attendees will learn about existing system and code protections on critical operating systems. Afterwards, students will learn details about different vulnerability classes and their respective consequences. We will provide class attendees with a practical approach about main types code sanitizers. At the second part of the course we will take a deep dive into modern code static analysis through well-known tools. At the last part of the course, we present an quick introduction to reversing, exploitation and applied fuzzing to class attendees.

This class will focus on Windows operating system.

Who Should Attend

This class was carefully planned and organized for professionals interested in learning about secure code and involved concepts that must be considered while designing or evaluating software. Class attendees from different areas such as programming, exploit development, malware analysis, incident response, threat hunting, pentesting and cyber defense will enjoy and benefit from this training.

Key Learning Objectives

Students attending this class will:

  • Learn about secure code concepts.
  • Master secure code lifecycle management.
  • Learn about system and code protections.
  • Learn about vulnerability classes.
  • Learn about memory management and vulnerabilities.
  • Learn about code sanitizers.
  • Learn how to use static analysis tools.
  • Get an overview about reversing, exploitation and applied fuzzing.

Prerequisite Knowledge

Students attending this class will:

  • Handle and compile simple programs on Visual Studio.
  • Read and interpret short pieces of code in C/C++.
  • Basic experience with debuggers and programs such as IDA Pro could be useful.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • Two virtual machines running: Windows 11 x64.
  • One virtual machine running Ubuntu 22.04+ or REMnux.
  • Visual Studio and SDK installed (with WinDbg) on both Windows machines.
  • IDA Pro or IDA Free.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class follows:

  • Introduction and Lab Setup.
  • Secure Code Life Cycle.
  • Secure Code Concepts.
  • System and Code Protections.
  • Vulnerability Classes.
  • Memory Management and Vulnerabilities.
  • Code Sanitizers.
  • Modern Static Analysis Tools.
  • Introduction to applied Fuzzing.

Note: Topics can be added, merged or removed without prior notice!