course-details-portlet

TDT4237 - Software Security

About

Examination arrangement

Examination arrangement: Portfolio assessment
Grade: Letters

Evaluation form Weighting Duration Examination aids Grade deviation
work 30/100
Written examination 70/100 4 hours D

Course content

The course will go through all the phases in the secure software development lifecycle (requirements, design, implementation and testing) focusing on how to incorporate security in each phase and what techniques to use. The main focus is on web-based applications, mobile apps, and cloud security.

Learning outcome

After having taken this course, students should be able to:

1) Identify typical security vulnerabilities of web applications listed in OWASP top 10, such as SQL injection, XSS, and XSRF, by reviewing the source code and by penetration testing. Students should also be able to fix the identified vulnerabilities; 2) Explain typical cryptograph concepts and algorithms that are related to web application, including e.g. block cipher, stream cipher, digital signature, and SSL/TSL handshaking procedure; 3) Apply the threat modeling methods to create threat models of a medium sized web application by using misuse cases and attack trees; 4) Describe and compare software engineering practices and standards related to software security, such as software touch points, common criteria, BASIMM, and OpenSAMM; 5) Create software security test cases and prioritizing the test cases by applying the risk-based testing framework; 6) Explain key authentication and authorization concepts and methods, such as different authentication methods, multilevel and multilateral security control, and role-based access control; 7) Explain, identify, and apply security mechanisms implemented in iOS and Android mobile application platforms; 8) Explain typical security issues of cloud platforms and services.

Learning methods and activities

Lectures, exercise lectures and mandatory exercises.
The exercises are obligatory. To pass the class, the students have to pass both the exercises and the final exam. The exercise grade in one semester will be valid for later exams.

Compulsory assignments

  • Øvinger

Further on evaluation

The portfolio includes a final written exam (70%) and exercises (30%). The results for the parts are given in %-scores, while the entire portfolio is assigned a letter grade. The text for the written final exam will be in English. The candidates may choose to write their answers in either English or Norwegian.
If there is a re-sit examination, the examination form may change from written to oral.
In the case that the student receives an F/Fail as a final grade after both ordinary and re-sit exam, then the student must retake the course in its entirety. Submitted work that counts towards the final grade will also have to be retaken.

Specific conditions

Exam registration requires that class registration is approved in the same semester. Compulsory activities from previous semester may be approved by the department.

Course materials

To be announced at the beginning of the semester.

More on the course

No

Facts

Version: 1
Credits:  7.5 SP
Study level: Second degree level

Coursework

Term no.: 1
Teaching semester:  SPRING 2020

No.of lecture hours: 2
Lab hours: 2
No.of specialization hours: 8

Language of instruction: English

Location: Trondheim

Subject area(s)
  • Computer and Information Science
  • Communication and Information Science
Contact information
Course coordinator:

Department with academic responsibility
Department of Computer Science

Phone:

Examination

Examination arrangement: Portfolio assessment

Term Status code Evaluation form Weighting Examination aids Date Time Digital exam Room *
Spring ORD work 30/100 INSPERA
Room Building Number of candidates
Spring ORD Written examination 70/100 D 2020-05-11 09:00 INSPERA
Room Building Number of candidates
  • * The location (room) for a written examination is published 3 days before examination date.
If more than one room is listed, you will find your room at Studentweb.
Examination

For more information regarding registration for examination and examination procedures, see "Innsida - Exams"

More on examinations at NTNU