Safe programmingSyllabus

Subject code

İF-2214y

Credits

5

Student workload

90

Semester

Autumn semester

Academic year

4

Subject type

Mandatory

Form of education

Full-time

Language of instruction

Azerbaijani

In-class hours

a) 30 saat - mühazirə b) 15 saat - seminar c) 15 saat - laboratoriya

Out-of-class hours

a) 30 saat – sərbəst iş b) 60 saat- layihə işi və ya məsləhət saatı

The subject provides students with the application of security principles in the process of software development and the formation of theoretical knowledge and practical skills in safe coding. within the scope of the subject, the reasons for the emergence of security vulnerabilities caused by the primary code, exploitation methods and their prevention mechanisms are studied. students examine `buffer overflow', `format string', SQL injection, xss, and other typical software vulnerabilities, as well as SEI CERT secure coding standards. basic principles of secure authentication and session management, proper use of cryptographic apis, and code auditing are reviewed. application of security requirements throughout the entire life cycle of software from development to operation, as well as static (sast) and dynamic (dast) analysis methods are studied. the course is aimed at building students' skills in building a laboratory environment, investigating OWASP top 10 vulnerabilities, analyzing code from the point of view of security, and eliminating discovered vulnerabilities.

• lecture
• laboratory work
• presentations
• seminar
• interactive discussion
• problem-based learning
• teamwork
• case study

1. 1

   CLO 1: Understands what software security is and why it happens.

2. 2

   CLO 2: It understands the structure of the computer's memory, memory overflow, and how the exploits that occur because of this work.

3. 3

   CLO 3: Knows how to consider security aspects when building software architecture, principles of their prevention.

4. 4

   CLO 4: Software code auditing is able to use tools for automated dynamic and static code testing.

5. 5

   CLO 5: Knows the importance of security issues and the principles of its monitoring throughout the entire life cycle of software development.

6. 6

   CLO 6: Able to perform secure code auditing. the most common software in the world is aware of security holes.

1. 1.
   Introduction to secure programming, classification of threats in softwareLecture

   Within the framework of the topic, the basic concepts of secure programming, its purpose and role in software development are studied. the main factors that lead to the emergence of security vulnerabilities in software and threats originating from software code are considered. it explains the classification of software threats based on their origin, impact and exploitation characteristics. it also examines the importance of considering security requirements from the early stages of software development.

2. 2.
   The main types of code vulnerabilitiesLecture

   Within the scope of the topic, the main security vulnerabilities in the software code and their causes are studied. buffer overflow, integer overflow, use-after-free, and other common memory and data processing vulnerabilities are addressed. the potential impact of these vulnerabilities on application logic, memory management, and system security is explained. it also explores secure programming principles for identifying and preventing vulnerabilities at the code level.

3. 3.
   Introduction to CERT security standards. SEI CERT coding standards (c/c++)Lecture

   Within the topic, the purpose, structure and role of CERT secure coding standards in secure software development are studied. the SEI CERT coding standards review the basic secure coding guidelines and recommendations established for the c and c++ programming languages. security requirements in memory management, data types, input processing, pointers, integers, and other coding areas are explained. it also examines the application of CERT guidelines in preventing code vulnerabilities and establishing secure programming practices.

4. 4.
   Dangerous functions and their alternatives. good experience in c/c++ programmingLecture

   In the framework of the topic, dangerous functions that can cause security vulnerabilities in c and c++ programming languages ​​and their safe alternatives are studied. features of using functions that pose risks during memory management, string processing, input data reception, and data transfer are reviewed. safer approaches and programming tools that can be used instead of these functions are explained. it also examines good practices in c/c++ programming for input validation, safe memory management, bounds checking, resource management, and safe coding.

5. 5.
   Exception and error handling. input validation and output filteringLecture

   Within the framework of the topic, the principles of safe handling of exceptions and errors in software, as well as checking of data from the user and external sources are studied. data leakage, unexpected program behavior, and other security risks that could result from improper error handling are considered. validation of input data in terms of type, format, length and allowed values, methods of preventing invalid data processing are explained. also explored are approaches to prevent injection and other application-level attacks by filtering and encoding output according to the context in which the data is presented.

6. 6.
   Format string vulnerabilities and how to protect against themLecture

   Within the scope of the topic, the nature of format string vulnerabilities, their causes, and their impact on software security are studied. security risks resulting from uncontrolled use of user-entered data such as format strings are considered. the mechanisms by which these vulnerabilities lead to unauthorized reading, modification, program crash, and other security issues are explained. also explored are methods of protecting against format string vulnerabilities through safe use of format functions, implementation of fixed format strings, input validation, and use of compiler security mechanisms.

7. 7.
   Industry example: code-level analysis of heartbleed and specter vulnerabilitiesLecture

   Within the framework of the topic, code-level analysis of serious security vulnerabilities in software is studied based on real industry examples. explains how the heartbleed vulnerability occurs as a result of improper memory checks and border controls. the relationship of the specter vulnerability to speculative execution mechanisms at the processor level and the impact on software security are considered. also, based on the lessons learned from these vulnerabilities, issues of secure coding, access verification, memory protection, and implementation of defense mechanisms are explored.

8. 8.
   Dynamic and static analysis toolsLecture

   Within the subject, static and dynamic analysis approaches used for detecting security vulnerabilities in software are studied. the principles of analyzing program code before execution through static analysis, and during program execution through dynamic analysis are considered. addresssanitizer and valgrind are used to detect memory errors and runtime problems, and coverity and sonarqube to detect code quality and security vulnerabilities. it also examines the purposes, advantages, limitations, and application of various analysis tools in the software development process.

9. 9.
   Secure coding in web programming: xss, SQL injection and protection mechanismsLecture

   The topic explores secure coding principles and common application-level vulnerabilities in web programming. the causes of XSS and SQL injection vulnerabilities, their connection to the application's failure to handle input data securely, and their potential impact on software are reviewed. key protection mechanisms such as user input validation, context-sensitive output encoding, parameterized queries, and prepared statements are explained. it also explores the principles of integrating secure coding approaches into the web application development process and preventing vulnerabilities at the code level.

10. 10.
    Correct handling of cryptographic apis and avoiding dangerous patternsLecture

    The principles of secure use of cryptographic apis in software are studied within the subject. issues of proper integration of encryption, hashing, digital signature and key management functions into the software code are considered. examples of dangerous programming are explained, such as using weak and outdated cryptographic algorithms, storing keys and passwords inside the code, not generating random numbers securely, choosing the wrong encryption parameters, and disabling certificate checks. it also examines the principles of using trusted cryptographic libraries, secure key management, and implementing secure default configurations.

11. 11.
    Principles of secure authentication and session managementLecture

    The principles of secure user authentication and session management in software are studied within the subject. user identification and authentication, secure storage of passwords, multi-factor authentication, and protection of authentication information are considered. the principles of securely creating, storing, transferring, and revoking session identifiers, as well as properly managing session duration and user logout, are explained. it also examines security risks such as account hijacking, session hijacking, and session fixation caused by weak authentication and session management, and how to prevent them.

12. 12.
    Basic principles of code auditing. conducting a code reviewLecture

    Within the framework of the topic, the principles of security auditing and systematic code review of the software code are studied. the purpose, scope, and key stages of code auditing are reviewed, as well as approaches to identifying security vulnerabilities and dangerous programming patterns. a code review explains the principles of checking security-critical areas such as input processing, authentication and authorization mechanisms, memory management, error handling, and the use of cryptographic functions. manual code review, evaluation of automated analysis results, documentation of detected problems and preparation of recommendations for elimination are also investigated.

13. 13.
    Integrating security into secure devops and ci/cd processesLecture

    Within the framework of the topic, the principles of security integration into devops and ci/cd processes are studied. approaches to incorporating security checks into software development, build, testing, and deployment phases are reviewed. explains the role of static and dynamic security testing, dependency and sensitive data testing, as well as automating security controls in a ci/cd pipeline. it also examines the devsecops approach, early detection of security issues, and ensuring continuous security throughout the software lifecycle.

14. 14.
    Owasp top 10 vulnerabilities and how to fix them at the code levelLecture

    Within the scope of the topic, widespread security risks in web applications and the principles of their prevention at the code level are studied. the main vulnerability categories identified within the OWASP top 10 are reviewed for their causes, exploit characteristics, and possible software impacts. dangerous coding patterns related to access control, injection, authentication, security configuration, cryptographic protection and other critical areas are analyzed. also explored are code-level approaches to address vulnerabilities through secure coding principles, input validation, output encryption, parameterized queries, secure authentication, and other defense mechanisms.

1. Robert c. seacord, secure coding in c and c++ (2nd edition), addison-wesley.
2. Mark dowd et al., the art of software security assessment, addison-wesley.
3. Gary mcgraw, software security: building security in.
4. Owasp secure coding practices – quick reference guide (https://owasp.org)
5. Tanya janca. alice and bob learn secure coding. john wiley & sons, 2025. 416p.
6. Owasp foundation. OWASP secure coding practices – quick reference guide (version 2.0.1). 2022. 17 p.
7. Carnegie mellon university software engineering institute. SEI CERT c coding standard. 2024.
8. Owasp foundation. OWASP top 10: the ten most critical web application security risks. 2021.
9. National institute of standards and technology. secure software development framework (ssdf) – SP 800-218. 2022. 44 p.
10. National institute of standards and technology. guidelines for minimizing the risk of software vulnerabilities (sp 800-218a and related documents). 2023.
11. Tanya janca — alice and bob learn secure coding. john wiley & sons, 2025. 416p.