Safe programmingTopics

Within the framework of the topic, the basic concepts of secure programming, its purpose and role in software development are studied. the main factors that lead to the emergence of security vulnerabilities in software and threats originating from software code are considered. it explains the classification of software threats based on their origin, impact and exploitation characteristics. it also examines the importance of considering security requirements from the early stages of software development.

Within the scope of the topic, the main security vulnerabilities in the software code and their causes are studied. buffer overflow, integer overflow, use-after-free, and other common memory and data processing vulnerabilities are addressed. the potential impact of these vulnerabilities on application logic, memory management, and system security is explained. it also explores secure programming principles for identifying and preventing vulnerabilities at the code level.

Within the topic, the purpose, structure and role of CERT secure coding standards in secure software development are studied. the SEI CERT coding standards review the basic secure coding guidelines and recommendations established for the c and c++ programming languages. security requirements in memory management, data types, input processing, pointers, integers, and other coding areas are explained. it also examines the application of CERT guidelines in preventing code vulnerabilities and establishing secure programming practices.

In the framework of the topic, dangerous functions that can cause security vulnerabilities in c and c++ programming languages ​​and their safe alternatives are studied. features of using functions that pose risks during memory management, string processing, input data reception, and data transfer are reviewed. safer approaches and programming tools that can be used instead of these functions are explained. it also examines good practices in c/c++ programming for input validation, safe memory management, bounds checking, resource management, and safe coding.

Within the framework of the topic, the principles of safe handling of exceptions and errors in software, as well as checking of data from the user and external sources are studied. data leakage, unexpected program behavior, and other security risks that could result from improper error handling are considered. validation of input data in terms of type, format, length and allowed values, methods of preventing invalid data processing are explained. also explored are approaches to prevent injection and other application-level attacks by filtering and encoding output according to the context in which the data is presented.

Within the scope of the topic, the nature of format string vulnerabilities, their causes, and their impact on software security are studied. security risks resulting from uncontrolled use of user-entered data such as format strings are considered. the mechanisms by which these vulnerabilities lead to unauthorized reading, modification, program crash, and other security issues are explained. also explored are methods of protecting against format string vulnerabilities through safe use of format functions, implementation of fixed format strings, input validation, and use of compiler security mechanisms.

Within the framework of the topic, code-level analysis of serious security vulnerabilities in software is studied based on real industry examples. explains how the heartbleed vulnerability occurs as a result of improper memory checks and border controls. the relationship of the specter vulnerability to speculative execution mechanisms at the processor level and the impact on software security are considered. also, based on the lessons learned from these vulnerabilities, issues of secure coding, access verification, memory protection, and implementation of defense mechanisms are explored.

Within the subject, static and dynamic analysis approaches used for detecting security vulnerabilities in software are studied. the principles of analyzing program code before execution through static analysis, and during program execution through dynamic analysis are considered. addresssanitizer and valgrind are used to detect memory errors and runtime problems, and coverity and sonarqube to detect code quality and security vulnerabilities. it also examines the purposes, advantages, limitations, and application of various analysis tools in the software development process.

The topic explores secure coding principles and common application-level vulnerabilities in web programming. the causes of XSS and SQL injection vulnerabilities, their connection to the application's failure to handle input data securely, and their potential impact on software are reviewed. key protection mechanisms such as user input validation, context-sensitive output encoding, parameterized queries, and prepared statements are explained. it also explores the principles of integrating secure coding approaches into the web application development process and preventing vulnerabilities at the code level.

The principles of secure use of cryptographic apis in software are studied within the subject. issues of proper integration of encryption, hashing, digital signature and key management functions into the software code are considered. examples of dangerous programming are explained, such as using weak and outdated cryptographic algorithms, storing keys and passwords inside the code, not generating random numbers securely, choosing the wrong encryption parameters, and disabling certificate checks. it also examines the principles of using trusted cryptographic libraries, secure key management, and implementing secure default configurations.

The principles of secure user authentication and session management in software are studied within the subject. user identification and authentication, secure storage of passwords, multi-factor authentication, and protection of authentication information are considered. the principles of securely creating, storing, transferring, and revoking session identifiers, as well as properly managing session duration and user logout, are explained. it also examines security risks such as account hijacking, session hijacking, and session fixation caused by weak authentication and session management, and how to prevent them.

Within the framework of the topic, the principles of security auditing and systematic code review of the software code are studied. the purpose, scope, and key stages of code auditing are reviewed, as well as approaches to identifying security vulnerabilities and dangerous programming patterns. a code review explains the principles of checking security-critical areas such as input processing, authentication and authorization mechanisms, memory management, error handling, and the use of cryptographic functions. manual code review, evaluation of automated analysis results, documentation of detected problems and preparation of recommendations for elimination are also investigated.

Within the framework of the topic, the principles of security integration into devops and ci/cd processes are studied. approaches to incorporating security checks into software development, build, testing, and deployment phases are reviewed. explains the role of static and dynamic security testing, dependency and sensitive data testing, as well as automating security controls in a ci/cd pipeline. it also examines the devsecops approach, early detection of security issues, and ensuring continuous security throughout the software lifecycle.

Within the scope of the topic, widespread security risks in web applications and the principles of their prevention at the code level are studied. the main vulnerability categories identified within the OWASP top 10 are reviewed for their causes, exploit characteristics, and possible software impacts. dangerous coding patterns related to access control, injection, authentication, security configuration, cryptographic protection and other critical areas are analyzed. also explored are code-level approaches to address vulnerabilities through secure coding principles, input validation, output encryption, parameterized queries, secure authentication, and other defense mechanisms.