|
所在平台: Coursera |
课程主页: https://www.coursera.org/learn/identifying-security-vulnerabilities-c-programming
课程评论：没有评论
课程名称：C/C++编程中的安全漏洞识别 概述：本课程建立在《安全编码原则》和《识别安全漏洞》这两门课程所学的技能和编码实践基础之上。课程采用聚焦技术，鼓励学员思考“需要注意什么”和“应该在哪里查看”来评估和改进脆弱的C++库代码。您将探讨的技术将使您的程序表现准确，并能抵抗不当操作的尝试。这正是安全编程的含义。课程将展示常见的编码错误，并教您如何更稳健地进行编程。您将运用提示和最佳实践来提升您的编程风格，避免诸如缓冲区溢出等常见问题，这些问题可能会引发安全隐患。 课程大纲： 1. **用户、权限和环境变量** - 描述：您将能够管理运行程序或子程序时的用户和权限。识别并使用Linux（以及类UNIX）系统中的不同权限，并了解程序Shell如何保持环境设置。您还将检查Shell（或使用PATH变量的其他程序）如何处理该变量的多个版本。 2. **验证与确认、缓冲和数字溢出、以及输入注入** - 描述：您将能够分解验证和确认输入过程，并避免程序中的缓冲和数字溢出。您将发现当您调用导致溢出的函数时会发生什么，并能够检测各种输入注入，例如跨站脚本和SQL注入，并描述未检查输入的后果。 3. **文件、子进程和竞争条件** - 描述：您将能够描述文件和子进程之间的交互，并能够创建子进程和Shell脚本。还将能够识别和预防程序中的竞争条件，并实践清理环境，以便为不可信的子进程提供安全的环境。 4. **随机性、密码学和其他主题** - 描述：您将能够区分伪随机性和真正的随机性。在编码环境中应用随机性，生成随机数并观察其分布。您将能够识别和描述密码学的使用原因，并理解为何应使用可信的密码学代码库而不是自行编写解决方案。课程还将分析处理敏感信息、密码、加密密钥的最佳实践，以及在安全敏感程序中处理错误、抵御字符串攻击的方法。您将能够对密码进行哈希处理并尝试猜测另一个密码，还将实践清理环境，以确保其对不可信的子进程安全，以及处理整数溢出。 通过本课程的学习，您将获得识别和修复C/C++代码安全漏洞的能力，从而编写出更安全、稳定的程序。
Name:Users, Privileges, and Environment Variables
Description:In this module, you will be able to manage users and privileges when you run programs or sub-programs. You will be able to identify and use the different types of privileges on a Linux (and UNIX-like) system. You'll be able to identify how program shells preserve environment settings. You will be able to examine how your shell (or other program that uses the PATH variable) deals with multiple versions of that variable.
Name:Validation and Verification, Buffer and Numeric Overflows, and Input Injections
Description:In this module, you will be able to breakdown how the process of checking inputs, known as validation and verification works. You will be able to avoid and buffer numeric overflows in your programs. You will be able to discover what happens when you call functions with parameters that cause overflows. And finally, you will be able to detect various input injections such as cross-site scripting and SQL injections and be able to describe the consequences of not examining input.
Name:Files, Subprocesses, and Race Conditions
Description:In this module, you will be able to describe how files and subprocesses interact and be able to create subprocesses and shell scripts. You will also be able to identify and prevent race conditions in your programs and practice cleaning out environments to make them safe for untrusted subprocesses.
Name:Randomness, Cryptography, and Other Topics
Description:In this module you will be able to distinguish between pseudo-randomness and actual randomness. You will be able to apply randomness in the coding environment and generate random numbers and look at their distribution. You'll be able to identify and describe how and why cryptography is used, as well as why you should use trusted cryptography code libraries instead of crafting your own solution. You will be able to analyze and consider best practices for handling sensitive information, passwords, crypto keys, how to handle errors in security sensitive programs, and how to defend against string attacks. You will be able to hash a password and then try to guess another one. You will be able to practice cleaning out environments to make them safe for untrusted subprocesses, as well as practice handling integer overflow.
This course builds upon the skills and coding practices learned in both Principles of Secure Coding and Identifying Security Vulnerabilities, courses one and two, in this specialization. This course uses the focusing technique that asks you to think about: “what to watch out for” and “where to look” to evaluate and ultimately remediate fragile C++ library code. The techniques you’ll be examining will make your programs perform accurately and be resistant to attempts to perform inaccurately. This is really what the term secure programming means. You will be shown common errors that people make, and then learn how to program more robustly. You will apply tips and best practices to help you improve your programming style and help you to avoid common problems like buffer overflows, which may or may not cause security problems.
