Secure Code


SS 2010

LVA - Name:
(Course name)

Secure Code

LVA - Nummer:
(Course number)


LVA - Typ
(Course type)


Wochenstunden pro Sem.:
(Week-hours per semester)



MSc. Dr. Alexandros Paramythis

Max. Teilnehmerzahl:
(Maximum participants)




Prerequisite knowledge:
Good knowledge of programming will be required. Participants should be familiar with both Java and C, and have at least working knowledge of HTML / HTTP and SQL.

(Lecture dates)

Block (The dates and times of lectures will be decided once the course starts)

Inhalt der LVA:
(Course contents)

Course curriculum:

  • Security Goals
    Authentication, Authorization, Confidentiality, Data / Message Integrity, Accountability, Availability, Non-Repudiation
  • Secure Systems Design
    Understanding Threats, “Designing-In” Security, Convenience and Security, Security By Obscurity, Open vs. Closed Source, A Game of Economics
  • Secure Design Principles
    Principle of Least Privilege, Defense-in-Depth & Diversity-in-Defense, Secure the Weakest Link, Fail-Safe Stance, Secure by Default, Simplicity & Usability
  • Worms and Other Malware
    Internet worms and their history, Rootkits, Botnets, Spyware, and more Malware
  • Buffer Overflows
    How buffer overflows work, machine hijacking, malicious code injenction, possible fixes (Safe string libraries, StackGuard, Static Analysis), other types of overflows (heap, integer, …)
  • Client-State Manipulation
    Examples of how manipulation of client state can affect the server in web applications
  • SQL Injection
    Command injection vulnerability - untrusted input inserted into query or command, SQL injection examples & solutions
  • Password Security
    Password systems and vulnerabilities, Threats: online & offline dictionary attacks, Solutions: hashing & salting
  • Cross-Domain Security in Web Applications
    Cross-Site Scripting (XSS), Cross-site request forgery (CSRF/XSRF), etc.

Project work:

As part of the course, you will be required to participate in a group project in which you will gain hands-on experience with the course material. The project will be assessed and marked, and will contribute towards the final mark for the course.


LVA - Modus:
(Teaching notes)

The lecture will be held in English!
Die Lehrveranstaltung wird in englischer Sprache abgehalten!


The course will have a final exam. Final marks will be derived proportionally from exam marks and from project marks (see above for details on the types of projects that will be available for selection)

(Reading material)

Course slides and accompanying materials, will be made available on the course's web site and will be available to course participants.

Sonstige Informationen:
(Additional information)

Further information about the course will be available on the course's web site. If you need additional details to decide whether you wish to register for the course, please communicate directly with the lecturer (see "Further inquiries" below).

Weitere Auskünfte:
(Further inquiries)

Alexandros Paramythis

letzte Änderung: 2010-02-08