Skip to content

Commit 5943791

Browse files
david-a-wheelerdavid-a-wheeler
committed
Add table of contents (TOC)
Some people want to quickly see a basic outline of the material, let's make that easy. Signed-off-by: David A. Wheeler <[email protected]>
1 parent affdf26 commit 5943791

File tree

2 files changed

+146
-0
lines changed

2 files changed

+146
-0
lines changed

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ project. Changes that are accepted into the Markdown must go through a series of
2828

2929
Changes to the markdown must have no errors reported by `markdownlint` using our configuration. This is checked when a pull request is made. You can do this check locally by installing markdownlint (e.g., `brew install markdownlint-cli` or `npm install -g markdownlint-cli`) and running `make`.
3030

31+
You can see a generated [table of contents](toc.md) - rerun `make` to regenerate it. This generated file is included in the repository itself for convenience of those new to the document.
32+
3133
This content was originally converted from Google docs format using
3234
[gdocs2md](http://github.com/mangini/gdocs2md),
3335
patched to skip inline drawings.

‎toc.md

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
Part I: Requirements, Design, and Reuse
2+
# Course Introduction
3+
## Introduction
4+
## A Note from the Author
5+
## Motivation
6+
### Motivation: Why Is It Important to Secure Software?
7+
### Motivation: Why Take This course?
8+
# Security Basics
9+
## What Do We Need?
10+
### What Does “Security” Mean?
11+
### Security Requirements
12+
### What Is Privacy and Why It Is Important
13+
### Privacy Requirements
14+
## How Can We Get There?
15+
### Risk Management
16+
### Development Processes / Defense-in-Breadth
17+
### Protect, Detect, Respond
18+
### Vulnerabilities
19+
# Design
20+
## Secure Design Basics
21+
### What Are Security Design Principles?
22+
### Widely-Recommended Secure Design Principles
23+
### Least Privilege
24+
### Complete Mediation (Non-Bypassability)
25+
### The Rest of the Saltzer & Schroeder Design Principles
26+
### Other Design Principles
27+
# Reusing External Software
28+
## Supply Chain
29+
### Basics of Reusing Software
30+
### Selecting (Evaluating) Open Source Software
31+
### Downloading and Installing Reusable Software
32+
### Updating Reused Software
33+
Part II: Implementation
34+
# Basics of Implementation
35+
### Implementation Overview
36+
# Input Validation
37+
## Input Validation Basics
38+
### Input Validation Basics Introduction
39+
### How Do You Validate Input?
40+
## Input Validation: Numbers and Text
41+
### Input Validation: A Few Simple Data Types
42+
### Sidequest: Text, Unicode, and Locales
43+
### Validating Text
44+
### Introduction to Regular Expressions
45+
### Using Regular Expressions for Text Input Validation
46+
### Countering ReDoS Attacks on Regular Expressions
47+
## Input Validation: Beyond Numbers and Text
48+
### Insecure Deserialization
49+
### Input Data Structures (XML, HTML, CSV, JSON, & File Uploads)
50+
### Minimizing Attack Surface, Identification, Authentication, and Authorization
51+
### Search Paths and Environment Variables (including setuid/setgid Programs)
52+
### Special Inputs: Secure Defaults and Secure Startup
53+
## Consider Availability on All Inputs
54+
### Consider Availability on All Inputs Introduction
55+
# Processing Data Securely
56+
## Processing Data Securely: General Issues
57+
### Prefer Trusted Data. Treat Untrusted Data as Dangerous
58+
### Avoid Default & Hardcoded Credentials
59+
### Avoid Incorrect Conversion or Cast
60+
## Processing Data Securely: Undefined Behavior / Memory Safety
61+
### Countering Out-of-Bounds Reads and Writes (Buffer Overflow)
62+
### Double-free, Use-after-free, and Missing Release
63+
### Avoid Undefined Behavior
64+
## Processing Data Securely: Calculate Correctly
65+
### Avoid Integer Overflow, Wraparound, and Underflow
66+
# Calling Other Programs
67+
## Introduction to Securely Calling Programs
68+
### Introduction to Securely Calling Programs - The Basics
69+
## Calling Other Programs: Injection and Filenames
70+
### SQL Injection
71+
### OS Command (Shell) injection
72+
### Other Injection Attacks
73+
### Filenames (Including Path Traversal and Link Following)
74+
## Calling Other Programs: Other Issues
75+
### Call APIs for Programs and Check What Is Returned
76+
### Handling Errors
77+
### Logging
78+
### Debug and Assertion Code
79+
### Countering Denial-of-Service (DoS) Attacks
80+
# Sending Output
81+
### Introduction to Sending Output
82+
### Countering Cross-Site Scripting (XSS)
83+
### Content Security Policy (CSP)
84+
### Other HTTP Hardening Headers
85+
### Cookies & Login Sessions
86+
### CSRF / XSRF
87+
### Open Redirects and Forwards
88+
### HTML **target** and JavaScript **window.open()**
89+
### Using Inadequately Checked URLs / Server-Side Request Forgery (SSRF)
90+
### Same-Origin Policy and Cross-Origin Resource Sharing (CORS)
91+
### Format Strings and Templates
92+
### Minimize Feedback / Information Exposure
93+
### Side-Channel Attacks
94+
Part III: Verification and More Specialized Topics
95+
# Verification
96+
## Basics of Verification
97+
### Verification Overview
98+
## Static Analysis
99+
### Static Analysis Overview
100+
### Software Composition Analysis (SCA)/Dependency Analysis
101+
## Dynamic Analysis
102+
### Dynamic Analysis Overview
103+
### Fuzz Testing
104+
### Web Application Scanners
105+
## Other Verification Topics
106+
### Combining Verification Approaches
107+
# Threat Modeling
108+
## Threat Modeling/Attack Modeling
109+
### Introduction to Threat Modeling
110+
### STRIDE
111+
# Cryptography
112+
## Applying Cryptography
113+
### Introduction to Cryptography
114+
### Symmetric/Shared Key Encryption Algorithms
115+
### Cryptographic Hashes (Digital Fingerprints)
116+
### Public-Key (Asymmetric) Cryptography
117+
### Cryptographically Secure Pseudo-Random Number Generator (CSPRNG)
118+
### Storing Passwords
119+
### Transport Layer Security (TLS)
120+
### Other Topics in Cryptography
121+
# Other Topics
122+
## Vulnerability Disclosures
123+
### Receiving Vulnerability Reports
124+
### Respond To and Fix the Vulnerability in a Timely Way
125+
### Sending Vulnerability Reports to Others
126+
## Miscellaneous
127+
### Assurance Cases
128+
### Harden the Development Environment (Including Build and CI/CD Pipeline) & Distribution Environment
129+
### Distributing, Fielding/Deploying, Operations, and Disposal
130+
### Artificial Intelligence (AI), Machine Learning (ML), and Security
131+
### Formal Methods
132+
## Top Vulnerability Lists
133+
### OWASP Top 10
134+
### CWE Top 25
135+
## Concluding Notes
136+
### Conclusions
137+
Part IV: Supporting Materials Not Part of the Course
138+
# Glossary
139+
# Further Reading
140+
# Old Mappings
141+
## OWASP Top 10 and CWE Top 25
142+
### OWASP Top 10 (2017 edition)
143+
### CWE Top 25 (2019 edition)
144+
# References

0 commit comments

Comments
 (0)