Software Security
- Level
- Undergraduate
- Status
- Under development
Note: this course is still being designed and calibrated; the page content is for reference and does not represent the final teaching version.
Syllabus
Course Overview
Software Security connects software engineering, program analysis, and adversarial thinking. The course covers memory safety, input validation, web and API security, dependency risk, fuzzing, static analysis, and secure remediation. The goal is not only exploit writing, but understanding how vulnerabilities arise, are found, validated, and fixed in an engineering workflow.
This is the security entry course after software engineering and a foundation for system security, program analysis, and security baseline automation.
Prerequisites
- Familiarity with one systems or backend programming language.
- Understanding of Git, testing, HTTP, and basic database concepts.
- Software engineering or equivalent team project experience is recommended.
Learning Outcomes
- Explain root causes and exploitability conditions for common software vulnerabilities.
- Use static analysis, dynamic testing, and fuzzing to find defects.
- Write minimal reproducers, vulnerability reports, and patches.
- Integrate security checks into CI and release workflows.
- Assess software supply-chain risk from dependencies, configuration, and interfaces.
Course Format
- Two meetings per week: one for core concepts and one for labs, paper discussion, or project review.
- The course proceeds over 16 weeks, each with a checkable assignment, lab, or project milestone.
- Reproducibility is required: code, configuration, data, lab logs, and reports must be reviewable by staff or peers.
Weekly Plan
Vulnerability models and secure engineering workflow
Analyze real advisories and separate root cause, impact, and fix.
Vulnerability models and secure engineering workflow: lab and review
Analyze real advisories and separate root cause, impact, and fix. Complete the paired lab, record issues, and explain design tradeoffs in class review.
Memory safety and undefined behavior
Reproduce buffer, use-after-free, and integer bugs.
Memory safety and undefined behavior: lab and review
Reproduce buffer, use-after-free, and integer bugs. Complete the paired lab, record issues, and explain design tradeoffs in class review.
Input validation, serialization, and injection
Build injection tests and fix parsing boundaries.
Input validation, serialization, and injection: lab and review
Build injection tests and fix parsing boundaries. Complete the paired lab, record issues, and explain design tradeoffs in class review.
Web, API, authentication, and authorization
Audit access control in a small web service.
Web, API, authentication, and authorization: lab and review
Audit access control in a small web service. Complete the paired lab, record issues, and explain design tradeoffs in class review.
Fuzzing and dynamic detection
Add a fuzz harness and sanitizers to a target library.
Fuzzing and dynamic detection: lab and review
Add a fuzz harness and sanitizers to a target library. Complete the paired lab, record issues, and explain design tradeoffs in class review.
Static analysis, code queries, and triage
Write query rules and triage alerts by priority.
Static analysis, code queries, and triage: lab and review
Write query rules and triage alerts by priority. Complete the paired lab, record issues, and explain design tradeoffs in class review.
Dependency, build, and supply-chain security
Generate an SBOM and assess upgrade and pinning strategy.
Dependency, build, and supply-chain security: lab and review
Generate an SBOM and assess upgrade and pinning strategy. Complete the paired lab, record issues, and explain design tradeoffs in class review.
Secure remediation, disclosure, and regression tests
Submit the final patch, test evidence, and disclosure draft.
Secure remediation, disclosure, and regression tests: lab and review
Submit the final patch, test evidence, and disclosure draft. Complete the paired lab, record issues, and explain design tradeoffs in class review.
Assessment
Concept questions, reading responses, design tasks, and small programming or lab exercises.
Vulnerability analysis, test harnesses, remediation patches, and security reports.
Participation in discussions, demos, code or paper reviews, and peer feedback.
Submit reproducible artifacts, a technical report, and a demo explaining methods, results, limitations, and future work.
Course Project
Students choose an open-source or course-provided target and complete threat modeling, vulnerability discovery, reproduction, remediation, and regression testing. Deliverables include a security report, patch, test evidence, and reproducible analysis scripts.
Policies
- AI tools are allowed, but generated code, lab notes, and design suggestions must be reviewed by the student and disclosed in the report.
- Students may not submit code, proofs, configuration, or experimental results they cannot explain; each member must defend their own design, tests, and tradeoffs.
- Late work affects iteration grades, but the course values reproducible, auditable, and maintainable results over last-minute accumulation.
Reference Courses
International
- CambridgeSoftware and Security Engineering
- CMU18-732 Secure Software Systems
- ETH ZurichSystem Security
- Georgia TechCS 6265 Information Security Lab
- MIT6.566 Computer Systems Security
- PrincetonCOS 432 Information Security
- StanfordCS 155 Computer and Network Security
- UC BerkeleyCS 161 Computer Security
- University of WashingtonCSE 484 Computer Security
China 985 Universities
- 上海交通大学IS308 计算机系统安全
- 中国科学技术大学软件安全与测试
- 北京大学信息安全实验室
- 华中科技大学网络空间安全学院
- 南京大学COSEC 安全课程
- 哈尔滨工业大学网络空间安全学院
- 复旦大学系统软件与安全实验室
- 浙江大学Network Security
- 清华大学网络空间安全研究生课程