Executive Development Programme in Ensuring Security in C Code: Compliance and Testing

This course is designed for software engineers, developers, and technical leads responsible for developing secure C code. Participants will gain in-depth knowledge of security best practices, compliance requirements, and testing methodologies essential for ensuring robust and secure C code.

Attendees will learn how to identify and mitigate common security vulnerabilities, understand regulatory compliance standards like OWASP, and implement effective testing strategies to validate code security. The course includes hands-on labs to apply learned techniques in real-world scenarios.

1. 1. Introduction to Security in C Code: Learners will study the importance of security in C code and foundational concepts such as buffer overflows, format string vulnerabilities, and integer overflows. They will gain an understanding of how these issues can be exploited and the basic principles of secure coding.
2. 2. Secure Coding Fundamentals: This module covers essential secure coding practices, including input validation, secure memory management, and error handling. Learners will gain practical skills in writing secure C code and identifying common security pitfalls.
3. 3. Compliance Standards and Best Practices: Learners will delve into industry standards and best practices for secure C code, such as the CERT C Coding Standard and the Common Vulnerabilities and Exposures (CVE) database. They will learn how to ensure code compliance and reduce the risk of vulnerabilities.
4. 4. Static Code Analysis Tools: This module focuses on using static code analysis tools to identify potential security issues in C code. Learners will gain hands-on experience with tools like Clang Static Analyzer and Coverity, and understand how to integrate these tools into their development process.
5. 5. Dynamic Analysis and Testing Techniques: Learners will explore dynamic analysis techniques, such as fuzz testing and taint analysis, to uncover runtime vulnerabilities in C code. They will gain practical skills in setting up and executing dynamic analysis tests to identify and mitigate security risks.
6. 6. Penetration Testing and Exploit Development: This module covers the techniques used in penetration testing and exploit development. Learners will learn how to develop and execute exploits against vulnerable C code and understand the mindset of an attacker to better secure their own code.
7. 7. Secure Design Principles: Learners will study secure design principles and architectures, such as the principle of least privilege and the use of secure APIs. They will gain an understanding of how to design secure systems from the ground up.
8. 8. Advanced Topics in Secure C Programming: This module delves into advanced secure programming concepts, including cryptographic techniques, secure communication protocols, and memory safety. Learners will gain in-depth knowledge of these topics and their application in C code.
9. 9. Continuous Integration and Security: Learners will learn how to integrate security practices into a continuous integration pipeline. They will gain skills in automating security checks and ensuring that security is a continuous part of the development lifecycle.
10. 10. Leadership in Security and Compliance: This module focuses on the leadership aspects of ensuring security in C code. Learners will explore how to manage security in large organizations, build a security culture, and communicate security risks and strategies to stakeholders.