So I was asked to put together a syllabus for a series of courses on the basics of secure coding, for a programming team. Though the time constraints are a bit... constraining, I'm working around that...
However, I'm coming up a bit short on relevant topics, though I feel that there should be something else. It's been a while since I've done this, so these topics are admittedly not fresh in my mind...
Note that this is only one part of a larger series, the other parts are dealing with all the other aspects of a security course - principles, best practices, theory, SDL, etc etc. This part is only on the actual coding bits.
So, for a course on Secure Coding in C, what I have so far is (for each type of attack, the course will cover what it is, and how to prevent it) :
- Buffer Overflows
- Stack overflow
- Heap overflow
- Integer Overflows
- Format Strings attacks
- Race conditions – TOC-TOU
- “Dangerous” APIs
Still waiting to hear back if databases are relevant; web issues are not.
What else would you suggest, specifically for C?