Lecture

Software security - Security testing

Graph Chat

Chat with Graph Search

Ask any question about EPFL courses, lectures, exercises, research, news, etc. or try the example questions below.

DISCLAIMER: The Graph Chatbot is not programmed to provide explicit or categorical answers to your questions. Rather, it transforms your questions into API requests that are distributed across the various IT services officially administered by EPFL. Its purpose is solely to collect and recommend relevant references to content that you can explore to help you answer your questions.

In course

COM-301: Computer security and privacy

This is an introductory course to computer security and privacy. Its goal is to provide students with means to reason about security and privacy problems, and provide them with tools to confront them. ...

Description

This lecture covers software security testing, including manual and automated approaches such as code review, heuristic test cases, static analysis, symbolic analysis, and dynamic analysis. It also discusses the limitations of achieving complete testing and the importance of coverage metrics.

Instructors (2)

Edouard Bugnion

Edouard Bugnion joined EPFL in 2012, where his focus is on datacenter systems. His areas of interest include operating systems, datacenter infrastructure (systems and networking), and computer architecture. Before joining EPFL, Edouard spent 18 years in the US, where he studied at Stanford and co-founded two startups: VMware and Nuova Systems (acquired by Cisco). At VMware from 1998 until 2005, he played many roles including CTO. At Nuova/Cisco from 2005 until 2011, he helped build the core engineering team and became the VP/CTO of Ciscos Server, Access, and Virtualization Technology Group, a group that brought to market Ciscos Unified Computing System (UCS) platform for virtualized datacenters. Prof. Bugnion is a Fellow of the ACM. Together with his colleagues, he received the ACM Software System Award for VMware 1.0 in 2009. His paper Disco: Running Commodity Operating Systems on Scalable Multiprocessors" received a Best Paper Award at SOSP '97 and was entered into the ACM SIGOPS Hall of Fame Award in 2008. At EPFL, he received the OSDI 2014 Best Paper Award for his work on the IX dataplane operating system

Carmela González Troncoso

SPRING Lab Our research focuses on building secure and privacy-preserving systems. We aim to develop tools and methodologies to help engineers embedding strong security and privacy guarantees in their designs, as well as techniques that help them to systematically quantifying the information that an adversary can infer from data she may have access to.More information about our activities here: https://spring.epfl.ch/ Teaching & PhD PhD Students Saiid El Hajj Chehade, Eric Jollès, Christian Knabenhans, Boy

Official source

Related concepts (25)

Program analysis

In computer science, program analysis is the process of automatically analyzing the behavior of computer programs regarding a property such as correctness, robustness, safety and liveness. Program analysis focuses on two major areas: program optimization and program correctness. The first focuses on improving the program’s performance while reducing the resource usage while the latter focuses on ensuring that the program does what it is supposed to do.

Computer security

Computer security, cyber security, digital security or information technology security (IT security) is the protection of computer systems and networks from attacks by malicious actors that may result in unauthorized information disclosure, theft of, or damage to hardware, software, or data, as well as from the disruption or misdirection of the services they provide. The field is significant due to the expanded reliance on computer systems, the Internet, and wireless network standards such as Bluetooth and Wi-Fi.

Heuristic (psychology)

Heuristics is the process by which humans use mental short cuts to arrive at decisions. Heuristics are simple strategies that humans, animals, organizations, and even machines use to quickly form judgments, make decisions, and find solutions to complex problems. Often this involves focusing on the most relevant aspects of a problem or situation to formulate a solution. While heuristic processes are used to find the answers and solutions that are most likely to work or be correct, they are not always right or the most accurate.

Heuristic

A heuristic (hjʊˈrɪstɪk; ), or heuristic technique, is any approach to problem solving or self-discovery that employs a practical method that is not guaranteed to be optimal, perfect, or rational, but is nevertheless sufficient for reaching an immediate, short-term goal or approximation. Where finding an optimal solution is impossible or impractical, heuristic methods can be used to speed up the process of finding a satisfactory solution. Heuristics can be mental shortcuts that ease the cognitive load of making a decision.

Penetration test

A penetration test, colloquially known as a pentest or ethical hacking, is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system; this is not to be confused with a vulnerability assessment. The test is performed to identify weaknesses (or vulnerabilities), including the potential for unauthorized parties to gain access to the system's features and data, as well as strengths, enabling a full risk assessment to be completed.

Related lectures (53)

Software Security: Security Testing - Sanitizers

Explores the use of sanitizers in software security testing to detect bugs early and improve testing effectiveness.

Automated Testing: Fuzzing and Sanitization

Explores fuzzing, bug oracles, code reviews, and automated testing techniques, emphasizing the importance of sanitization in detecting faults.

Software Security Vulnerabilities: Case Studies

Explores various software security vulnerabilities and the challenges of testing large codebases.

Programming Bugs: Understanding, Fixing, and Preventing

Explores programming challenges, debugging techniques, software testing, and security practices in software development.

Adversarial Thinking: Reasoning as an Adversary