Programming and Secure software development presentation consists of various slides which shed light on concepts like using python for writing scripts to secure a network.
- 1. Introduction
- 2. Unit Guide ■ Unit Description ■ Learning Outcomes ■ Assessments ■ Expectations
- 3. What is Computer Security? ■ Most developers and operators are concerned with correctness: achieving desired behaviour • A working software • A working banking web site, word processor, blog, • … ■ Security is concerned with preventing undesired behaviour • Considers an enemy/opponent/hacker/adversary who is actively and maliciously trying to circumvent any protective measures you put in place
- 4. Significant security breaches ■ Marriott International, November 2018 • Stole 500 million customers data, including contact info, passport number, travel information, and credit card numbers of more than 100 million customers. ■ Equifax, July 2017 • Personal information (including Social Security Numbers, birth dates, addresses, and in some cases drivers' license numbers) of 143 million consumers; 209,000 consumers also had their credit card data exposed. ■ Yahoo, September 2016 • 3 billion user accounts are compromised, including names, dates of birth, email addresses, passwords, security questions and answers.
- 5. Contributing Factors ■ Lack of awareness of threats and risks of information systems • Security measures are often not considered until an Enterprise has been penetrated by malicious users • The situation is getting better, but … ■ (Historical) Reluctance to invest in security mechanisms • The situation is improving • Example: Windows 95 -> Windows 2000 -> Windows XP -> Windows Vista -> Windows 7 -> Windows 8 -> Windows 10 -> Windows 11 • But there exists legacy software • Supply chain security ■ Wide-open network policies • Many Internet sites allow wide-open Internet access
- 6. Contributing Factors continued ■ Lack of security in TCP/IP protocol suite • Most TCP/IP protocols not built with security in mind • Work is actively progressing within the Internet Engineering Task Force (IETF) ■ Complexity of security management and administration • Security is not just encryption and authentication ■ Software vulnerabilities • Example: buffer overflow vulnerabilities • We need techniques and tools to better software security ■ Hacker skills keep improving • Cyber warfare
- 7. Compusec + Comsec = Infosec
- 8. Security Mechanisms ■ Prevention is more fundamental • Detection seeks to prevent by threat of punitive action • Detection requires that the audit trail be protected from alteration ■ Sometime detection is the only option, e.g., • Accountability in proper use of authorized privileges • Modification of messages in a network ■ Security functions are typically made available to users as a set of security services ■ Cryptography underlies (almost) all security mechanisms
- 9. Application Security ■ Application security usually refers to security after the software is built • Adding more code does not make a faulty software correct • Sandboxing • Network-centric approach • Focus on input checking
- 10. Why Software Security? ■ Software Security aims to address weaknesses directly
- 11. HeartBleed ■ SSL/TLS is a core protocol for encrypted communications used by the web ■ Heartbleed is a bug in the commonly used OpenSSL implementation of SSL/TLS, v1.0.1 - 1.0.1f – Discovered in March 2014, it has been in released code since March 2012 ■ A carefully crafted packet causes OpenSSL to read and return portions of a vulnerable server’s memory – Leaking passwords, keys, and other private information
- 12. Why existing security software didn’t work?! ■ Black box security is incomplete against Heartbleed exploits • Issue is not at the level of system calls or deposited files: nothing the OS or antivirus can do • Basic attack packets could be blocked by IDS, but • “Packet chunking” may bypass basic filters • Exfiltrated data on the encrypted channel; invisible to forensics ■ Software security methods attack the source of the problem: the buggy code
- 13. Security Assurance ■ How well your security mechanisms guarantee your security policy ■ Everyone wants high assurance ■ High assurance implies high cost • May not be possible ■ Trade-off is needed
- 14. Security by Obscurity ■ Security by obscurity • If we hide the inner workings of a system it will be secure • E.g., steganography ■ Less and less applicable in the emerging world of vendor-independent open standards ■ Less and less applicable in a world of widespread computer knowledge and expertise
- 16. Install Python https://www.python.org/ Download and Install the latest Python: Why Python? •Python works on different platforms (Windows, Mac, Linux, Raspberry Pi, etc). •Python has a simple syntax similar to the English language. (Friendly and Easy to Use) •Python has syntax that allows developers to write programs with fewer lines than some other programming languages. •Python runs on an interpreter system, meaning that code can be executed as soon as it is written. This means that prototyping can be very quick. •Python can be treated in a procedural way, an object-oriented way or a functional way.
- 17. Install PIP For Instructions see here: https://www.geeksforgeeks.org/download-and- install-pip-latest-version/ https://pypi.org/project/pip/ Why pip? pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes.
- 18. Install Jupyter NoteBook For Instructions see here: https://jupyter.org/install Why Jupyter Notebook? A Jupyter Notebook provides you with an easy-to-use, interactive environment a different approach for an IDE with short, explanation and presentation of code, which helps us focus on the meaning. In a Windows/Linux/Mac terminal
- 20. Run Jupyter NoteBook Windows/Linux/Mac Command Line: jupyter notebook Tip: Use Dark Mode – reduces the light by ~80%, which causes strain on your eyes.
- 21. Create a Jupyter NoteBook Note: Console – Python Console (accept python commands) Notebook – creates a new Notebook Terminal – OS Terminal (we’ll use this) Text file – a simple ACSII file Markdown File – a Jupyter markdown file, no code, only comments. Python File – python source code file
- 22. Selecting a Kernel Notebooks are compatible with several programming languages. We’ll always use Python in this class. It can support: Julia, Python, R.
- 23. Your First Notebook: Hello World Type: print(“Hello World”’) Be careful: Automatic talking marks, punctuation, etc. 1. Type 2. Click Run Success!!
- 25. Markdown 1. Type the following (Just text) 2. Select Markdown. 3. Run -> Render All Markdown Cells
- 26. Add New Blocks Copy/Duplicate Block Move the Block UP Move the Block DOWN Delete Block Click Here: Add New Block Below Add New Block Abov
- 27. Try Some Basic Code Maths Type: Output:
- 29. String Type: Click Run, to get the output Tip: If you get an error. Check you have typed it in correctly
- 30. Input Type: Click Run, now enter your name and press ENTER. Then enter your student no and press ENTER. Tip: If you get an error. Check you have typed it in correctly
- 31. Basic: Input and Output Type:
- 32. Activity: Knock Knock Joke 10 Minutes Write code that: Outputs: “Knock Knock” Input (expect): Who’s there “Harry” Input (expect): Harry Who? “Harry up and gives us good grades” Outputs: “Knock Knock” Input (expect): Who’s there “Annie” Input (expect): Annie Who? “Annie thing you can help us write code?” Outputs: “What is your lecturer’s name?” Input (expect): <name of teacher> “The best teacher in the world is <name of teacher>
- 33. Functions - remember to always use a new block Output of the text The brackets indicate a function The semicolon indicates scope. Make sure it is indented automatically. Just press enter after the semicolon. # is comments
- 35. Import - math Try: Tip: Careful what you type. What the talking marks and the brackets. Careful on who you spell variables. Wrong variables name will give you an error/print something unexpected. Import allows files to be imported into your code. Such that we can use the code variable
- 36. Typecast: Int and Float Try: What happens when you enter “3.5”? Now change: w = int(w) To: w = float(w) Enter “3.5” again. Tip: Input from the command line in Python is always a String. Convert to a whole number use int() Convert to a decimal number use float()
- 37. Python Basic Data Types ■ Integers – whole numbers ■ Float – negative and positive that can have many decimal places. ■ Strings – Characters, Human language literals. ■ Boolean True/False
- 38. Activity: Write Code to Calculate Simple Interest 10 Minutes Write code that display and calculates simple Interest: displays How much do you want to borrow? In 30 years, the loan will cost you? I + P I knew I should have stayed at Mum’s and Dad’s! Enter P t = 30 R = 0.05 I = P*R*T
- 40. Controls: If … then … else Tip: Remember the colon – they represent the start of an indented block/scope Let the Python Interpreter do the indentation (otherwise, you might add an extra space) Remember Boolean in Python starts with a capital. Try – changing the “True” to a “False”
- 41. Controls: If … then … else if then Run again and again: Try “Yes”, “No” and “Maybe” “YES”, “NO”, “7777”
- 42. Controls: If … then … else if then Run again and again: Try “Yes”, “No” and “Maybe” “YES”, “NO”, “7777”
- 43. While Loops Tip: Got an Infinite Loop? Go to the command line – where the Jupyter kernel is running and Ctrl-C. Use the up arrows to get the last command. Re-execute jupyer notebook.
- 44. For Loops - traditional Tip: Got an Infinite Loop? Go to the command line – where the Jupyter kernel is running and Ctrl-C. Use the up arrows to get the last command. Re-execute Jupyer notebook.
- 45. For Loops – “in” Tip: Got an Infinite Loop? Go to the command line – where the Jupyter kernel is running and Ctrl-C. Use the up arrows to get the last command. Re-execute jupyer notebook.
- 46. For Loops – and Else Tip: Got an Infinite Loop? Go to the command line – where the Jupyter kernel is running and Ctrl-C. Use the up arrows to get the last command. Re-execute Jupyer notebook.
- 47. Practice, Practice, Practice ■ There is loads of help for Python online! ■ Useful Websites: • https://www.w3schools.com/python • https://www.geeksforgeeks.org/ • Even ChatGPT is good at Python. What to Hand in: Your Jupyter Notepad file