Cyber capacity building program

Evaluating product security

Introduction to applications and system security; building reliable and resilient ICT infrastructure:

• Approaches for evaluating product security;
• Assessment techniques of a vendor’s software development process;
• Analyzing a vendor’s data processing practices;
• Static and dynamic examination techniques of a software product for its security.

Threat modelling

Introduction to the process of identifying and mitigating potential threats, such as structural vulnerabilities or the absence of appropriate safeguards. The purpose of threat modelling is to provide a systematic analysis of what controls or defenses need to be included, given the nature of the system, the probable attacker’s profile, the most likely attack vectors, and the assets most desired by an attacker.

The sections includes:

• Approaches to threat modeling;
• Actor identification;
• Risk identification;
• Prioritization.

Secure code review

Introduction to basic techniques for identifying vulnerabilities in software code. The purpose of the code review is to ensure that a product has no potential vulnerabilities or backdoors. We will also share best practices of Kaspersky’s Transparency Centers and how processes are organized for external reviews of our source code and software development.

The sections includes:

• Approaches for automated source code analysis;
• Static analysis of source code;
• Dynamic analysis of source code;
• Approaches to manual analysis of source code.

Code fuzzing

This gives an introduction to the process of defining, developing and testing Windows-based applications through fuzzing to identify bugs and vulnerabilities. Though the training focuses on native Windows-based applications, most of the concepts – as well as the methodology and tools – can be applied to other platforms.

After completing this course, trainees will be able to:

• Understand different fuzzing techniques and when to apply them;
• Choose the appropriate tools and prepare a target for fuzzing;
• Generate interesting fuzzing input depending on the target.

Vulnerability management and disclosure

Introduction to and definition of approaches for building the process of managing vulnerabilities within an organization’s ICT infrastructure.

This section includes:

• Sharing best practices for vulnerability management and disclosure;
• Sharing best practice for coordinated vulnerability disclosure;
• Sharing Kaspersky’s experience in handling vulnerability reports from the research community;
• Revealing nuances of bug bounty programs.