Kaspersky

Evaluating product security

Introduction to applications and system security; building reliable and resilient ICT infrastructure:

• Approaches for evaluating product security;
• Assessment techniques of a vendor’s software development process;
• Analyzing a vendor’s data processing practices; and
• Static and dynamic examination techniques of a software product for its security.

Duration: 1 hour.

Threat modelling

The purpose of threat modeling is to provide systematic analysis of what controls or defenses need to be included – given the nature of the system, the probable attacker's profile, the most likely attack vectors, and the assets most desired by an attacker.

The sections includes:

• Approaches for threat modelling;
• Actor identification; and
• Risk identification and prioritization.

Duration: 1.5 hours.

Secure code review

Introduction to the basic techniques of identifying vulnerabilities in software code. The purpose of the code review is to ensure that a product has no potential vulnerabilities or backdoors. We will also share best practices of Kaspersky’s Transparency Centers and how processes are organized for external reviews of our source code and software development.

This section includes:

• Approaches for automated source code analysis;
• Static analysis of source code;
• Dynamic analysis of source code; and
• Approaches for manual analysis of source code.

Duration: 2.5 hours.

Code fuzzing

Code Fuzzing gives an introduction to the process of defining, developing and testing Windows-based applications through fuzzing to identify bugs and vulnerabilities. Though the training focuses on native Windows-based applications, most of the concepts – as well as the methodology and tools – can be applied to other platforms.

After completing this course, trainees will be able to:

• Understand the different fuzzing techniques and when to apply them;
• Choose the appropriate tools and prepare a target for fuzzing; and
• Generate interesting fuzzing input depending on the target.

Duration: 2.5 hours.

Vulnerability Management and Disclosure

Introduction to and definition of approaches for building up the process of managing vulnerabilities within an organization’s ICT infrastructure:

• Sharing best practices for vulnerability management;
• Sharing best practices for coordinated vulnerability disclosure;
• Sharing Kaspersky’s experience in handling vulnerability reports from the research community; and
• Revealing nuances of bug bounty programs.

Duration: 1 hour.