Advanced Practices in Application Security

Course details

Software rules the world whether it runs a datacenter, a cloud workload, on an IoT device in a factory, or an application on a mobile device—software is inescapable. Traditionally, security approaches have “bolted on” security in the final stages of development. But these last-minute techniques are no longer sufficient in providing security against sophisticated cyber threats. Each year cyberattacks become more prevalent and more dangerous, and organizations face unprecedented pressure to embed security into their development processes rather than treating it like an afterthought. This course is designed to empower cybersecurity professionals, software developers, and DevSecOps teams to implement application security techniques that integrate into and throughout the entire software development lifecycle (SDLC).

Learning objectives
Conduct automated and manual security testing.
Debug and resolve critical vulnerabilities.
Test software using penetration testing tools.
Generate actionable security reports.

Concepts

Introduction

Intro video to course

Building Security from the Ground Up

Chapter introduction
Secure by design principles
Secure coding practices
Secure configuration and defaults

OWASP Top 10 Prevention

Prevention of OWASP Top 10
Stopping insecure design and misconfiguration failures
Defending against supply chain attacks and logging failures

Application Security Testing and Protection

Code testing for vulnerabilities
Testing an application for run-time vulnerabilities
Run-time protection

Threat Modelling

Chapter introduction
Threats vs. risks
Intro to threat modelling
Utilizing STRIDE for threat modelling

Utilizing Threat Modeling Tools

Threat modelling with OWASP Threat Dragon
Using attack trees in threat modelling
Completing a rapid threat modelling prototyping (RTMP)

Managing Findings from Threat Modeling

Risk rating using OWASP risk rating
CVSS scoring for vulnerability management
Transforming threats into secure designs

Understanding the Software Supply Chain

Chapter introduction
Software supply chain threat landscape
Software bill of materials (SBOM) fundamentals
Dependency management and open-source risk assessment

Collecting Artifacts and Understanding Risk

SLSA framework and build provenance
Artifact integrity and code signing
Vendor risk assessment and third-party security

Managing and Monitoring the Supply Chain

Continuous supply chain monitoring
Compliance and regulatory requirements
Supply chain incident response and recovery

Understanding Cloud and Container Fundamentals

Chapter introduction
Cloud-native security fundamentals
Container and serverless security
Cloud security automation and infrastructure as code (IaC) security

Understanding Container Security Practices

Kubernetes security architecture and RBAC
Container and registry security
Runtime protection and behavioral monitoring

Understanding Cloud Security Defenses

Network security and micro-segmentation
Secrets management and data protection
Compliance and governance in cloud-native environments

Conclusion

Course wrap-up video