Programming Foundations: Secure Coding

Course details

This course is an introduction to secure development practices related to various aspects of software development. Security architect Frank Moley introduces you to risk analysis, including proactive risk identifications. Frank then looks at the most common types of vulnerabilities that plague applications today, including client/server issues, with a heavy focus on web-based and embedded and IoT focused development. The course then gets into a primer of cryptography, the role it plays in security, and its proper use by looking at the vulnerabilities around its misuse. Frank finishes the course by looking at strategies for each phase of the software development lifecycle to build a secure application development lifecycle while considering the modern development practices.

Concepts

Introduction

Introduction

Security and Risk Overview

The goals of secure coding
Understand the attacker
Threat modeling
Understand your risks
Break what you build
Document what you understand
Introduction to vulnerabilities

Web-Based Client Server Issues

Input validation
Communication channel
Session management

Thick Application and Client Server Issues

Error handling
Logging and output
Internal data management
Configuration
Database
File and I O
Memory management
Dependencies

Embedded Device and IoT Issues

Physical security
Side channel
Memory
Software versioning
Third-party components

Security and Cryptography Misuse Issues

Authentication and password
Authorization and access control
Cryptography

Security in the SDLC

Requirements
Design
Development
Testing
Deployment
Operations
Containerization concerns
Best practices

Conclusion

Next steps