Secure Software Development Fundamentals - Packt

In this module, we will introduce the core principles of application security, covering essential terminology and objectives. You will gain an understanding of why application security is critical and explore OWASP WebGoat, a deliberately vulnerable application used for security training.

In this module, we will delve into Secure SDLC, starting with an overview of application security and key industry standards. You will learn about common security risks, fundamental security goals, and leading frameworks like NIST and CSA that guide secure software development.

In this module, we will explore the Defense in Depth strategy, focusing on multiple layers of security to protect applications. You will gain insights into cybersecurity roles, API security, CSP implementation, SSRF attacks, and effective vulnerability management practices.

In this module, we will take a deep dive into the OWASP Top 10, the most critical web security risks recognized globally. Through theoretical explanations and practical demos, you will learn how vulnerabilities like Broken Access Control, Injection, and Cross-Site Scripting (XSS) are exploited and how to mitigate them effectively.

In this module, we will explore the critical aspects of supply chain security, from understanding risks to implementing proactive defenses. You will learn about Software Composition Analysis (SCA), the SLSA framework, SBOM, and essential tools like Dependency-Track and CycloneDX to manage software dependencies securely.

In this module, we will dive into cloud and container security, focusing on securing workloads across AWS, Azure, and GCP. You will learn about identity and access management, detection controls, data protection, and incident response in AWS, along with best practices for securing containerized applications.

In this module, we will explore the critical aspects of session management, including web sessions, JWT, and JSON Web Encryption (JWE). You will also learn about OAuth and OpenID Connect, which are widely used authentication and authorization protocols for securing modern applications.

In this module, we will explore risk rating methodologies and introduce threat modeling as a proactive approach to identifying and mitigating security threats. You will learn how to assess risks, apply security controls, and use industry-leading tools like the Microsoft Threat Model Tool and OWASP Threat Dragon.

In this module, we will dive deeper into advanced threat modeling approaches, including DREAD, MITRE ATT&CK, and attack trees. You will learn how to apply these frameworks, perform hands-on demos, and implement continuous threat modeling for cloud environments using tools like Threagile.

In this module, we will explore the concepts of encryption and hashing, their applications, and their role in cybersecurity. You will gain hands-on experience with hashing techniques, password security, and Public Key Infrastructure (PKI) to understand how cryptographic principles protect sensitive data.