Duration
2 days
Overview
When it comes to secure software development – the earlier you apply secure code in the software development life cycle, the better. Not using secure code could create vulnerabilities in your enterprise databases, software and web applications, leaving your organization open to cyber threats and attacks.
The vast majority of computer science graduates have never taken secure development training and do not know about types of vulnerabilities or how to defend against them. Universities need to do better. Developers graduate and take a job where most of the time they, again, do not receive secure development training. Many software engineers continue to progress in their careers without getting the secure coding fundamentals that are vital to keeping products safe.
The course shapes developers to be more security-driven by teaching them the skills they need to produce secure code. Our flagship learning platform delivers relevant skills-based pathways and contextual tools for developers to quickly write secure, quality code and fix common security bugs in real-time.
Benefits
Software Development Life DiscoveryWhen working on the scope of the Software Development Life, a development team should focus on deliverables such as security milestones, required certifications, risk assessments, key security resources, and required third-party resources.
Security BaselinesA Gap Analysis, contrasting the product’s features against the baseline, is useful to identify the areas not complying with the security baseline. When finding a gap, this needs to be addressed as early as possible in the lifecycle.
Third-Party Software TrackingSince third-party software can be open source or commercial use, the team needs to list all third-party tools used in the project. This inventory should be done in the early stages of the development cycle.
Security Design and Peer ReviewWhen reviewing the functional feature design, the developer should include a security design review, thinking like an attacker to discover the feature vulnerabilities. When reviewing the code, developers need to be aware of the most common coding security pitfalls.
Security TestingWhile code review focus on functionality, security testing checks how vulnerable is the new product to attacks.
Module 1: Overview of Secure Software Development
- Misconceptions of Secure Software Development
- Software Development Security: The Complete Picture
- Software Development Anatomy of a Disaster?
- Causes of Software Development Data Breaches
- Meaning of Being Software Development Compliant
- Software Development Data Breach Report
Module 2: Foundations of Secure Software Development
- Security Concepts
- Motivations: Costs and Standards
- Open Web Application Security Project
- Web Application Security Consortium
- CERT Secure Coding Standards
- Assets are the Targets
- Security Activities Cost Resources
- Threat Modeling
- Principles of Information Security
- Security Is a Lifecycle Issue
- Compartmentalize
- Consider All Application States
Module 3: Vulnerabilities in Secure Software Development
- Unvalidated Input
- Broken Authentication
- Injection Flaws
- Error Handling, Logging, and Information Leakage
- Insecure Storage
- Direct Object Access
- Web Services Vulnerabilities
- Common Vulnerabilities and Exposures
- Monster Mitigations
- Strength Training: Project Teams/Developers
- Strength Training: IT Organizations
- Intercepting Web Agent
Module 4: Secure Development Lifecycle (SDL) & Risk Analysis
- SDL Process Overview
- Software Security Axioms
- Security Lifecycle - Phases
- Applying Processes and Practices
- Application Assessments
- Security Requirements
- Secure Development Practices
- Threat Modeling Process
- Identify Security Objectives
- Describe the System
- List Assets
- Define System/Trust Boundaries
- List and Rank Threats
- List Defenses and Countermeasures
- Testing Tools and Processes
- Security Testing Principles
Note : All sessions contain group activities and case studies to strengthen the understanding of Secure Software Development and readiness to be applied at respective individual’s organization.
Programme scope, delivery arrangements and suitability are confirmed during enquiry.