Secure Software Engineering training

Lesson 1 • Security in the Software Development Lifecycle

Maps security activities to each SDLC phase from requirements through deployment. Shows how early integration reduces cost and risk.

Lesson 2 • Security Goals and Core Principles

Defines confidentiality, integrity, and availability as engineering constraints. Connects these goals to design decisions made throughout the development lifecycle.

Lesson 3 • Attacker Mindset and Threat Concepts

Introduces adversarial thinking as a foundational engineering skill. Teaches how attackers identify and exploit weaknesses to inform defensive design.

Lesson 4 • Common Vulnerability Categories

Surveys the most prevalent software weakness classes using industry-standard taxonomies. Provides a shared vocabulary for identifying and discussing flaws.

Lesson 1 • Identifying and Rating Threats

Applies STRIDE categories to DFD elements to enumerate threats systematically. Introduces DREAD and CVSS-style scoring to prioritise identified threats.

Lesson 2 • Threat Model Maintenance and Updates

Addresses how threat models evolve as systems change over time. Establishes triggers and processes for keeping models accurate and actionable.

Lesson 3 • Deriving Security Requirements

Converts threat model outputs into verifiable security requirements. Links each requirement to a specific threat to maintain traceability.

Lesson 4 • Threat Modeling Methodologies

Compares leading structured approaches to threat identification and analysis. Equips students to select the right methodology for a given project context.

Lesson 1 • Core Secure Design Principles

Covers least privilege, defence in depth, fail-safe defaults, and separation of duties. Students apply each principle to concrete design scenarios.

Lesson 2 • Cryptography Selection and Application

Guides selection of appropriate cryptographic primitives for common use cases. Covers symmetric, asymmetric, and hashing choices without requiring deep maths.

Lesson 3 • Authentication and Session Design

Designs robust authentication flows and secure session management mechanisms. Addresses credential storage, multi-factor patterns, and session lifecycle.

Lesson 4 • Secure API and Service Design

Applies secure design principles specifically to REST and service-oriented interfaces. Covers input validation, rate limiting, and secure error handling at the API layer.

Lesson 1 • Secure Error Handling and Logging

Teaches error handling that prevents information leakage while supporting diagnostics. Covers secure logging practices that avoid capturing sensitive data.

Lesson 2 • Secure Concurrency and State Management

Identifies race conditions and time-of-check/time-of-use flaws in concurrent code. Applies synchronisation and atomic operations to eliminate state-based vulnerabilities.

Lesson 3 • Cross-Site Scripting Prevention

Covers reflected, stored, and DOM-based XSS with specific mitigation for each type. Introduces Content Security Policy as a defence-in-depth control.

Lesson 4 • Memory Safety and Resource Management

Addresses buffer overflows, use-after-free, and resource exhaustion in systems code. Applies safe memory patterns and resource lifecycle controls.

Lesson 5 • Injection Attack Prevention

Addresses SQL, command, LDAP, and XML injection through parameterisation and safe APIs. Students refactor vulnerable code to eliminate injection vectors.

Lesson 1 • Fuzz Testing and Property-Based Testing

Applies fuzzing to discover unexpected input handling failures and crashes. Introduces property-based testing as a complement to example-based security tests.

Lesson 2 • Security Testing Strategy and Planning

Defines the scope, objectives, and methods for a security testing programme. Aligns testing effort with threat model outputs and risk priorities.

Lesson 3 • Dynamic Application Security Testing

Uses DAST tools to probe running applications for exploitable vulnerabilities. Covers authenticated scanning, spider configuration, and result interpretation.

Lesson 4 • Penetration Testing Concepts

Introduces structured penetration testing methodology from reconnaissance to reporting. Distinguishes developer-focused pen testing from full red team engagements.

Lesson 1 • Secure Build and Artifact Integrity

Applies signing, hashing, and provenance tracking to build artifacts. Ensures that what is deployed matches what was reviewed and approved.

Lesson 2 • Dependency Management Best Practices

Establishes policies for selecting, pinning, and updating third-party dependencies. Reduces attack surface through minimal dependency footprint.

Lesson 3 • Software Composition Analysis

Uses SCA tools to inventory open-source components and detect known vulnerabilities. Covers licence compliance as a parallel concern alongside security.

Lesson 4 • Understanding Software Supply Chain Risk

Maps the modern software supply chain and identifies attack vectors at each stage. Establishes why transitive dependencies amplify risk beyond direct dependencies.

Lesson 1 • Container and Image Security

Secures container images from base image selection through runtime deployment. Covers image scanning, minimal base images, and runtime security controls.

Lesson 2 • DevSecOps Principles and Culture

Defines the shift-left philosophy and shared security responsibility model. Addresses cultural barriers to security adoption in fast-moving development teams.

Lesson 3 • Secrets Management in Pipelines

Prevents hardcoded credentials by integrating secrets vaults into build and deploy workflows. Covers secret rotation, access scoping, and audit logging.

Lesson 4 • Automating Security in CI Pipelines

Embeds SAST, SCA, and secret scanning as automated pipeline stages. Configures quality gates that block builds on critical security findings.

Lesson 1 • Resilience and Recovery Design

Designs software systems to degrade gracefully and recover quickly after attacks. Covers backup strategies, failover patterns, and chaos engineering basics.

Lesson 2 • Post-Incident Analysis and Learning

Applies blameless post-mortems to extract security lessons from incidents. Converts findings into concrete code and process improvements.

Lesson 3 • Incident Response Fundamentals

Introduces the incident response lifecycle and the developer's role within it. Covers preparation, detection, containment, eradication, and recovery phases.

Lesson 4 • Vulnerability Disclosure and Patch Management

Establishes processes for receiving, triaging, and remediating reported vulnerabilities. Covers coordinated disclosure, patch timelines, and customer communication.