CIS1550 Introduction for Secure Programming

• Misuse/Abuse Cases
• Requirements Traceability Matrix
• Software Acquisition
• Lesson Review

• Perform Threat Modeling
• Define the Security Architecture
• Lesson Review

• Performing Secure Interface Design
• Performing Architectural Risk Assessment
• Model (Nonfunctional) Security Properties and Constraints
• Model and Classify Data
• Evaluate and Select Reusable Secure Design
• Perform Security Architecture and Design Review
• Define Secure Operational Architecture
• Use Secure Architecture and Design Principles, Patterns, and Tools
• Lesson Review

1 LiveLab in this lesson — see the labs panel →

• Declarative vs. Imperative Security
• Memory Management
• Error Handling
• Interface Coding
• Primary Mitigations
• Learning from Past Mistakes
• Secure Design Principles
• Interconnectivity
• Cryptographic Failures
• Input Validation Failures
• General Programming Failures
• Technology Solutions
• Lesson Review

5 LiveLab in this lesson — see the labs panel →

• Code Analysis (Static and Dynamic)
• Code/Peer Review
• Code Review Objectives
• Additional Sources of Vulnerability Information
• CWE/SANS Top 25 Vulnerability Categories
• OWASP Vulnerability Categories
• Common Vulnerabilities and Countermeasures
• Lesson Review

3 LiveLab in this lesson — see the labs panel →

• Security Risks
• Implement Security Controls
• Applying Security via the Build Environment
• Anti-tampering Techniques
• Defensive Coding Techniques
• Primary Mitigations
• Secure Integration of Components
• Lesson Review

2 LiveLab in this lesson — see the labs panel →

• Security Test Cases
• Attack Surface Evaluation
• Penetration Testing
• Common Methods
• Lesson Review

9 LiveLab in this lesson — see the labs panel →

• Develop a Security Testing Strategy and a Plan
• Functional Security Testing
• Nonfunctional Security Testing
• Testing Techniques
• Environment
• Standards
• Crowd Sourcing
• Lesson Review

• Perform Verification and Validation Testing
• Identify Undocumented Functionality
• Analyze Security Implications of Test Results
• Classify and Track Security Errors
• Secure Test Data
• Lesson Review

• Secure Configuration and Version Control
• Define Strategy and Roadmap
• Manage Security Within a Software Development Methodology
• Identify Security Standards and Frameworks
• Define and Develop Security Documentation
• Develop Security Metrics
• Decommission Software
• Report Security Status
• Lesson Review

1 LiveLab in this lesson — see the labs panel →

• Incorporate Integrated Risk Management
• Promote Security Culture in Software Development
• Implement Continuous Improvement
• Lesson Review

• Perform Operational Risk Analysis
• Release Software Securely
• Securely Store and Manage Security Data
• Ensure Secure Installation
• Perform Post-Deployment Security Testing
• Lesson Review

• Obtain Security Approval to Operate
• Perform Information Security Continuous Monitoring
• Support Incident Response
• Perform Patch Management
• Perform Vulnerability Management
• Runtime Protection
• Support Continuity of Operations
• Integrate Service Level Objectives and Service Level Agreements
• Lesson Review

• Implement Software Supply Chain Risk Management
• Analyze Security of Third-Party Software
• Verify Pedigree and Provenance
• Lesson Review

• Ensure Supplier Security Requirements in the Acquisition Process
• Support Contractual Requirements
• Lesson Review