UOP-CYB505: Secure Software Development

01 Secure Software Concepts 13 topics +

• Confidentiality
• Integrity
• Availability
• Authentication
• Authorization
• Accountability (Auditing and Logging)
• Nonrepudiation
• Secure Development Lifecycle
• Secure Development Lifecycle Components
• System Tenets
• Secure Design Tenets
• Security Models
• Adversaries

02 Secure Software Requirements 9 topics +

• Functional Requirements
• Operational and Deployment Requirements
• Connecting the Dots
• Regulations and Compliance
• Data Classification
• Privacy
• Misuse/Abuse Cases
• Requirements Traceability Matrix
• Software Acquisition

03 Secure Software Design 10 topics +

• Perform Threat Modeling
• Define the Security Architecture
• Performing Secure Interface Design
• Performing Architectural Risk Assessment
• Model (Nonfunctional) Security Properties and Constraints
• Model and Classify Data
• Evaluate and Select Reusable Secure Design
• Perform Security Architecture and Design Review
• Define Secure Operational Architecture
• Use Secure Architecture and Design Principles, Patterns, and Tools

04 Secure Software Implementation 26 topics +

• Declarative vs. Imperative Security
• Memory Management
• Error Handling
• Interface Coding
• Primary Mitigations
• Learning from Past Mistakes
• Secure Design Principles
• Interconnectivity
• Cryptographic Failures
• Input Validation Failures
• General Programming Failures
• Technology Solutions
• Code Analysis (Static and Dynamic)
• Code/Peer Review
• Code Review Objectives
• Additional Sources of Vulnerability Information
• CWE/SANS Top 25 Vulnerability Categories
• OWASP Vulnerability Categories
• Common Vulnerabilities and Countermeasures
• Security Risks
• Implement Security Controls
• Applying Security via the Build Environment
• Anti-tampering Techniques
• Defensive Coding Techniques
• Primary Mitigations
• Secure Integration of Components

05 Secure Software Testing 16 topics +

• Security Test Cases
• Attack Surface Evaluation
• Penetration Testing
• Common Methods
• Develop a Security Testing Strategy and a Plan
• Functional Security Testing
• Nonfunctional Security Testing
• Testing Techniques
• Environment
• Standards
• Crowd Sourcing
• Perform Verification and Validation Testing
• Identify Undocumented Functionality
• Analyze Security Implications of Test Results
• Classify and Track Security Errors
• Secure Test Data