Secure by Design

With the increase in cybercrime and threat actors targeting web applications and software vulnerabilities as a route to exploit business, it's time to start building security into new systems developments processes right from the start. Most successful cyber-attacks still depend on exploiting a few well-known common vulnerabilities. This course, updated with the latest OWASP Top 10, will show you how security can be designed into, managed and maintained within a development lifecycle.

The course includes the following technical practice simulation CYRIN labs, which are available to learners for six months post class.

1. Web Application Security Analysis using OWASP-ZAP

Students will use the OWASP program’s ZAP tool suite from within Kali Linux to scan multiple web services and document vulnerabilities. Students will see ZAP in action on a vulnerable web site where entire database tables are available to potential attackers.

2. Web Application Security Analysis using Nikto

Students will use the Nikto tool to test web services over the network and document vulnerabilities. Students will then use network packet capture tools such as Wireshark to verify their understanding of the vulnerabilities and testing procedures.

3. Web Application Security Analysis using Vega

Students will use the Vega scanning tool, within a graphical Kali Linux environment, to test web services over the network and document vulnerabilities. Students will then use network packet capture tools such as Wireshark to verify their understanding of the vulnerabilities and testing procedures.

4. Web Application Security Analysis using Burp Suite

Burp Suite is an industry standard suite of tools used by information security professionals for testing Web application security. Its tools work together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security vulnerabilities.

5. Detecting and Exploiting SQL Injection Vulnerabilities

Students will learn how to detect and exploit SQL injection vulnerabilities. By using several SQL injections techniques students will gather information about a remote database such as Operating System, database type, table names and their content. Students will then use sqlmap, a tool for SQL injection, to automate this process.

6. Web Site Reconnaissance

Web site reconnaissance is about gathering information about a web site. Of course, there is information published on the website that is intended for people to see. Then there is information such as the name and version of the software used in the website and information about databases used by web applications on the site. This is information the website owner may not want known but can be discovered using techniques covered by CYRIN labs in the Network Monitoring and Recon and Web Application Security Analysis categories.

• Understand the main Secure Development Lifecycle (SDLC) Models, and their principal differences
• Be able to choose which SDLC model is most appropriate in a given situation.
• Learn how to apply secure development techniques from the initial design stage and throughout a development lifecycle
• Understand the latest (2021) OWASP vulnerabilities and how to counter/mitigate them
• Learn about useful system design tools
• Discover resources to help introduce and use secure design and development best practices
• Learn Threat Modelling methodologies and techniques
• Understand the benefits of code review
• Understand various testing strategies
• Learn about encryption, securing and compromising passwords and meta data
• An introduction to the classification of security flaws and application security

There are no specific pre-requisites for this course.

Note: This course does not cover hands-on coding. Additional courses can be found in our Secure Development knowledge area.

Module 1 - Secure Development Lifecycle (SDLC)

• An overview of the main SDLC models
• Development models (Inc. DevSecOps)
• Configuration and source code management
• Risk analysis tools
• Privacy by Design

Module 2 - Secure By Design

• Secure development processes
• Threat modelling
• Risk mitigation
• Security best practice
• Secure design architecture

Module 3 – Introduction to Application Security (OWASP 2021)

• Vulnerabilities and mitigations available to any development environment
• Attack vectors and security controls
• OWASP Top Ten 2021
  • Broken Access Controls
  • Cryptographic Failures
  • Injection
  • Insecure Design
  • Security Misconfiguration
  • Vulnerable and Outdated Components
  • Identification and Authentication Failures
  • Software and Data Integrity Failures
  • Security Logging and Monitoring Failures
  • Server-Side Request Forgery (SSRF)

Module 4 – Introduction to Security Testing

• Secure coding techniques and principles.
• Methods of testing code, and code test analysis
• Using, compromising and defending encryption, hashes and passwords
• Classification of security flaws