Course Objectives
By the end of this course, students will be able to:
- Categorize secure and resilient software
- Identify the role of security in the software development life cycle
- Apply security methods to software design
- Apply development best practices
- Analyze security testing
- Examine the Comprehensive Lightweight Application Security Process (CLASP)
- Apply security metrics and maturity models
- Evaluate web services, particularly with regard to their security
Week 1
Lecture: Introduction
Lecture: Characteristics of Secure and Resilient Software
Lecture: Project Overview
Outcomes
By the end of this module, you should be able to:
- Examine the course outline and objectives
- Explain why software is insecure
- Define key terms in the course
- Identify key concepts in software security
- Compare functional and nonfunctional requirements
- Identify how to test nonfunctional requirements
- Evaluate a variety of security-related nonfunctional requirements
- Break down the objectives and requirements of the course project
Week 2
Lecture: Security and Resilience in the SDLC
Lecture: Best Practices
Outcomes
By the end of this module, you should be able to:
- Identify the phases of the SDLC
- Integrate security into each phase of the SDLC
- Compare and contrast the best practices for secure software development
Week 3
Lecture: Designing Applications
Lecture: Most Dangerous Programming Errors
Outcomes
By the end of this module, you should be able to:
- Examine how proper design can impact software security
- Analyze web security architecture requirements
- Identify the CWE/SANS top 25 most dangerous programming errors
Week 4
Lecture: Programming Best Practices: Part 1
Outcomes
By the end of this module, you should be able to:
- Identify the risks and defenses against improper input validation, cross-site scripting, and injection attacks
Week 5
Lecture: Programming Best Practices: Part 2
Outcomes
By the end of this module, you should be able to:
- Identify the risks and defenses against poor authentication and session management, cross-site request forgery attacks, cryptographic attacks, and improper error handling
Week 6
Lecture: Embedded and Other Systems
Outcomes
By the end of this module, you should be able to:
- Analyze the specific security requirements of embedded systems
- Compare iOS and Android approaches to security
Week 7
Lecture: Security Testing
Lecture: CLASP
Outcomes
By the end of this module, you should be able to:
- Identify each testing phase of the SDLC
- Apply different approaches to software testing for security
- Describe the Comprehensive, Lightweight Application Security Process (CLASP)
Week 8
Lecture: Metrics
Outcomes
By the end of this module, you should be able to:
- Analyze the role of software security maturity models
- Apply OpenSAMM and BSIMM
- Examine the nature of software security metrics
The course description, objectives and learning outcomes are subject to change without notice based on enhancements made to the course. November 2013
