Application security¶

Building software that is hard to attack and easy to fix: threat modeling at design time, secure coding against the common risk lists, automated scanning in the pipeline, and a safe supply chain.

flowchart LR
  DES[Design:<br/>threat model] --> CODE[Code:<br/>secure patterns, secrets out]
  CODE --> CI[Build:<br/>SAST, SCA, secret scan, SBOM]
  CI --> TEST[Test:<br/>DAST, API tests]
  TEST --> RUN[Run:<br/>headers, WAF, monitoring]
  RUN -.findings and incidents.-> DES

Security checks move left into each stage of delivery, and what production teaches goes back into design.

Learn¶

• Threat modeling explained - STRIDE and data flow diagrams
• OWASP Top 10 explained - web application risks and their defences
• OWASP API Security Top 10 explained - the ten API-specific risks
• Secure SDLC and DevSecOps - SAST, DAST, SCA and secret scanning in CI
• Security headers and CSP - what each header protects and a report-only CSP rollout
• Software supply chain security - SBOMs, signing, SLSA, dependency risk
• Secrets management - credentials out of code and config
• OAuth and OIDC explained - delegated access and federated login
• Hashing and password storage - salts and slow hashes
• TLS and HTTPS - encryption in transit
• Container security basics - minimal images, scanning, signing
• Kubernetes security basics - RBAC, Pod Security Standards, admission control
• Vulnerability management - CVE, CVSS, EPSS, KEV and patch SLAs

Reference¶

• Case study: Log4Shell 2021 - responding to a critical dependency vulnerability
• Case study: SolarWinds 2020 - build-system supply chain compromise
• Case study: MOVEit 2023 - an injection flaw in a widely deployed product
• Case study: Capital One 2019 - SSRF plus an over-permissioned IAM role
• Architecture pattern: Secrets and PKI platform
• Compliance: PCI DSS - secure development requirements for card data
• Compliance: EU Cyber Resilience Act - security obligations for products with digital elements
• AppSec engineer roadmap and AppSec interview prep

Build¶

• Harden a Linux server - the host your app runs on
• Container image scan with an SBOM - scan a public image and inspect what is inside

Certify¶

• GitHub Advanced Security - SAST, secret scanning, dependency scanning
• CKS - Certified Kubernetes Security Specialist
• KCSA - Kubernetes and Cloud Native Security Associate
• CompTIA Security+ - includes application security basics
• HashiCorp Vault Associate - secrets management