Curriculum

Application Security and DevSecOps

Embedding security into every stage of the software development lifecycle and measuring the price that differs at each stage: the gain and the limit of shifting left, abuse cases, threat modeling, the data flow diagram and trust boundaries, attack trees, what input validation and output encoding cover, injection, template injection, file upload, server-side request forgery and deserialization risks, identity, session and authorization implementation flaws, race conditions, secrets embedded in code and dependency risks, static and dynamic security testing, dependency and image scanning, the software bill of materials, build artifact signing and provenance, runtime defense layers, the secret lifecycle and workload identity, detection from application telemetry, breach response and the automation of audit evidence.

Embedding security into every stage of the software development lifecycle and measuring the price that differs at each stage: the gain and the limit of shifting left, abuse cases, threat modeling, the data flow diagram and trust boundaries, attack trees, what input validation and output encoding cover, injection, template injection, file upload, server-side request forgery and deserialization risks, identity, session and authorization implementation flaws, race conditions, secrets embedded in code and dependency risks, static and dynamic security testing, dependency and image scanning, the software bill of materials, build artifact signing and provenance, runtime defense layers, the secret lifecycle and workload identity, detection from application telemetry, breach response and the automation of audit evidence.