QUICK REFERENCE
Study Guides
Key takeaways, essential concepts, and quick-reference summaries for every module. Jump directly to any study guide.
Track 1: Foundations & Governance
SSDLC Process & Policy
SSDLC process fundamentals, security activities across SDLC phases, governance documents, and AI acceptable use policies.
Threat Landscape
Current threat landscape including OWASP Top 10, API Security Top 10, LLM Top 10, CWE Top 25, and MITRE ATT&CK techniques relevant to application security.
CIS Controls v8: CG16 Deep Dive
Deep dive into CIS Controls v8 Control Group 16, covering all safeguards for application software security from 16.1 through 16.14.
Regulatory & Compliance Framework
Regulatory and compliance frameworks affecting software development, including PCI DSS, HIPAA, SOX, GDPR, and the EU AI Act.
AI Governance for Development
AI governance frameworks for development teams, covering acceptable use policies, risk assessment, and responsible AI integration into the SDLC.
Track 2: Design & Architecture
Security Requirements Engineering
Security requirements engineering techniques including misuse cases, OWASP ASVS, and leveraging LLMs for requirements brainstorming with human validation.
Secure Design Principles
Secure design principles including defense in depth, least privilege, fail-safe defaults, and applying security patterns to system architecture.
Threat Modeling
Threat modeling methodologies including STRIDE, PASTA, Attack Trees, and LINDDUN, with practical application to real-world architectures.
Cryptography Standards
Cryptographic standards for developers covering algorithm selection, key management, TLS configuration, and common implementation pitfalls.
Architecture Security Assessment
Architecture security assessment techniques for evaluating system designs against security requirements and identifying structural vulnerabilities.
Privacy by Design
Privacy by Design principles and implementation, covering GDPR requirements, data minimization, and privacy impact assessments.
Track 3: Secure Implementation
Secure Coding Practices
Secure coding practices across languages, covering OWASP guidelines, CWE Top 25 mitigations, and recognizing AI-generated code vulnerabilities.
AI-Augmented Coding
Secure use of AI coding assistants, covering prompt engineering for security, validating AI output, and managing AI-specific vulnerability patterns.
Security Libraries and Vetted Components
Selecting and managing security libraries and vetted components, including evaluation criteria, approved lists, and dependency governance.
Secure Code Review
Secure code review processes including security-focused checklists, automated analysis integration, and reviewing AI-generated code contributions.
API Security
API security covering authentication, authorization, rate limiting, input validation, and the OWASP API Security Top 10.
Track 4: Configuration Management
Version Control Security
Version control security including repository hardening, branch protection, commit signing, and code provenance for AI-generated contributions.
Change Management & Release Control
Change management and release control processes integrating security gates, approval workflows, and rollback procedures.
AI Code Attribution & Licensing
AI code attribution and licensing challenges, covering intellectual property, license compliance, and provenance tracking for AI-generated code.
Track 5: Testing & Verification
Testing Pyramid & Coverage
Testing pyramid fundamentals, coverage metrics, mutation testing, and designing security-specific test strategies with AI-generated test evaluation.
Security Testing Automation
Security testing automation including SAST, DAST, IAST, and SCA integration into CI/CD pipelines with quality gate enforcement.
UAT & Acceptance Testing
User acceptance testing and security acceptance criteria, ensuring security requirements are validated before production release.
Penetration Testing
Penetration testing methodologies, scoping, execution, and remediation workflows for application security assessments.
Testing AI-Generated Code
Testing strategies specific to AI-generated code, including higher coverage requirements, mutation testing, and behavioral validation.
Track 6: Build, Deploy & Operations
Pipeline Security
CI/CD pipeline security covering hardening, scanning stages, secrets management, and protecting the build system as an attack surface.
Artifact Integrity & SBOM
Artifact integrity verification, SBOM generation, and software supply chain transparency using SLSA and in-toto frameworks.
Dependency & Supply Chain Management
Dependency and supply chain management including SCA, license compliance, vulnerability monitoring, and mitigating dependency confusion attacks.
Secrets Management
Secrets management best practices covering vaults, rotation, detection, and preventing secret exposure in code and CI/CD pipelines.
Infrastructure Hardening & Container Security
Infrastructure hardening and container security covering IaC security, CIS Benchmarks, image scanning, and runtime protection.
Environment Separation & Deployment
Environment separation and deployment strategies ensuring security isolation between development, staging, and production environments.
Secure Development Environment
Secure development environment configuration covering endpoint security, IDE hardening, and developer workstation standards.
Track 7: Response & Improvement
Vulnerability Management Program
Vulnerability management program design covering lifecycle management, severity rating, SLA enforcement, and AI-powered triage at scale.
Coordinated Vulnerability Disclosure
Coordinated vulnerability disclosure program design including policy creation, safe harbor provisions, and researcher engagement.
Incident Response for Development Teams
Incident response procedures for development teams covering containment, investigation, remediation, and post-incident review.
Security Logging & Monitoring
Security logging and monitoring for applications covering log standards, SIEM integration, alerting, and detection engineering.
Program Metrics & Continuous Improvement
Program metrics and continuous improvement for SSDLC maturity, covering KPIs, dashboards, and maturity model assessments.
Software Decommissioning
Software decommissioning procedures covering data retention, credential revocation, dependency notification, and secure disposal.