Module 1: Security Fundamentals

This module is designed to introduce you to academic concepts in security. By the end of this module, you should be able to understand that security is fundamentally risk management. You will also have developed a vocabulary to talk about different kinds of security threats.

Overview of Security:

• Bruce Schneier: The security mirage (ted talk)

Introduction to Computer Security:

• Lecture 1: Introduction
• Lecture 2: Why Security is Hard
• Lecture 3: Security as Risk Management
• Lecture 4: Aspects of Security

Interesting Bonus Materials:

• On Security Awareness Training (Bruce Schneier)
• Keren Elazari: Hackers: the Internet's immune system

Questions for discussion:

• In The security mirage Bruce Schneier talks about our implicit biases that distort our view of security. What are your biases?
• Which methods of managing risk apply most to your role at Redox? See lecture 3 for a list.
• Of confidentiality, integrity, and availability, which is the most important at Redox? See lecture 4 for one possible answer.

Module 2: Web Application Security

We make a web app. There are very specific and immediate vulnerabilities each developer needs to understand well and defend against.

Move slowly through these and finish the hacksplaing exercises on your own terms. This is marathon - not a sprint!

OWASP Top 10

• Injection
  • sql-injection
• Broken Authentication and Session_Management
  • session-fixation
  • weak-session
• Cross-Site Scripting (XSS)
  • xss-stored
  • xss-reflected
  • xss-dom
• Insecure Direct Object References
• Security Misconfiguration
  • unencrypted-communication
  • broken-access-control
• Sensitive Data Exposure
  • user-enumeration
  • information-leakage
  • password-mismanagement
• Missing Function Level Access Control
  • xss-stored
  • privilege-escalation
  • directory-traversal
• Cross-Site Request Forgery (CSRF)
  • csrf
• Using Components with Known Vulnerabilities
  • xml-bombs
  • file-upload
  • xml-external-entities
  • command-execution
• Unvalidated Redirects and Forwards
  • click-jacking
  • open-redirects

Exercises

• Complete the free exercises at hacksplaining
• Identify parts of the Redox application that mitigate each of the OWASP top 10

Module 3: Cryptography

Redox is a highly networked application. All of that information needs to be secured in transport and at rest. Cryptography is what is lets us do that.

Public key cryptography

• Introduction to Public-Key Cryptography (mozilla)
• How PGP works

Exercises

• Set up Github with your PGP key

Module 4: Cloud Infrastructure Security

• AWS Cloud Security Best Practices
• AWS Security Best Practices Video
• AWS Security Masterclass

Final Project

The final project will be a presentation to the team on a recent security topic of interest to you.

Here are some resources for cutting edge topics:

• OWASP Youtube channel
• Blackhat conference archives
• Schneier on Security
• Seclists.org
• National Vulnerability Database
• NodeJS security advisories