With this module, you'll learn how to keep secrets safe and write code that keeps user data private and secure.
With this topic, you'll learn about the most common application security issues and how to mitigate them.
- Describe each of the vulnerabilities in the OWASP Top 10
- Describe what threat modeling is
- Explain how you might prevent the "Broken Access Control" vulnerability
- Explain what remediation is and how you might remediate an "Injection" vulnerability
- OWASP Top 10:2021
Resource - OWASP Top 10:2021 Overview
Video - Port Swigger Web Security Academy
Resource - What is web application security?
Resource
With this topic, you'll learn about identity providers and how to use OAuth 2.0 to manage authentication and authorization in an application.
- Compare authentication with authorization and explain their differences
- Use an identity provider to authenticate users in an application
- Explain what "federated identities" are
- Explain what the OAuth 2.0 standard is
- Auth0
Tool - Auth0 in 100 Seconds
Video - AWS Cognito
Tool - Calling an API
Video - Ethereum Accounts
Article - Firebase Authentication
Tool - Identity and Reputation in Web 3
Article - Introduction to Identity
Video - OAuth 2.0 Protocol
Resource - OpenID Connect and OAuth2
Video - OWASP Authentication Cheatsheet
Resource - OWASP Authorization Cheatsheet
Resource - Signing in with Ethereum
Video
With this topic, you'll learn about application secrets and how to manage them effectively.
- Describe what an application secret is
- Describe what an environment variable is
- Explain why you might want to secure an application secret
- Explain how you might inject secrets into an application using environment variables
- 12 Factor App: Config
Resource - 1Password Secrets Automation
Tool - 7 Cryptography Concepts EVERY Developer Should Know
Video - AWS Systems Manager (check out Parameter Store)
Tool - Removing sensitive data from a repository
Resource - Security and Cryptography
Video - Working with AWS Parameter Store
Resource
With this topic, you'll learn about methods to integrate security scanning into a project CI/CD pipeline.
- Describe what continuous security is
- List out some tools you might use to scan a project for vulnerabilities
- Explain how you might go about remediating vulnerabilities found from automated scanning
With this topic, you'll learn about the role of a security engineer and how to work with them on your team effectively.
- Describe the role of a security engineer
- Identify what you need from a security engineer to complete software engineering tasks
- Explain how you might work with a security engineer to remediate vulnerabilities