syllabus.md

Course Syllabus – Developing Secure Software (Linux Foundation)

Module 1: Introduction

• Why secure software matters
• Cost of insecure design and coding
• Security frameworks and standards (OWASP, NIST, SLSA)

Module 2: Secure Software Lifecycle

• Stages of SSDLC
• Integrating security into Agile and DevOps

Module 3: Requirements & Security

• Defining security requirements
• Non-functional requirements and compliance

Module 4: Threat Modeling

• STRIDE, PASTA, and other methodologies
• Identifying attack surfaces and trust boundaries

Module 5: Secure Design Principles

• Least privilege, fail-safe defaults, defense-in-depth
• Secure architecture patterns

Module 6: Secure Coding Practices

• Input validation and sanitization
• Output encoding
• Error handling and logging
• Language-specific guidelines

Module 7: Dependency & Supply Chain Security

• Managing open-source dependencies
• Software Bill of Materials (SBOM)

Module 8: Static Analysis (SAST)

• Tools and workflows
• Interpreting results and reducing false positives

Module 9: Dynamic Analysis (DAST)

• Runtime testing approaches
• Fuzzing and penetration testing basics

Module 10: Software Composition Analysis (SCA)

• Vulnerability scanning in dependencies
• Patch management workflows

Module 11: Authentication & Authorization

• Secure password storage
• MFA, OAuth2, OpenID Connect

Module 12: Data Protection & Cryptography

• Encryption at rest and in transit
• Key management best practices

Module 13: Secure Deployment & CI/CD

• Securing build pipelines
• Secrets management
• Container and Kubernetes security

Module 14: Runtime Protection & Observability

• Intrusion detection and prevention
• Logging and monitoring

Module 15: Incident Response & Reporting

• Coordinated vulnerability disclosure
• Postmortems and continuous improvement