Fundamentals of Secure Design

Participant has demonstrated an understanding of fundamental secure design concepts. These include:

• Threat modelling concepts and when to perform it.
• Designing authentication and authorisation, including common mistakes and attacks.
• Designing correct input validation and why input sanitisation may lead to problems.
• Data protection via encryption and step-up authentication, and how attacks may steal data.
• Protecting secrets and designing systems to safely and securely inject said secrets at runtime.
• Logging and auditing considerations.
• Third-party library dangers and limiting user input to said libraries.

In addition participant has understood:

• How resources such as OWASP may help,
• OWASP top 10 and CWE top 25.
• Common tools, techniques and methods of exploitation employed by attackers.
• Importance of security when building applications.