Cybersecurity and Information Security

  1. Application Security and Secure Development
    1. Secure Software Development Lifecycle
      1. Security Requirements
        1. Security Requirement Gathering
          1. Threat Modeling
            1. STRIDE Methodology
              1. Attack Trees
                1. Data Flow Diagrams
                2. Risk Assessment
                3. Secure Design Principles
                  1. Least Privilege Principle
                    1. Defense in Depth
                      1. Fail Secure Design
                        1. Complete Mediation
                          1. Open Design
                            1. Separation of Privilege
                              1. Least Common Mechanism
                                1. Psychological Acceptability
                                2. Secure Coding Practices
                                  1. Input Validation
                                    1. Data Type Validation
                                      1. Range Checking
                                        1. Format Validation
                                        2. Output Encoding
                                          1. Context-aware Encoding
                                            1. Sanitization Techniques
                                            2. Error Handling
                                              1. Secure Error Messages
                                                1. Logging Practices
                                                2. Session Management
                                                  1. Session Token Generation
                                                    1. Session Timeout
                                                      1. Session Invalidation
                                                    2. Security Testing Integration
                                                      1. Unit Testing Security
                                                        1. Integration Testing
                                                          1. System Testing
                                                            1. Acceptance Testing
                                                          2. Web Application Security
                                                            1. Common Web Vulnerabilities
                                                              1. Injection Attacks
                                                                1. SQL Injection
                                                                  1. NoSQL Injection
                                                                    1. LDAP Injection
                                                                      1. OS Command Injection
                                                                        1. Code Injection
                                                                        2. Authentication Vulnerabilities
                                                                          1. Broken Authentication
                                                                            1. Session Management Flaws
                                                                              1. Credential Management Issues
                                                                              2. Authorization Flaws
                                                                                1. Broken Access Control
                                                                                  1. Insecure Direct Object References
                                                                                    1. Missing Function Level Access Control
                                                                                    2. Cross-Site Scripting
                                                                                      1. Reflected XSS
                                                                                        1. Stored XSS
                                                                                          1. DOM-based XSS
                                                                                            1. XSS Prevention
                                                                                            2. Cross-Site Request Forgery
                                                                                              1. CSRF Attack Vectors
                                                                                                1. CSRF Prevention
                                                                                                2. Security Misconfigurations
                                                                                                  1. Default Configurations
                                                                                                    1. Unnecessary Features
                                                                                                      1. Error Handling
                                                                                                      2. Sensitive Data Exposure
                                                                                                        1. Data Classification
                                                                                                          1. Encryption Requirements
                                                                                                            1. Secure Storage
                                                                                                          2. Web Application Security Testing
                                                                                                            1. Static Application Security Testing
                                                                                                              1. Source Code Analysis
                                                                                                                1. Binary Analysis
                                                                                                                  1. Configuration Review
                                                                                                                  2. Dynamic Application Security Testing
                                                                                                                    1. Black Box Testing
                                                                                                                      1. Vulnerability Scanning
                                                                                                                        1. Penetration Testing
                                                                                                                        2. Interactive Application Security Testing
                                                                                                                          1. Gray Box Testing
                                                                                                                            1. Runtime Analysis
                                                                                                                            2. Manual Security Testing
                                                                                                                              1. Code Review
                                                                                                                                1. Architecture Review
                                                                                                                                  1. Configuration Review
                                                                                                                              2. API Security
                                                                                                                                1. API Security Fundamentals
                                                                                                                                  1. REST API Security
                                                                                                                                    1. SOAP API Security
                                                                                                                                      1. GraphQL Security
                                                                                                                                      2. API Authentication and Authorization
                                                                                                                                        1. API Key Management
                                                                                                                                          1. OAuth Implementation
                                                                                                                                            1. JWT Token Security
                                                                                                                                            2. API Security Testing
                                                                                                                                              1. API Vulnerability Assessment
                                                                                                                                                1. API Penetration Testing
                                                                                                                                              2. Database Security
                                                                                                                                                1. Database Security Architecture
                                                                                                                                                  1. Database Access Controls
                                                                                                                                                    1. Network Security
                                                                                                                                                      1. Database Hardening
                                                                                                                                                      2. Data Protection
                                                                                                                                                        1. Encryption at Rest
                                                                                                                                                          1. Encryption in Transit
                                                                                                                                                            1. Key Management
                                                                                                                                                            2. Database Attack Prevention
                                                                                                                                                              1. SQL Injection Prevention
                                                                                                                                                                1. Privilege Escalation Prevention
                                                                                                                                                                  1. Data Leakage Prevention

                                                                                                                                                              Previous

                                                                                                                                                              4. System and Endpoint Security

                                                                                                                                                              Go to top

                                                                                                                                                              Next

                                                                                                                                                              6. Identity and Access Management