Secure Software Development

  1. Secure Requirements and Design
    1. Security Requirements Engineering
      1. Eliciting Security Requirements
        1. Stakeholder Analysis
          1. Security Requirement Gathering Techniques
            1. Requirements Prioritization
            2. Types of Security Requirements
              1. Functional Security Requirements
                1. Non-Functional Security Requirements
                  1. Compliance Requirements
                    1. Privacy Requirements
                    2. Abuse and Misuse Cases
                      1. Identifying Potential Abuses
                        1. Documenting Misuse Scenarios
                          1. Attack Trees and Attack Graphs
                          2. Security Standards and Compliance Requirements
                            1. GDPR
                              1. Data Protection Principles
                                1. Privacy by Design
                                  1. Data Subject Rights
                                  2. HIPAA
                                    1. Healthcare Data Security Requirements
                                      1. Administrative Safeguards
                                        1. Physical Safeguards
                                          1. Technical Safeguards
                                          2. PCI DSS
                                            1. Payment Card Data Security Standards
                                              1. Cardholder Data Environment
                                                1. Security Requirements
                                                2. SOX
                                                  1. Financial Data Integrity
                                                    1. Internal Controls
                                                      1. Audit Requirements
                                                  2. Secure Architectural Design
                                                    1. Security Architecture Principles
                                                      1. Secure by Design
                                                        1. Security Zoning and Segmentation
                                                          1. Zero Trust Architecture
                                                          2. Trust Boundaries
                                                            1. Identifying Trust Boundaries
                                                              1. Enforcing Trust Boundaries
                                                                1. Trust Relationship Modeling
                                                                2. Data Flow Analysis
                                                                  1. Data Flow Diagrams for Security
                                                                    1. Identifying Sensitive Data Flows
                                                                      1. Trust Boundary Crossing Points
                                                                      2. Secure Design Patterns
                                                                        1. Input Validation Patterns
                                                                          1. Authentication Patterns
                                                                            1. Authorization Patterns
                                                                              1. Secure Logging Patterns
                                                                                1. Error Handling Patterns
                                                                                2. Security Anti-Patterns
                                                                                  1. Common Design Mistakes
                                                                                    1. Patterns to Avoid
                                                                                      1. Refactoring Anti-Patterns
                                                                                      2. Component and Service Architecture
                                                                                        1. Isolating Critical Components
                                                                                          1. Microservices Security Considerations
                                                                                            1. API Security Design
                                                                                              1. Service Mesh Security
                                                                                            2. Threat Modeling
                                                                                              1. Threat Modeling Fundamentals
                                                                                                1. Purpose and Goals
                                                                                                  1. Proactive Risk Identification
                                                                                                    1. Prioritizing Security Efforts
                                                                                                      1. Integration with Design Process
                                                                                                      2. Threat Modeling Methodologies
                                                                                                        1. STRIDE
                                                                                                          1. Spoofing Identity
                                                                                                            1. Tampering with Data
                                                                                                              1. Repudiation
                                                                                                                1. Information Disclosure
                                                                                                                  1. Denial of Service
                                                                                                                    1. Elevation of Privilege
                                                                                                                    2. DREAD
                                                                                                                      1. Damage Potential
                                                                                                                        1. Reproducibility
                                                                                                                          1. Exploitability
                                                                                                                            1. Affected Users
                                                                                                                              1. Discoverability
                                                                                                                              2. PASTA
                                                                                                                                1. Process Overview
                                                                                                                                  1. Attack Simulation
                                                                                                                                    1. Threat Analysis Steps
                                                                                                                                    2. VAST
                                                                                                                                      1. Visual Modeling
                                                                                                                                        1. Agile Integration
                                                                                                                                          1. Scalable Approach
                                                                                                                                        2. Threat Modeling Process
                                                                                                                                          1. Application Decomposition
                                                                                                                                            1. Identifying Assets
                                                                                                                                              1. Mapping Components
                                                                                                                                                1. Data Flow Analysis
                                                                                                                                                  1. Entry and Exit Points
                                                                                                                                                  2. Threat Identification
                                                                                                                                                    1. Threat Enumeration Techniques
                                                                                                                                                      1. Attack Vector Analysis
                                                                                                                                                        1. Threat Actor Profiling
                                                                                                                                                        2. Risk Assessment
                                                                                                                                                          1. Risk Calculation Methods
                                                                                                                                                            1. Prioritization Criteria
                                                                                                                                                              1. Risk Tolerance Levels
                                                                                                                                                              2. Countermeasure Identification
                                                                                                                                                                1. Mapping Controls to Threats
                                                                                                                                                                  1. Mitigation Strategies
                                                                                                                                                                    1. Residual Risk Assessment
                                                                                                                                                                  2. Threat Modeling Tools and Documentation
                                                                                                                                                                    1. Threat Modeling Tools
                                                                                                                                                                      1. Documentation Standards
                                                                                                                                                                        1. Model Maintenance and Updates

                                                                                                                                                                    Previous

                                                                                                                                                                    1. Introduction to Secure Software Development

                                                                                                                                                                    Go to top

                                                                                                                                                                    Next

                                                                                                                                                                    3. Secure Implementation and Coding