Application Security Foundations

What you will be able to do

• Map the secure software development lifecycle (SSDLC) and explain where security work belongs at each stage.
• Lead a threat modeling session using STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege) and turn the findings into a prioritized fix list.
• Draw a data flow diagram and mark the trust boundaries where attacks are most likely to start.
• Recognize every class in the OWASP (Open Worldwide Application Security Project) Top 10 and describe how each one shows up in real code.
• Trace a common vulnerability from its root cause to a concrete fix a developer can apply.
• Choose the right security testing tool for the job, whether static analysis (SAST), dynamic analysis (DAST), or software composition analysis (SCA).
• Explain how security responsibilities are shared across developers, operations, and a dedicated application security team.
• Write security findings that are clear, specific, and easy for developers to act on.

What is inside

4 modules, 8 lessons. Each module ends in a graded quiz and most carry an assignment.

1. 01

   The Secure Software Development Lifecycle

   Security costs the least and works the best when it starts early, not when it is rushed in right before release. This module walks through how software actually gets built and shows where security belongs at every phase, from requirements and design through coding, testing, and release. You will pick up the mindset behind shifting security left and see why catching a flaw in design beats finding it in production.

   2 lessons · 5 quiz questions

2. 02

   Threat Modeling with STRIDE

   Before you can defend a system, you have to understand how it could be attacked. This module teaches threat modeling, a structured way to find design weaknesses on paper before vulnerable code ever ships. You will build data flow diagrams, locate the trust boundaries where threats gather, and then apply STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege) to enumerate threats and decide what to fix first.

   2 lessons · 5 quiz questions · assignment

3. 03

   The OWASP Top 10 in Practice

   The OWASP (Open Worldwide Application Security Project) Top 10 is the industry's shared list of the most critical web application security risks. This module works through each class in plain language, using real breaches and everyday coding mistakes to show not only what each flaw is, but how it happens and how a developer can shut it down. The content reflects the current 2025 edition of the list.

   2 lessons · 5 quiz questions

4. 04

   Security Across the Engineering Team

   Application security is a team sport, and no single person can carry all of it. This module shows how responsibilities are shared across developers, operations, and a dedicated security team, and how the security champion model spreads good habits without creating a bottleneck. You will also see how security fits into a modern continuous integration and continuous delivery (CI/CD) pipeline, using static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA), so protection scales along with the code.

   2 lessons · 5 quiz questions · assignment