セキュアソフトウェア開発：要件、設計、再利用 from edX

現代のソフトウェアは常に攻撃を受けていますが、多くのソフトウェア開発者は、それらの攻撃に効果的に対処する方法を教わったことがありません。このコースでは、この問題を解決するために、セキュアなソフトウェアを開発するための基本的な知識を解説します。このコースは、ソフトウェア開発者、DevOpsプロフェッショナル、ソフトウェア技術者、Webアプリケーション開発者、およびセキュアなソフトウェアの開発方法を学ぶことに関心のある人を対象としており、情報セキュリティを改善するために、限られたリソースでも実行可能な実践的なステップに重点を置いています。このコースでは、ソフトウェア開発者が、攻撃を成功させるのが格段に難しいシステムを開発し、維持すること、攻撃が成功した場合の被害を減らすこと、潜在的な脆弱性を速やかに修復できるよう対応を迅速化することができるようになることを目指します。

このコースでは、リスクマネジメントの本当の意味など、セキュリティの基本的な事柄について説明します。システムの要件の一部としてセキュリティをどのように考慮するか、また、どのような潜在的なセキュリティ要件が考えられるかについて説明します。次に、ソフトウェアをセキュアに設計する方法について、悪い設計を避け、良い設計を取り入れるのに役立つ様々なセキュア設計の原則を含めて説明します。また、ソフトウェアのサプライチェーンを安全にする方法、つまり、セキュリティを強化するために再利用されるソフトウェア（オープンソースソフトウェアを含む）をより安全に選択し、取得する方法についても説明します。

このコースは、「セキュアソフトウェア開発の基礎」のプロフェッショナル認定プログラムの3つのコースのうちの最初のコースで、オープンソースのエコシステムのセキュリティにフォーカスしたLinux FoundationのプロジェクトであるOpen Source Security Foundation（OpenSSF）によって開発されたものです。このプログラムに含まれるトレーニングコースは、最も一般的な種類の攻撃に対処するために、（開発者として）あなたが取ることができる実践的なステップに重点を置いています。

What's inside

Learning objectives

セキュリティの基本：リスクマネジメント、「cia」トライアド、要件。
セキュアデザイン原則：「最小限の権限」などの原則とは何か、そしてそれらの原則の適用方法。

サプライチェーンの評価：再利用するパッケージの選び方や、迅速に警告を受け。アップデートできるように再利用する方法などのヒント。

セキュリティの基本：リスクマネジメント、「cia」トライアド、要件。
セキュアデザイン原則：「最小限の権限」などの原則とは何か、そしてそれらの原則の適用方法。
サプライチェーンの評価：再利用するパッケージの選び方や、迅速に警告を受け。アップデートできるように再利用する方法などのヒント。

Syllabus

ようこそ！

セキュリティの基本

セキュア設計の基礎

外部ソフトウェアの再利用

最終問題（ベリファイドトラックのみ)

Good to know

Know what's good

, what to watch for

, and possible dealbreakers

This course provides a solid foundation for comprehending and implementing secure software development practices

Taught by David A. Wheeler, a recognized expert in secure software

Examines core concepts of security and risk management, equipping learners to develop more robust systems

Covers secure design principles and best practices, promoting the development of secure software

Emphasizes the importance of supply chain security, assisting learners in selecting and using third-party software more effectively

May require additional background knowledge or experience in software development to fully benefit from the course

Activities

Be better prepared before your course. Deepen your understanding during and after it. Supplement your coursework and achieve mastery of the topics covered in セキュアソフトウェア開発：要件、設計、再利用 with these activities:

Gather resources on open source security best practices

Show steps

Expand your knowledge of open source security by compiling a collection of reputable resources, including articles, tools, and guidelines.

Browse courses on Open Source Security

Show steps

Search for relevant resources on open source security.
Organize the resources into categories, such as best practices, tools, and case studies.
Create a central repository (e.g., a shared document or online folder) to house the compilation.

セキュアコーディングのオンラインコース

Show steps

オンラインコースを受講することで、安全なコーディングの実践を体系的に学ぶことができます。

Show steps

セキュアコーディングに関するオンラインコースを探して、受講する
コースの課題や演習に取り組み、セキュアコーディングの技術を習得する

Practice identifying security risks

Show steps

Reinforce your understanding of security fundamentals by completing exercises that test your ability to identify potential security risks.

Browse courses on Security Fundamentals

Show steps

Review the course materials on security risks.
Complete the practice exercises provided in the learning platform.

Eight other activities

Expand to see all activities and additional details

Show all 11 activities

Participate in peer code review sessions

Show steps

Enhance your understanding of secure coding practices by engaging in peer code review sessions, where you can provide and receive feedback on code security.

Browse courses on Code Reviews

Show steps

Join or create a peer code review group.
Participate regularly in code review sessions.
Provide constructive feedback to peers, focusing on security aspects.
Incorporate feedback received from peers into your own coding practices.

脆弱性診断ツールの演習

Show steps

脆弱性診断ツールを使用することで、実際にシステムの脆弱性を発見し、対応する経験を積むことができます。

Show steps

脆弱性診断ツールを1つ以上インストールする
ツールを使用して、他の参加者または友人のシステムをスキャンする
発見された脆弱性を分析し、対応策を考案する

セキュリティに関する議論

Show steps

他の参加者と議論を行うことで、セキュリティに関する多様な視点に触れ、理解を深めることができます。

Show steps

他の参加者と議論の会を設ける
セキュリティに関するトピックを選び、議論する

Explore best practices for secure software design

Show steps

Enhance your understanding of secure software design principles by following guided tutorials that demonstrate best practices and common pitfalls.

Browse courses on Secure Design Principles

Show steps

Identify reputable resources and tutorials on secure software design.
Follow the tutorials step-by-step, implementing the principles in your own projects.
Seek feedback from peers or mentors to refine your approach.

シナリオベースのセキュリティ設計

Show steps

実際のシナリオを想定してセキュリティ設計を行うことで、リスクをより具体的に理解し、効果的な対策を講じることができます。

Show steps

特定のアプリケーションやシステムを想定して、それが攻撃される可能性のあるシナリオを特定する
各シナリオに対して、攻撃者がどのようにシステムを侵害できるかを分析する
システムの脆弱性を特定し、攻撃に対する対策を考案する
考案した対策を設計文書にまとめる

Develop a security checklist for code reviews

Show steps

Apply your knowledge of secure software design by creating a comprehensive checklist to guide code reviews and identify potential vulnerabilities.

Browse courses on Software Security

Show steps

Review existing security checklists and guidelines.
Identify common security vulnerabilities and threats.
Develop a customized checklist tailored to your specific project or domain.
Test and refine the checklist by applying it to sample code.

セキュリティハッカソン

Show steps

ハッカソンに参加することで、実世界の課題に取り組み、セキュリティに関する実践的な経験を積むことができます。

Show steps

セキュリティハッカソンを探し、参加する
チームを組んで、課題に取り組む
課題を解決するソリューションを設計し、実装する
ソリューションを審査員にプレゼンする

セキュリティボランティア

Show steps

セキュリティに関する非営利団体やコミュニティに参加することで、実世界の課題に取り組み、貢献することができます。

Show steps

セキュリティに関する非営利団体やコミュニティを探す
ボランティアとして参加し、活動に参加する

Career center

Learners who complete セキュアソフトウェア開発：要件、設計、再利用 will develop knowledge and skills that may be useful to these careers:

Security Engineer

Security Engineers design, implement, and maintain security measures to protect computer systems and networks from attacks. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to develop software that is resistant to attacks. You will learn about risk management, secure design principles, and how to secure the software supply chain. This course is particularly relevant for Security Engineers who want to specialize in secure software development or who work on software that handles sensitive data.

See salaries and explore the career path for Security Engineer

Web Application Developer

Web Application Developers design, develop, and maintain web applications, ensuring that they are secure and meet the needs of the users. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to develop web applications that are resistant to attacks. You will learn about risk management, secure design principles, and how to secure the software supply chain. This course is particularly relevant for Web Application Developers who want to specialize in secure software development or who work on web applications that handle sensitive data.

See salaries and explore the career path for Web Application Developer

Software Developer

Software Developers design, write, and test the code for computer software applications, ensuring that they are secure and meet the needs of the users. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to develop software that is resistant to attacks. You will learn about risk management, secure design principles, and how to secure the software supply chain. This course is particularly relevant for Software Developers who want to specialize in secure software development or who work on software that handles sensitive data.

See salaries and explore the career path for Software Developer

Software Architect

Software Architects design and develop the overall architecture of software systems, ensuring that they are secure, scalable, and meet the needs of the users. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to design and develop software systems that are resistant to attacks. You will learn about risk management, secure design principles, and how to secure the software supply chain. This course is particularly relevant for Software Architects who want to specialize in secure software development or who work on software systems that handle sensitive data.

See salaries and explore the career path for Software Architect

DevOps Engineer

DevOps Engineers work to bridge the gap between software development and operations teams, ensuring that software is developed, deployed, and maintained in a secure and efficient manner. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to develop and deploy software securely. You will learn about risk management, secure design principles, and how to secure the software supply chain. This course is particularly relevant for DevOps Engineers who want to specialize in secure software development or who work on software that handles sensitive data.

See salaries and explore the career path for DevOps Engineer

Security Architect

Security Architects design and implement security architectures for organizations. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to design and implement secure software architectures. You will learn about security architecture principles, threat modeling techniques, and how to develop and implement security controls. This course is particularly relevant for Security Architects who want to specialize in secure software development or who work on software systems that handle sensitive data.

See salaries and explore the career path for Security Architect

Chief Information Security Officer (CISO)

Chief Information Security Officers (CISOs) are responsible for the overall security of an organization's information systems and data. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to lead an organization's security program. You will learn about security leadership, risk management, and how to develop and implement security strategies. This course is particularly relevant for CISOs who want to specialize in secure software development or who work on software systems that handle sensitive data.

See salaries and explore the career path for Chief Information Security Officer (CISO)

Software Quality Assurance (QA) Engineer

Software Quality Assurance (QA) Engineers test software to ensure that it meets the requirements and is free of defects. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to test software for security vulnerabilities. You will learn about software testing techniques, security testing tools, and how to develop and implement security test plans. This course is particularly relevant for Software QA Engineers who want to specialize in secure software development or who work on software that handles sensitive data.

See salaries and explore the career path for Software Quality Assurance (QA) Engineer

Software Security Analyst

Software Security Analysts identify and assess software vulnerabilities and develop and implement security measures to mitigate risks. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to identify, assess, and mitigate software vulnerabilities. You will learn about software security testing techniques, vulnerability assessment tools, and how to develop and implement security patches. This course is particularly relevant for Software Security Analysts who want to specialize in secure software development or who work on software that handles sensitive data.

See salaries and explore the career path for Software Security Analyst

Risk Manager

Risk Managers identify, assess, and mitigate risks to an organization's assets and operations. This course can help you build a foundation in risk management, providing you with the knowledge and skills necessary to identify, assess, and mitigate risks to software systems. You will learn about risk management techniques, risk assessment methods, and how to develop and implement risk mitigation plans. This course is particularly relevant for Risk Managers who want to specialize in software security or who work on software systems that handle sensitive data.

See salaries and explore the career path for Risk Manager

Product Security Manager

Product Security Managers are responsible for the security of software products and services. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to develop and manage secure software products and services. You will learn about product security planning, secure software development practices, and how to manage software security risks. This course is particularly relevant for Product Security Managers who want to specialize in secure software development or who work on software products and services that handle sensitive data.

See salaries and explore the career path for Product Security Manager

Security Consultant

Security Consultants provide security consulting services to organizations. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to provide security consulting services to clients. You will learn about security assessment techniques, risk management, and how to develop and implement security plans. This course is particularly relevant for Security Consultants who want to specialize in secure software development or who work with clients who develop and use software.

See salaries and explore the career path for Security Consultant

Compliance Auditor

Compliance Auditors ensure that an organization's operations are in compliance with applicable laws and regulations. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to ensure that software systems are in compliance with applicable laws and regulations. You will learn about security standards, compliance frameworks, and how to audit software systems for compliance. This course is particularly relevant for Compliance Auditors who want to specialize in software security or who work on software systems that handle sensitive data.

See salaries and explore the career path for Compliance Auditor

Penetration Tester

Penetration Testers assess the security of computer systems and networks by simulating attacks. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to assess the security of software systems. You will learn about penetration testing techniques, vulnerability assessment tools, and how to develop and implement security patches. This course is particularly relevant for Penetration Testers who want to specialize in secure software development or who work on software systems that handle sensitive data.

See salaries and explore the career path for Penetration Tester

Information Security Manager

Information Security Managers are responsible for the security of an organization's information systems and data. This course can help you build a foundation in secure software development, providing you with the knowledge and skills necessary to secure information systems and data. You will learn about information security principles, security controls, and how to develop and implement information security policies. This course is particularly relevant for Information Security Managers who want to specialize in secure software development or who work on software systems that handle sensitive data.

See salaries and explore the career path for Information Security Manager