Principles of Secure Coding offers a comprehensive exploration of secure coding practices, emphasizing the importance of incorporating security throughout the entire development process. This course will equip you with the skills and mindset necessary to protect your applications against potential threats, setting you on the path towards developing robust and resilient software.
Read more
Principles of Secure Coding offers a comprehensive exploration of secure coding practices, emphasizing the importance of incorporating security throughout the entire development process. This course will equip you with the skills and mindset necessary to protect your applications against potential threats, setting you on the path towards developing robust and resilient software.
Principles of Secure Coding offers a comprehensive exploration of secure coding practices, emphasizing the importance of incorporating security throughout the entire development process. This course will equip you with the skills and mindset necessary to protect your applications against potential threats, setting you on the path towards developing robust and resilient software.
Dive into essential security concepts such as authentication, authorization, encryption, and encoding. Learn the importance of version control and best practices for maintaining sensitive information. Engage with real-life and fictional security horror stories, including an exclusive tale from YouTube sensation Tom Scott, to gain insight into the potential consequences of insecure coding.
Explore secure coding techniques using C# as our primary language while emphasizing broader applicability to other programming languages. Delve into methods for safeguarding data, preventing information leaks, and mitigating vulnerabilities. Develop an understanding of security testing and code review processes to ensure your applications remain secure and compliant.
Continuing the course, we'll investigate the OWASP Top Ten security risks for 2021, enabling you to recognize and address recurring security issues. By diving deep into these prevalent concerns, you'll gain invaluable insight into the mindset and thought processes that often lead to security problems.
New. A bonus module examining three new online authentication methods and how they work, as well as how they fit into the context of encryption and security. Have you ever wondered how Google or Microsoft Authenticator works? We will dig into what is happening under the covers.
Seize the opportunity to enhance your software development skills with this course. Enroll today and propel your skills to new heights.
What's inside
Learning objectives
- Understand the core concepts of security, including encoding, encryption, and serialization
- Recognize the importance of version control in maintaining secure software development and managing sensitive information
- Apply secure coding practices, such as mitigating reflection attacks, handling data types securely, and avoiding custom encryption implementations
- Effectively store and protect data using techniques such as hashing, salting, and transparent data encryption
- Identify and prevent common attacks as outlined in the owasp top ten for 2021, including broken access control, cryptographic failures, and injection attacks
- Gain familiarity with security tools, such as owasp zap, and the value of penetration testing for assessing application security
- Develop a comprehensive understanding of security logging, monitoring, and best practices for secure software design and data integrity
- Understand the core concepts of security, including encoding, encryption, and serialization
- Recognize the importance of version control in maintaining secure software development and managing sensitive information
- Apply secure coding practices, such as mitigating reflection attacks, handling data types securely, and avoiding custom encryption implementations
- Effectively store and protect data using techniques such as hashing, salting, and transparent data encryption
- Identify and prevent common attacks as outlined in the owasp top ten for 2021, including broken access control, cryptographic failures, and injection attacks
- Gain familiarity with security tools, such as owasp zap, and the value of penetration testing for assessing application security
- Develop a comprehensive understanding of security logging, monitoring, and best practices for secure software design and data integrity
Syllabus
Introduction
Who I am, what I aim to do, and what I think of best practices.
A quick look at the tools we're going to use and a map of the course.
Read more
Syllabus
Who I am, what I aim to do, and what I think of best practices.
A quick look at the tools we're going to use and a map of the course.
Some definitions of "security", and some clarity on the pain of insecurity.
Who you are, what you can do, and how this goes wrong.
Untangling some security terms from each other and from their common usage.
We'll look at a nuts and bolts example of how serialization can cause problems.
We'll understand how and why the nature of the Internet is fundamentally insecure.
Understanding the bad guys both outside the walls and in.
We'll wrap up the section and review what we talked about.
What it is we're talking about when we say "the security of version control".
Why secrets do not belong in version control, and what we mean by that.
A story about what goes wrong when secrets end up in version control.
Working with secrets managers, and what doing that correctly requires.
How we can avoid secrets and the pain of working with them altogether.
We'll demo a secrets manager and talk about how to manage secrets in Production.
We'll close out the section with a discussion of Tom Scott's legendary YouTube short, "The (Fictional) Day Google Forgot to Check Passwords".
We'll talk about the nature of server-side code and how it can go wrong.
We'll talk about the risks associated with the very common practice of code reflection.
We'll look at some C#-specific solutions to reducing the copies of your sensitive data floating around.
We'll look at the ins and outs of read-only structs and reflect on the other uses of the readonly keyword.
Why SecureString isn't, and what happens to best practices.
Why you're not good enough (and neither am I) to write your own encryption.
One more look at the problems associated with serialization and an approach to deal with them.
What Microsoft says about secure coding.
A look at the role that containers and VMs can play in secure coding.
We'll talk about choosing in security, and another horror story from poor security.
We'll look at a common source of data breaches, and what practices can prevent it.
An in depth look at what we're talking about with hashing and salt.
A look at Microsoft's cloud encryption solution for databases, Transparent Data Encryption.
We'll look at connecting to an Azure Key Vault to manage our secrets.
A discussion of Social Security Numbers and their meaning in security.
How sensitive data gets into logs, and why it happens.
A nuts and bolts example of getting a piece of sensitive data into the logs, and how to keep it out.
An overview of OWASP and what the Top Ten means from year to year.
What happens when users get outside of their intended permissions.
What happens when we fail to protect our data.
What happens when users can execute code we did not intend.
What happens when our system is designed wrongly from the start, in security terms.
What happens when you haven't configured your applications and systems for secure operation.
When updating that package is too much trouble, so you end up with a security breach.
When the basis of your authentication is inadequate evidence that a user is who they say they are.
What happens when our application trusts stuff it shouldn't.
When we don't know what's going on with our system, or can't.
When an internal server is tricked into making a request on the behalf of an attacker.
Working with OWASP's automated scanning tool, ZAP.
Why getting help from security experts can be painful, but is worth it.
We'll wrap up the course and take one last stab at getting some security principles into your bones.
We'll review a few of the big concepts covered in the course and see how much you remember.
We'll look at a mostly-abandoned symmetric encryption method with some interesting history.
We'll break down what HMAC means and how we can use it for authentication.
We'll look at the time-based variation on the hash-based authentication scheme.
We'll cover the basics of FIDO, a new password-free authentication scheme which is taking hold.
This quiz will test your knowledge of OTP, HOTP, TOTP, and FIDO.
Traffic lights
Save this course
Save
Reviews summary
Foundational secure coding principles with c#
Excellent for building fundamental security understanding.
Instructor is knowledgeable and engaging.
Useful, real-world examples applied to secure coding.
The course explains complex security topics clearly.
Activities
Review Cryptography Fundamentals
Show steps
Reinforce your understanding of cryptography, which is essential for secure coding practices covered in the course.
Browse courses on
Cryptography
Show steps
-
Review basic encryption algorithms and their use cases.
-
Study hashing and salting techniques for password storage.
-
Understand the differences between symmetric and asymmetric encryption.
Read 'Writing Secure Code'
Show steps
Deepen your understanding of secure coding principles with a comprehensive guide.
View
Liber Nox
on Amazon
Show steps
-
Read the book cover to cover, taking notes on key concepts.
-
Implement the secure coding practices discussed in the book in a sample project.
OWASP Top Ten Vulnerability Exercises
Show steps
Reinforce your knowledge of the OWASP Top Ten vulnerabilities through hands-on exercises.
Show steps
-
Find vulnerable code examples online for each OWASP Top Ten vulnerability.
-
Attempt to exploit each vulnerability in a controlled environment.
-
Implement fixes for each vulnerability to understand how to prevent them.
Four other activities
Expand to see all activities and additional details
Show all seven activities
Write a Blog Post on Secure Coding
Show steps
Solidify your understanding of secure coding by explaining key concepts in a blog post.
Show steps
-
Choose a specific secure coding topic covered in the course.
-
Research the topic thoroughly and gather relevant information.
-
Write a clear and concise blog post explaining the topic and its importance.
-
Publish the blog post on a platform like Medium or your personal website.
Secure Web Application Project
Show steps
Apply secure coding principles by building a web application with security in mind from the start.
Show steps
-
Design a web application with specific security requirements.
-
Implement authentication and authorization mechanisms.
-
Protect against common web vulnerabilities like XSS and SQL injection.
-
Conduct security testing and code reviews to identify and fix vulnerabilities.
Study 'The Web Application Hacker's Handbook'
Show steps
Enhance your knowledge of web application security vulnerabilities and exploitation techniques.
View
Ethical Hacking and Web Hacking Handbook and...
on Amazon
Show steps
-
Read the book, focusing on the exploitation techniques.
-
Practice identifying and exploiting vulnerabilities in a lab environment.
Contribute to a Secure Coding Project
Show steps
Gain practical experience by contributing to an open-source project focused on secure coding.
Show steps
-
Find an open-source project related to secure coding on platforms like GitHub.
-
Identify a bug or feature related to security that you can contribute to.
-
Submit a pull request with your changes and address any feedback from the project maintainers.
Review Cryptography Fundamentals
Show steps
Reinforce your understanding of cryptography, which is essential for secure coding practices covered in the course.
Browse courses on
Cryptography
Show steps
- Review basic encryption algorithms and their use cases.
- Study hashing and salting techniques for password storage.
- Understand the differences between symmetric and asymmetric encryption.
Read 'Writing Secure Code'
Show steps
Deepen your understanding of secure coding principles with a comprehensive guide.
View
Liber Nox
on Amazon
Show steps
- Read the book cover to cover, taking notes on key concepts.
- Implement the secure coding practices discussed in the book in a sample project.
OWASP Top Ten Vulnerability Exercises
Show steps
Reinforce your knowledge of the OWASP Top Ten vulnerabilities through hands-on exercises.
Show steps
- Find vulnerable code examples online for each OWASP Top Ten vulnerability.
- Attempt to exploit each vulnerability in a controlled environment.
- Implement fixes for each vulnerability to understand how to prevent them.
Write a Blog Post on Secure Coding
Show steps
Solidify your understanding of secure coding by explaining key concepts in a blog post.
Show steps
- Choose a specific secure coding topic covered in the course.
- Research the topic thoroughly and gather relevant information.
- Write a clear and concise blog post explaining the topic and its importance.
- Publish the blog post on a platform like Medium or your personal website.
Secure Web Application Project
Show steps
Apply secure coding principles by building a web application with security in mind from the start.
Show steps
- Design a web application with specific security requirements.
- Implement authentication and authorization mechanisms.
- Protect against common web vulnerabilities like XSS and SQL injection.
- Conduct security testing and code reviews to identify and fix vulnerabilities.
Study 'The Web Application Hacker's Handbook'
Show steps
Enhance your knowledge of web application security vulnerabilities and exploitation techniques.
View
Ethical Hacking and Web Hacking Handbook and...
on Amazon
Show steps
- Read the book, focusing on the exploitation techniques.
- Practice identifying and exploiting vulnerabilities in a lab environment.
Contribute to a Secure Coding Project
Show steps
Gain practical experience by contributing to an open-source project focused on secure coding.
Show steps
- Find an open-source project related to secure coding on platforms like GitHub.
- Identify a bug or feature related to security that you can contribute to.
- Submit a pull request with your changes and address any feedback from the project maintainers.
Career center
Application Security Engineer
Source Code Auditor
Security Software Engineer
DevSecOps Engineer
Software Developer
Web Application Developer
Cryptography Engineer
Information Security Analyst
Penetration Tester
Vulnerability Assessor
Security Operations Center Analyst
Cloud Security Engineer
Information Security Manager
Security Consultant
Security Architect
Reading list
Save
Share
Similar courses
OpenCourser helps millions of learners each year. People visit us to learn workspace skills, ace their exams, and nurture their curiosity.
Our extensive catalog contains over 50,000 courses and twice as many books. Browse by search, by topic, or even by career interests. We'll match you to the right resources quickly.
Find this site helpful? Tell a friend about us.
We're supported by our community of learners. When you purchase or subscribe to courses and programs or purchase books, we may earn a commission from our partners.
Your purchases help us maintain our catalog and keep our servers humming without ads.
Thank you for supporting OpenCourser.
