CyberSecurity & DevSecOps Expert: Develop, PenTest, and Deploy Secure Applications

Why the law is your first tool In the previous activity, you saw that the only thing separating an ethical hacker from a criminal is authorisation. This lesson explains what that means in law. The commands, tools and techniques used by a penetration ...

Same techniques, opposite status In the previous activities you studied attackers, their motivations, attack families and how an incident unfolds from intrusion to investigation. Here is the key idea of this lesson. An ethical hacker uses exactly the...

Why follow an incident from start to finish You already have the basic vocabulary of cybersecurity. You can tell a threat from a vulnerability and a risk. You know who attacks and why, and which property of confidentiality, integrity and availability...

Phishing: attacking the human You now know how to name a threat, a vulnerability and a risk. You know who attacks and why, and which property is hit: confidentiality, integrity or availability (the CIA triad). This lesson adds the missing piece, whic...

Why security needs a clear target In the previous activities you learned to separate a threat, a vulnerability and a risk, and you met the attackers who exploit them. One question remains: what exactly is damaged when an attack succeeds? Cybersecurit...

Core Concepts Recap You have recently learned the crucial difference between threat, vulnerability, and risk. A threat is a potential cause of an unwanted incident, like a hacker. A vulnerability is a weakness in a system, such as outdated software. ...

Why you must know your attacker In the previous lesson, you learned to separate three words: a threat is what can cause harm, a vulnerability is the weakness that harm exploits, and a risk combines the likelihood of an attack with its impact. This le...

Why these three words matter In the welcome activity, you saw that cybersecurity protects information and the systems that carry it. To do that job, professionals use a precise vocabulary. Three words come up in every meeting, audit report and penetr...

Welcome to the Ethical Hacker and Cyber Defence course. You are starting from scratch, and that is fine. By the end of this path you will understand how systems and networks work, how attackers think, how defenders respond, and how to carry out a com...

## Context You are hired as a junior security analyst for a startup that publishes a public REST **Weather API**. This API exposes endpoints such as `GET /weather?city=`, `GET /forecast?lat=&lon=`, `POST /users` (registration), `POST /login` (authent...

Threat modeling is only useful if the results are captured, shared, and kept up to date. A threat model that lives in someone's head or in an outdated diagram provides no value to the team. This chapter explains how to document a threat model properl...

THEORETICAL RECAP Threat modeling is the structured practice of identifying, communicating, and understanding threats and mitigations within the context of protecting an application. OWASP Threat Dragon is a free, open-source tool that lets you draw ...

Threat modeling is only as effective as the tools you use to draw, document, and share it. Up to now, you have learned the concepts: confidentiality, integrity and availability (the CIA triad), the STRIDE categories, attack surface analysis, security...

THEORETICAL RECAP A security test checklist derived from a threat model is not a fixed artifact: it must be adapted to the specific context of the target. A third-party public API differs sharply from an internal service. Key definitions: a 'third-pa...

This case study connects everything you have already studied: the STRIDE threat categories, the attack surface, the security principles, the OWASP Risk Rating methodology, the correction and testing heuristics, and the security checklist. The goal he...

THEORETICAL RECAP A threat model is a structured description of what can go wrong in an application: assets to protect, entry points (attack surface), threats (typically classified via STRIDE: Spoofing, Tampering, Repudiation, Information disclosure,...

So far, you have learned to identify an attack surface, to apply security principles, to model threats with STRIDE, and to prioritize risks using the OWASP Risk Rating Methodology. All of this is analytical work. But analysis alone changes nothing ab...

This chapter closes the section on Application Security Principles and Threat Modeling. Its purpose is not to introduce new material, but to assemble everything you have studied into a single coherent mental map. A mental map is a way of representing...

THEORETICAL RECAP Risk scoring turns a vague sense of danger into a comparable number so you can prioritize corrections and tests. The OWASP Risk Rating Methodology models Risk = Likelihood x Impact. Likelihood is estimated from Threat Agent factors ...

In the previous activities, you learned to identify the attack surface of an application, to map threats using the STRIDE model, to apply secure design principles, and to score threats with the OWASP Risk Rating Methodology (probability versus impact...

THEORETICAL RECAP The OWASP Risk Rating Methodology estimates the severity of a threat by combining two dimensions: Likelihood (how probable an attack is) and Impact (the damage it causes). Each dimension is broken into factors scored from 0 to 9. Li...

In the previous activities, you built a threat matrix for the Blog, mapped its attack surface, and applied secure design principles such as Least Privilege and Defense in Depth. You also practiced classifying threats with STRIDE. Now that you can ide...

THEORETICAL RECAP The attack surface is the sum of all points where an unauthorized actor can attempt to enter, extract, or manipulate data within a system. It includes entry points (HTTP endpoints, forms, APIs, file uploads, cookies, headers), data ...

The attack surface is one of the most important concepts in application security and threat modeling. Now that you have practiced drawing Data Flow Diagrams, applying the STRIDE methodology, building threat matrices, and evaluating applications again...

THEORETICAL RECAP Secure design principles are not abstract rules; they are decision filters you apply to concrete features. Least Privilege means every component (service account, container, database user, storage bucket) holds only the permissions ...