CyberSecurity & DevSecOps Expert: Develop, PenTest, and Deploy Secure Applications

THEORETICAL RECAP The attack surface is the sum of all points where an unauthorized actor can attempt to enter, extract, or manipulate data within a system. It includes entry points (HTTP endpoints, forms, APIs, file uploads, cookies, headers), data ...

The attack surface is one of the most important concepts in application security and threat modeling. Now that you have practiced drawing Data Flow Diagrams, applying the STRIDE methodology, building threat matrices, and evaluating applications again...

THEORETICAL RECAP Secure design principles are not abstract rules; they are decision filters you apply to concrete features. Least Privilege means every component (service account, container, database user, storage bucket) holds only the permissions ...

In the previous activities, you learned to model threats with STRIDE, to draw Data Flow Diagrams, to build a threat matrix, and to evaluate an application against secure design principles such as Least Privilege and Defense in Depth. This case study ...

THEORETICAL RECAP Secure design principles are foundational rules that guide how an application should be architected to minimize attack surface and contain damage when a component is compromised. The core principles you must know include: Least Priv...

In the previous activities, you learned to identify threats using the STRIDE method, to draw Data Flow Diagrams, and to build a complete threat matrix for a Blog application. Those activities focused on finding and classifying threats. This activity ...

## Project Overview This mini-project is the culmination of the 'Application Security Principles and Threat Modeling' chapter. You will consolidate everything you have practiced so far — components/assets identification, CIA, STRIDE, Data Flow Diagra...

THEORETICAL RECAP Threat modeling connects two artifacts you have already built: the Data Flow Diagram (DFD) and the STRIDE taxonomy. A DFD represents your application as external entities (users, third parties), processes (services, APIs), data stor...

THEORETICAL RECAP A Data Flow Diagram (DFD) is a graphical model that shows how data moves through an application. It relies on four core symbols: external entities (rectangles) representing actors or systems outside your control (users, third-party ...

A Data Flow Diagram, often abbreviated as DFD, is a visual representation of how information moves through an application or a system. In threat modeling, it is the foundation on which everything else is built. Before you can apply STRIDE, identify a...

THEORETICAL RECAP STRIDE is a threat modeling framework that classifies threats into six categories: Spoofing (impersonating an identity), Tampering (altering data or code), Repudiation (denying an action without traceability), Information Disclosure...

THEORETICAL RECAP STRIDE is a threat classification model created by Microsoft that maps six threat categories to the security properties they violate: Spoofing (breaks Authentication), Tampering (breaks Integrity), Repudiation (breaks Non-repudiatio...

The STRIDE method is a structured approach to threat modeling. It was developed at Microsoft to help teams systematically identify the ways an application or system can be attacked. You have already studied why we model threats, how to break an appli...

THEORETICAL RECAP Threat modeling always starts with understanding what you are protecting. Before you can identify threats, you must decompose the application into its components. A component is any distinct part of the system that stores, processes...

Threat modeling is a structured way of thinking about what can go wrong with an application before attackers find out for you. In the previous activities, you learned about assets (things worth protecting), the Confidentiality, Integrity and Availabi...

THEORETICAL RECAP The OWASP Top 10 is a consensus-based, regularly updated list of the ten most critical web application security risks. It is not a checklist of individual bugs but a set of risk categories, each grouping many concrete weaknesses. Th...

The OWASP Top 10 is a reference document published by the Open Worldwide Application Security Project, a nonprofit foundation dedicated to improving software security. This document lists the ten most critical security risks for web applications. It ...

THEORETICAL RECAP The CIA triad describes three security properties every asset can require: Confidentiality (only authorized parties can read the data), Integrity (data cannot be altered or destroyed without authorization or detection), and Availabi...

In the previous activities you learned the essential vocabulary of security — asset, threat, vulnerability, risk — and you explored the three foundational properties of information security: Confidentiality, Integrity, and Availability. You also prac...

In the previous activities, you learned the essential vocabulary of security: asset, threat, vulnerability, and risk. You also practiced locating assets inside a simple application such as a Todo List. Now we build on that foundation with the single ...

THEORETICAL RECAP In threat modeling, an 'asset' is anything of value that an attacker might want to steal, alter, destroy, or misuse — and that you must therefore protect. Assets are not only files or databases; they include data (user credentials, ...

Welcome to the first true building block of application security. Before you can defend an application, run a penetration test, or set up a secure delivery pipeline, you must master a small set of words used every single day by security professionals...

Welcome to the chapter on Application Security Principles and Threat Modeling. This chapter is the foundation of the entire training path that will turn you into a CyberSecurity and DevSecOps professional. Before you learn how to attack applications,...

This chapter closes the module dedicated to advanced Linux for security. You have travelled a long way: from user and group management, sudoer configuration, and the creation of restricted accounts, to writing executable scripts scheduled with cron, ...

## Project Overview In this mini-project, you will apply a complete security hardening checklist to a Linux virtual machine (VM) in a lab environment. This project consolidates every skill covered in the 'Linux advanced for security' chapter: user an...