CyberSecurity & DevSecOps Expert: Develop, PenTest, and Deploy Secure Applications

Ilaria Digital School

Become a CyberSecurity & DevSecOps Specialist: Understand the risks of an application to prioritize tests and corrections; Conduct a Web/API application Pentest (recognition, tests, proofs) on an authorized perimeter; Identify and validate major vulnerabilities (auth/session, access control, access control, injections, auth/session, access control, access, injection, injection, CSRF, injections, CSRF, injections, CSRF, injections, CSRF, injections, CSRF, injections, CSRF, injections, CSRF, injections, CSRF, injections, CSRF, injections, CSRF, injections, CSRF, injections, CSRF, injection); Master the main tools such as Nmap, Wireshark, Metasploit, Python scripting; Correct flaws properly and set up non-regression tests; Produce a vulnerability report; Set up a secure delivery chain: CI/CD, SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), SCA (Software Composition Analysis), SCA (Software Composition Analysis), containers.

Play

Open in

20 episodes
Avg 15 min
English

Episodes 20

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Wednesday · 15 min
Red thread 2 — Model and document the threats of a Weather API
## Context You are hired as a junior security analyst for a startup that publishes a public REST **Weather API**. This API exposes endpoints such as `GET /weather?city=`, `GET /forecast?lat=&lon=`, `POST /users` (registration), `POST /login` (authent...
Wednesday · 15 min
Model documentation and versioning best practices
Threat modeling is only useful if the results are captured, shared, and kept up to date. A threat model that lives in someone's head or in an outdated diagram provides no value to the team. This chapter explains how to document a threat model properl...
Wednesday · 15 min
Getting started with OWASP Threat Dragon on the Blog project
THEORETICAL RECAP Threat modeling is the structured practice of identifying, communicating, and understanding threats and mitigations within the context of protecting an application. OWASP Threat Dragon is a free, open-source tool that lets you draw ...
Wednesday · 15 min
Tools for modeling threats — Threat Dragon, Draw.io, others
Threat modeling is only as effective as the tools you use to draw, document, and share it. Up to now, you have learned the concepts: confidentiality, integrity and availability (the CIA triad), the STRIDE categories, attack surface analysis, security...
Tuesday · 15 min
Adapting the checklist to a third party public API
THEORETICAL RECAP A security test checklist derived from a threat model is not a fixed artifact: it must be adapted to the specific context of the target. A third-party public API differs sharply from an internal service. Key definitions: a 'third-pa...
Tuesday · 15 min
Case study — Transforming a STRIDE threat into an automated test scenario
This case study connects everything you have already studied: the STRIDE threat categories, the attack surface, the security principles, the OWASP Risk Rating methodology, the correction and testing heuristics, and the security checklist. The goal he...
Tuesday · 15 min
Develop a test checklist based on the threat model
THEORETICAL RECAP A threat model is a structured description of what can go wrong in an application: assets to protect, entry points (attack surface), threats (typically classified via STRIDE: Spoofing, Tampering, Repudiation, Information disclosure,...
Tuesday · 15 min
From modeling to test plans — a practical and practical bridge
So far, you have learned to identify an attack surface, to apply security principles, to model threats with STRIDE, and to prioritize risks using the OWASP Risk Rating Methodology. All of this is analytical work. But analysis alone changes nothing ab...
Monday · 15 min
Visual summary — Mental map of the concepts seen
This chapter closes the section on Application Security Principles and Threat Modeling. Its purpose is not to introduce new material, but to assemble everything you have studied into a single coherent mental map. A mental map is a way of representing...
Monday · 15 min
Varying the scoring on an e-commerce API
THEORETICAL RECAP Risk scoring turns a vague sense of danger into a comparable number so you can prioritize corrections and tests. The OWASP Risk Rating Methodology models Risk = Likelihood x Impact. Likelihood is estimated from Threat Agent factors ...
September 18 · 15 min
Heuristics to prioritize corrections and tests
In the previous activities, you learned to identify the attack surface of an application, to map threats using the STRIDE model, to apply secure design principles, and to score threats with the OWASP Risk Rating Methodology (probability versus impact...
September 18 · 15 min
Score previous threats with OWASP Risk Rating
THEORETICAL RECAP The OWASP Risk Rating Methodology estimates the severity of a threat by combining two dimensions: Likelihood (how probable an attack is) and Impact (the damage it causes). Each dimension is broken into factors scored from 0 to 9. Li...
September 17 · 15 min
OWASP Risk Rating Methodology — probability vs impact
In the previous activities, you built a threat matrix for the Blog, mapped its attack surface, and applied secure design principles such as Least Privilege and Defense in Depth. You also practiced classifying threats with STRIDE. Now that you can ide...
September 16 · 15 min
Map the Blog's attack surface
THEORETICAL RECAP The attack surface is the sum of all points where an unauthorized actor can attempt to enter, extract, or manipulate data within a system. It includes entry points (HTTP endpoints, forms, APIs, file uploads, cookies, headers), data ...
September 15 · 15 min
Attack surface — definition and identification
The attack surface is one of the most important concepts in application security and threat modeling. Now that you have practiced drawing Data Flow Diagrams, applying the STRIDE methodology, building threat matrices, and evaluating applications again...
September 15 · 15 min
Adapting the principles to a file upload microservice
THEORETICAL RECAP Secure design principles are not abstract rules; they are decision filters you apply to concrete features. Least Privilege means every component (service account, container, database user, storage bucket) holds only the permissions ...
September 14 · 15 min
Case study — Incident due to the absence of Least Privilege
In the previous activities, you learned to model threats with STRIDE, to draw Data Flow Diagrams, to build a threat matrix, and to evaluate an application against secure design principles such as Least Privilege and Defense in Depth. This case study ...
September 11 · 15 min
Evaluate the Blog against the principles of secure design
THEORETICAL RECAP Secure design principles are foundational rules that guide how an application should be architected to minimize attack surface and contain damage when a component is compromised. The core principles you must know include: Least Priv...
September 11 · 15 min
Secure Design Principles — Least Privilege & Defense in Depth
In the previous activities, you learned to identify threats using the STRIDE method, to draw Data Flow Diagrams, and to build a complete threat matrix for a Blog application. Those activities focused on finding and classifying threats. This activity ...
September 10 · 15 min
Red thread — Building a complete threat matrix for the Blog
## Project Overview This mini-project is the culmination of the 'Application Security Principles and Threat Modeling' chapter. You will consolidate everything you have practiced so far — components/assets identification, CIA, STRIDE, Data Flow Diagra...

Showing 1–20 of 20 episodes