Course Syllabus

Module 1 – Foundations & Secure SDLC (5 h)

Topics: CIA triad, defense-in-depth, security in SDLC, OWASP ASVS
Description: Introduce key security principles, secure design integration, and threat modeling frameworks
Features: Real-world breach case studies & hands-on threat-model exercises.

Module 2 – Web Fundamentals & Configuration (4 h)

Topics: HTTP/HTTPS, environment isolation, config hardening, secure headers
Description: Build secure foundations to prevent misconfiguration and protocol-based attacks .
Features: Labs on HTTP analysis, header scanners, secure server setup.

Module 3 – Input Handling & Validation (5 h)

Topics: SQLi, XSS, CSRF, command injection, input sanitization patterns
Description: Dive deep into OWASP Top 10 input flaws and defense techniques .
Features: Exploitation walkthroughs and coding remediation labs.

Module 4 – Authentication & Session Management (5 h)

Topics: Auth logic, MFA, session tokens, cookie security, JWT misuse
Description: Secure identity processes and manage sessions safely .
Features: Configuration labs for OAuth, JWT, MFA, and token validation.

Module 5 – Access Control & Authorization (4 h)

Topics: RBAC/ABAC, IDOR, ACL implementation, privilege escalation
Description: Implement fine-grained access policies and prevent bypasses.
Features: Access matrix design workshops and test-case labs.

Module 6 – API & Microservices Security (5 h)

Topics: REST/SOAP security, API auth, input validation, rate limiting
Description: Secure modern app architectures, from endpoints to service composition .
Features: API attack simulation and defense configuration.

Module 7 – Secure Coding & DevSecOps (4 h)

Topics: Code review, SAST/DAST, integrate security CI/CD, dependency management
Description: Shift left with developer tooling, pipeline enforcement & SBOM.
Features: Static analysis tool labs, dev pipeline integration demos.

Module 8 – Penetration Testing & Bug Bounty (5 h)

Topics: Recon, scanning, exploitation, reporting, OWASP methodology
Description: Understand adversary techniques via ethical attacks .
Features: Hands-on pentest labs with DVWA, Burp Suite, and reporting templates.

Module 9 – Emerging Trends & Capstone (2 h)

Topics: Cloud-native security, serverless concerns, supply-chain risk, zero-trust
Description: Explore trends and apply learning in a combined mini-project .
Features: Group capstone—design, test, and secure a sample app.