Overview
The Software Architect learning path includes a variety of security courses that will vary depending on whether you are seeking core, advanced or elite paths. It is designed for those making design choices, coordinating and overseeing technical standards and includes software coding standards, tools, and platforms.
Concepts covered include:
- Secure software architecture best practices that can be applied to early phase SDLC activities
- Defensive coding techniques
- Avoiding systemic issues found in insecure software
- AWA 101 – Fundamentals of Application Security
- AWA 102 – Secure Software Concepts (UPDATE PENDING)
- COD 102 – The Role of Software Security
- COD 103 – Creating Software Security Requirements
- COD 104 – Designing Secure Software
- COD 105 – Secure Software Development (UPDATE PENDING)
- COD 106 – The Importance of Software Integration and Testing
- COD 107 – Secure Software Deployment
- COD 108 – Software Operations and Maintenance
- COD 141 – Fundamentals of Database Security
- DES 101 – Fundamentals of Secure Architecture
- DES 151 – Fundamentals of the PCI Secure SLC Standard
- LAB 120 Identifying XML Injection (NEW)
- API 210 Mitigating APIs Lack of Resources & Rate Limiting (COMING SOON)
- API 211 Mitigating APIs Broken Object Level Authorization (COMING SOON)
- COD 252 – Securing Google Platform Applications & Data
- COD 261 – Threats to Scripts
- COD 267 – Securing Python Microservices
- DES 202 – Cryptographic Suite Services: Encoding, Encrypting & Hashing
- DES 203 – Cryptographic Components: Randomness, Algorithms, and Key Management
- DES 204 – Role of Cryptography in Application Development
- DES 205 – Message Integrity Cryptographic Functions
- DES 207 – Mitigating OWASP API Security Top 10
- DES 209 Authentication and Lifecycle Management (COMING SOON)
- DES 212 – Architecture Risk Analysis & Remediation
- DES 214 – Securing Infrastructure Architecture
- DES 215 – Defending Infrastructure
- DES 216 – Protecting Cloud Infrastructure
- DES 217 – Securing Terraform Infrastructure and Resources
- DES 218 – Protecting Microservices, Containers, and Orchestration
- DES 222 – Applying OWASP 2017: Mitigating Injection
- DES 223 – Applying OWASP 2017: Mitigating Broken Authentication
- DES 224 – Applying OWASP 2017: Mitigating Sensitive Data Exposure
- DES 225 – Applying OWASP 2017: Mitigating XML External Entities
- DES 226 – Applying OWASP 2017: Mitigating Broken Access Control
- DES 227 – Applying OWASP 2017: Mitigating Security Misconfiguration
- DES 228 – Applying OWASP 2017: Mitigating Cross Site Scripting (XSS)
- DES 229 – Applying OWASP 2017: Mitigating Insecure Deserialization
- DES 230 – Applying OWASP 2017: Mitigating Use of Components with Known Vulnerabilities
- DES 231 – Applying OWASP 2017: Mitigating Insufficient Logging & Monitoring Vulnerabilities
- DES 232 – Mitigating OWASP 2021 Injection (NEW)
- DES 233 – Mitigating OWASP 2021 Identification and Authentication Failures (NEW)
- DES 234 – Mitigating OWASP 2021 Cryptographic Failures (NEW)
- DES 235 Mitigating OWASP 2021 Insecure Design (NEW)
- DES 236 Mitigating OWASP 2021 Broken Access Control (NEW)
- DES 237 Mitigating OWASP 2021 Security Misconfiguration (NEW)
- DES 238 Mitigating OWASP 2021 Server-Side Request Forgery (SSRF) (NEW)
- DES 239 Mitigating OWASP 2021 Software and Data Integrity Failures (NEW)
- DES 240 Mitigating OWASP 2021 Vulnerable and Outdated Components (NEW)
- DES 241 Mitigating OWASP 2021 Security Logging and Monitoring Failures (NEW)
- DES 255 – Securing the IoT Update Process
- DES 260 – Fundamentals of IoT Architecture & Design
- DES 281 – OWASP IoT1: Mitigating Weak, Guessable or Hardcoded Passwords
- DES 282 – OWASP IoT2: Mitigating Insecure Network Services
- DES 283 – OWASP IoT3: Mitigating Insecure Ecosystem Interfaces
- DES 284 – OWASP IoT4: Mitigating Lack of Secure Update Mechanism
- DES 285 – OWASP IoT5: Mitigating Use of Insecure or Outdated Components
- DES 286 – OWASP IoT6: Mitigating Insufficient Privacy Protection
- DES 287 – OWASP IoT7: Mitigating Insecure Data Transfer and Storage
- DES 288 – OWASP IoT8: Mitigating Lack of Device Management
- DES 289 – OWASP IoT9: Mitigating Insecure Default Settings
- DES 290 – OWASP IoT10 Mitigating Lack of Physical Hardening
- DSO 201 – Fundamentals of Secure DevOps
- DSO 211 – Identifying Threats to Containers in a DevSecOps Framework
- DSO 212 Fundamentals of Zero Trust Security (COMING SOON)
- DSO 256 – DevSecOps in the Google Cloud Platform
- ENG 211 – How to Create Application Security Design Requirements
- ENG 251 – Risk Management Foundations
- LAB 114 Identifying Cookie Tampering (NEW)
- LAB 115 Identifying Reflective XSS (NEW)
- LAB 116 Identifying Forceful Browsing (NEW)
- LAB 117 Identifying Hidden Form Field (NEW)
- LAB 118 Identifying Weak File Upload Validation (NEW)
- LAB 119 Identifying Persistent XSS (NEW)
- LAB 220 Defending Against Hard-Coded Secrets (NEW)
- LAB 221 Defending C# Against SQL Injection (NEW)
- LAB 222 Defending Python Against SQL Injection (NEW)
- LAB 223 Defending Node.js Against SQL Injection (NEW)
- LABÂ 228 Defending Against Weak AES ECB Mode Encryption (Java) (COMING SOON)
- LABÂ 229 Defending Against Weak PRNG (Java) (COMING SOON)
- LAB 230 Defending Java Against XSS (NEW)
- LAB 231 Defending Python Against XSS (NEW)
- LAB 232 Defending C# Against XSS (NEW)
- LAB 233 Defending Node.js Against XSS (NEW)
- LABÂ 234 Defending Against Parameter Tampering (Java) (COMING SOON)
- LABÂ 235 Defending Against Plaintext Password Storage (Java) (COMING SOON)
- LAB 237 Defending Java from SQL Injection (NEW)
- LABÂ 238 Defending Against Weak AES ECB Mode Encryption (C#) (COMING SOON)
- LABÂ 239 Defending Against Weak PRNG (C#) (COMING SOON)
- LAB 240 Defending Java Against eXternal XML Entity (XXE) Vulnerabilities (NEW)
- LAB 241 Defending C# Against eXternal XML Entity (XXE) Vulnerabilities (NEW)
- LAB 242 Defending Node.js Against eXternal XML Entity (XXE) Vulnerabilities (NEW)
- LAB 243 Defending Python Against eXternal XML Entity (XXE) Vulnerabilities (NEW)
- LAB 244 Defending Java Against Security Misconfiguration (NEW)
- LABÂ 245 Defending Against Plaintext Password Storage (Node.js) (COMING SOON)
- LABÂ 246 Defending Against Weak AES ECB Mode Encryption (Node.js) (COMING SOON)
- LABÂ 247 Defending Against Weak PRNG (Node.js) (COMING SOON)
- LABÂ 248 Defending Against Parameter Tampering (Node.js) (COMING SOON)
- LABÂ 249 Defending Against Plaintext Password Storage (Python) (COMING SOON)
- LAB 250 Defending Against Parameter Tampering (C#) (COMING SOON)
- LAB 251 Defending Against Plaintext Password Storage (C#) (COMING SOON)
- LAB 252 Defending Against Weak AES ECB Mode Encryption (Python) (COMING SOON)
- LAB 253 Defending Against Weak PRNG (Python) (COMING SOON)
- LAB 254 Defending Against Parameter Tampering (Python) (COMING SOON)
- TST 206 – ASVS Requirements for Developers
- DES 311 – Creating Secure Application Architecture
- DSO 301 – Orchestrating Secure System and Service Configuration
- DSO 302- Automated Security Testing
- DSO 304 – Securing API Gateways in a DevSecOps Framework
- DSO 305 – Automating CI/CD Pipeline Compliance
- ENG 311 – Attack Surface Analysis & Reduction
- ENG 312 – How to Perform a Security Code Review
- ENG 351 – Preparing the Risk Management Framework
- ENG 352 – Categorizing Systems and Information within the RMF
- ENG 353 – Selecting, Implementing and Assessing Controls within the RMF
- ENG 354 – Authorizing and Monitoring System Controls within the RMF
- LAB 315 ATT&CK: Updating Vulnerable Java Web Application Server Software (NEW)
- LAB 321 ATT&CK: Password Cracking (NEW)
- LAB 323 ATT&CK: Exploiting Vulnerable Java Web Application Server Software (NEW)
- LAB 324 ATT&CK: Exploiting Java Web Application Server Misconfiguration (NEW)
- LAB 330 ATT&CK: Exploiting Java SQL Injection to Extract Password Hashes (NEW)
- SDT 302 Testing for Identification and Authentication Failures (NEW)
- TST 303 – Penetration Testing for Google Cloud Platform
- TST 304 – Penetration Testing for AWS Cloud
- TST 305 – Penetration Testing for Azure Cloud
Learning Path Details
Number of Courses: 125
Total Duration: 29 hours
Total CPE Credits: 35