Staying Ahead of the Threatscape

With 180+ courses, Security Innovation has the most expansive and current software security curriculum in the industry. And just like the threat landscape, it’s constantly changing. That’s why we regularly release new and updated courses throughout the year.

Your voice matters

In addition to emerging trends, customer feedback largely drives course direction. If you would like a more detailed look at our roadmap, please contact us.

Planned Updates at a Glance

While slight changes might be made based on emerging threats and customer demand, our planned future releases include:

	OWASP Mobile & IoT		OWASP Application Security Verification Standard (ASVS)
	Securing browser-based JavaScript/Typescript applications		Application & infrastructure pen testing
	Securing Blockchain assets and its network		Hardening Linux/Unix systems
	Secure DevOps practices		PCI Secure Software Framework
	Supply chain security		Privacy principles

Released Course Updates

April 2020 Release

In an effort to help organizations improve the resiliency of cyber-security environments and reduce cyber-attack surfaces we’ve released courses focused on applying security to components of the infrastructure.

We also introduced Blockchain, Supply Chain, Cloud DevSecOps, Risk Management, Penetration Testing, and OWASP Mobile & IoT courses.

DES 210 – Hardening Linux/Unix Systems	DES 276 – OWASP M6: Mitigating Insecure Authorization
DES 305 – Protecting Existing Blockchain Assets	DES 277 – OWASP M7: Mitigating Client Code Quality
DES 306 – Creating a Secure Blockchain Network	DES 278 – OWASP M8: Mitigating Code Tampering
DSO 205 – Securing the COTS Supply Chain	DES 279 – OWASP M9: Mitigating Reverse Engineering
DSO 253 – DevSecOps in the AWS Cloud	DES 280 – OWASP M10: Mitigating Extraneous Functionality
DSO 254 – DevSecOps in the Azure Cloud	DES 281 – OWASP IoT1: Mitigating Weak, Guessable or Hardccoded Passwords
ENG 352 – Categorizing Systems and Information within the RMF	DES 282 – OWASP IoT2: Mitigating Insecure Network Services
ENG 353 – Selecting, Implementing and Assessing Controls within the RMF	DES 283 – OWASP IoT3: Mitigating Insecure Ecosystem Interfaces
ENG 354 – Authorizing and Monitoring System Controls within the RMF	DES 284 – OWASP IoT4: Mitigating Lack of Secure Update Mechanism
TST 301 – Infrastructure Penetration Testing	DES 285 – OWASP IoT5: Mitigating Use of Insecure or Outdated Components
TST 302 – Application Penetration Testing	DES 286 – OWASP IoT6: Mitigating Insufficient Privacy Protection
DES 271 – OWASP M1: Mitigating Improper Platform Usage	DES 287 – OWASP IoT7: Mitigating Insecure Data Transfer and Storage
DES 272 – OWASP M2: Mitigating Insecure Data Storage	DES 288 – OWASP IoT8: Mitigating Lack of Device Management
DES 273 – OWASP M3: Mitigating Insecure Communication	DES 289 – OWASP IoT9: Mitigating Insecure Default Settings
DES 274 – OWASP M4: Mitigating Insecure Authentication	DES 290 – OWASP IoT10: Mitigating Lack of Physical Hardening

View Course Catalog

January 2020 Release

NEW COURSES

In response to the increased complexity of modern software systems and attacker techniques getting more sophisticated, this quarter’s release focused primarily on specialized and advanced penetration testing best practices.

We also introduced DevOps, IoT and PCI courses.

DES 151 – Fundamentals of the PCI Secure SLC Standard	TST 355 – Penetration Testing for Authorization Vulnerabilities
DES 255 – Securing the IoT Update Process	TST 356 – Penetration Testing for XSS
DSO 201 – Fundamentals of Secure DevOps	TST 357 – Penetration Testing for Hardcoded Secrets
TST 202 – Penetration Testing Fundamentals	TST 358 – Penetration Testing Wireless Networks
TST 351 – Penetration Testing for TLS Vulnerabilities	TST 359 – Penetration Testing Network Infrastructure
TST 352 – Penetration Testing for Injection Vulnerabilities	TST 360 – Penetration Testing for Authentication Vulnerabilities
TST 353 – Penetration Testing for SQL Injection	DES 255 – Securing the IoT Update Process
TST 354 – Penetration Testing for Memory Corruption Vulnerabilities

View Course Catalog

October 2019 Release

NEW COURSES

As security increasingly becomes a business risk issue, we introduced fundamental courses around the NIST Risk Management Framework (RMF), with more specialized and implementation-specific coverage planned for 2020.

We also introduced our first vulnerability scanning course, which was based on increasing customers’ need to achieve the breadth of test coverage across their entire portfolio of software/IT systems.

ENG 251 – Risk Management Foundations
ENG 351 – Preparing the Risk Management Framework
TST 205 – Performing Vulnerability Scans

UPDATED COURSES

Most of these courses include content updates for newer versions of technologies, programming languages, and methodologies. Design updates include improved interactivity such as drag and drop code exercises and real-world scenarios:

COD 141 – Fundamentals of Database Security
COD 160 – Fundamentals of Embedded Software Development
COD 256 – Creating Secure Code Ruby on Rails Foundations
COD 257 – Creating Secure Python Web Applications
DES 101 – Fundamentals of Secure Architecture
DES 212 – Architecture Risk Analysis and Remediation
DES 311 – Creating Secure Application Architecture
ENG 205 – Fundamentals of Threat Modeling
ENG 211 – How to Create Application Security Design Requirements
ENG 311 – Attack Surface Analysis and Reduction
ENG 312 – How to Perform a Security Code Review

View Course Catalog

July 2019 Release

NEW COURSES

This quarter’s theme was largely driven by the increased attack surface of cloud-based systems. We released courses so that teams could better defend architecture, code, and infrastructure.

DES 216 – Protecting Cloud Infrastructure
DES 218 – Protecting Microservices, Containers, and Orchestration
COD 251 – Defending AJAX-enabled Web Applications
COD 214 – Creating Secure GO Applications
COD 258 – Creating Secure PHP Web Applications
COD 267 – Securing Python Microservices

Foreign language versions
We also released the following Chinese (Simplified), Spanish (Latin America) and French (France/European) courses:

AWA 102 – Software Security Concepts
DES 222 – Applying OWASP 2017 Mitigating Injection
DES 223 – Applying OWASP 2017 Mitigating Broken Authentication
DES 224 – Applying OWASP 2017 Mitigating Sensitive Data Exposure
DES 225 – Applying OWASP 2017 Mitigating XML External Entities
DES 226 – Applying OWASP 2017 Mitigating Broken Access Control
DES 227 – Applying OWASP 2017 Mitigating Security Misconfiguration
DES 228 – Applying OWASP 2017 Mitigating Cross-Site Scripting
DES 229 – Applying OWASP 2017 Mitigating Insecure Deserialization
DES 230 – Applying OWASP 2017 Mitigating Use of Components with Known Vulnerabilities
DES 231 – Applying OWASP 2017 Mitigating Insufficient Logging and Monitoring
ENG 312 – How to Perform a Security Code Review
TST 201 – Testing for CWE SANS Top 25 Software Errors
TST 222 – Testing for OWASP 2017: Injection
TST 223 – Testing for OWASP 2017: Broken Authentication
TST 224 – Testing for OWASP 2017: Sensitive Data Exposure
TST 225 – Testing for OWASP 2017: XML External Entities
TST 226 – Testing for OWASP 2017: Broken Access Control\TST 227 – Testing for OWASP 2017: Security Misconfiguration
TST 228 – Testing for OWASP 2017: Cross-Site Scripting
TST 229 – Testing for OWASP 2017: Insecure Deserialization
TST 230 – Testing for OWASP 2017: Use of Components with Known Vulnerabilities
TST 231 – Testing for OWASP 2017: Insufficient Logging and Monitoring

UPDATED COURSES

We updated many of our secure coding courses to provide more interactivity and updates to a specific syntax.

COD 110 – Fundamentals of Secure Mobile Development
COD 152 – Fundamentals of Secure Cloud Development
COD 242 – Creating Secure SQL Server and Azure Server Database Applications
COD 253 – Creating Secure AWS Cloud Applications
COD 254 – Creating Secure Azure Applications
COD 317 – Creating Secure iOS Code in Swift
COD 318 – Creating Secure Android Code in Java
COD 352 – Creating Secure JavaScript and jQuery Code

MODULARIZED COURSES

Creating Secure ASP.NET Applications Series

COD 308 – Common ASP.NET Vulnerabilities and Attacks
COD 309 – Securing ASP.NET MVC Applications

View Course Catalog

April 2019 Release

NEW COURSES

This quarter’s releases and updates were primarily focused on securing and defending infrastructure, with a focus on IoT.

COD 284 – Secure Java Coding
ENG 150 – Meeting Confidentiality, Integrity and Availability Requirements
DES 214 – Securing Infrastructure Architecture
DES 215 – Defending Infrastructure

UPDATED COURSES

Insecure IoT Series
We updated our Insecure IoT Series to help IT teams secure interfaces, communications, network services, firmware, and authentication/authorization schemes.

COD 225 – Insecure IoT Web Interfaces
COD 226 – Insecure IoT Authentication and Authorization
COD 227 – Insecure IoT Network Services
COD 228 – Insecure IoT Communications
COD 229 – Insecure IoT Mobile Interface
COD 230 – Insecure IoT Firmware

As part of our commitment to timely content, these courses have also undergone updates related to code syntax, design, and interactivity.

COD 262 – Fundamentals of Shell and Interpreted Language Security
COD 283 – Java Cryptography
TST 101 – Fundamentals of Security Testing
COD 261 – Threats to Scripts

MODULARIZED COURSES

PCI DSS Series
Previously one course, our PCI DSS v3.2 Best Practices for Developers course has been broken down into four micro-courses:

COD 246 – PCI DSS 3: Protecting Stored Cardholder Data
COD 247 – PCI DSS 4: Encrypting Transmission of Cardholder Data
COD 248 – PCI DSS 6: Develop & Maintain Secure Systems and Applications
COD 249 – PCI DSS 11: Regularly Test Security Systems and Processes

Fundamentals of SDLC Security Series
Rather than having to learn all concepts at once, we broke this down into more focused topics for streamlined training.

COD 102 – The Role of Software Security
COD 103 – Creating Software Security Requirements
COD 104 – Designing Secure Software
COD 105 – Secure Software Development
COD 106 – The Importance of Integration and Testing
COD 107 – Secure Software Deployment
COD 108 – Software Operations and Maintenance

Secure Scripting Series
Previously one course, we broke this down into four language-specific modules.

COD 263 – Secure Bash Scripting
COD 264 – Secure Perl Scripting
COD 265 – Secure Python Scripting
COD 266 – Secure Ruby Scripting

View Course Catalog