Developing Secure Software Fundamentals

Practical fundamentals of developing secure software for developers, DevOps professionals, and software engineers.

Modules: 8
Level: Foundation to practitioner
Formats: Online package, classroom

Modern software is under constant attack. From web applications to cloud services and IoT devices, the systems we build face a growing volume of increasingly sophisticated threats. Yet many software developers have never been taught how to effectively counter those attacks.

This course closes that gap. Rather than treating security as a separate concern to be handed to specialists, it embeds security thinking into the practices that developers already use every day: requirements analysis, design, implementation, testing, and deployment. The focus is on actionable techniques, not abstract theory — practical steps that can be taken even with limited resources.

Who it is for

Software developers, DevOps professionals, software engineers, and web application developers. No prior security training is assumed.

What you will learn

Apply core security concepts and terminology, including confidentiality, integrity, availability, and privacy requirements such as the GDPR.
Manage risk and build a threat model with STRIDE, and turn it into clear security requirements.
Design systems that are inherently easier to secure, using least privilege, defence in depth, and secure defaults.
Avoid the implementation mistakes behind the most common vulnerability classes — injection, memory safety, and unvalidated input.
Choose and apply the right verification techniques: static and dynamic analysis, fuzz testing, and security code review.
Use cryptography correctly and avoid the usual pitfalls.
Operate software securely after release, covering vulnerability disclosure, incident response, and supply chain security.

Course outline

Each module is divided into short sections, and ends with a knowledge-check quiz so learners can assess their own progress. Every section also works as a standalone reference.

Module 1: Basics

The core concepts and terminology that underpin security: security objectives such as confidentiality, integrity, and availability, privacy requirements including the GDPR, how vulnerabilities are classified and tracked, secure development processes, and the protect-detect-respond model.

Sections

Motivation
Key concepts
Development processes
Protect, detect, respond
Measuring progress and setting targets
Knowledge check

Module 2: Risk management, threat modelling, and requirements

Risk management as the foundation for building secure software. Introduces threat modelling using the STRIDE approach and walks through how to define clear security requirements based on common security objectives.

Sections

Risk management
Threat modelling
Setting security requirements
Knowledge check

Module 3: Secure design

Fundamental secure design principles that help you build systems which are inherently easier to secure: least privilege, defence in depth, input validation strategies, secure defaults, secure design patterns, secure interfaces, selecting external technologies, and security design review.

Sections

Secure design principles
Knowledge check

Module 4: Implementation

Common implementation-level vulnerabilities and how to avoid them: input validation, injection attacks, memory safety, minimising attack surface, handling output safely, and other practical coding practices that reduce the attack surface of your software.

Sections

Implementation practices
Knowledge check

Module 5: Documentation

The role of documentation in secure software development, including user-facing product documentation, internal technical documentation, and documentation reviews — supporting users in operating the software securely.

Sections

Documentation practices
Knowledge check

Module 6: Verification

Testing and analysis techniques for finding vulnerabilities before attackers do: static analysis, software composition analysis, dynamic analysis, fuzz testing, web application scanners, penetration testing, and how to organise security testing as part of the development workflow.

Sections

Verification techniques
Knowledge check

Module 7: Cryptography

A practical introduction to cryptography for software developers: when and how to use cryptographic primitives correctly, and the common pitfalls to avoid.

Sections

Cryptography fundamentals
Knowledge check

Module 8: Operations

Secure deployment and operational practices, including vulnerability disclosure, incident response, supply chain security, and keeping systems secure after release.

Sections

Operational security
Knowledge check

How to take this course

Online learning package

Self-paced, taken whenever it suits the learner, with a knowledge check at the end of every module. Also available as a SCORM package for your own learning management system.

Classroom training

Delivered on site or remotely by an experienced Cyberismo consultant, with the emphasis of each module tailored to your audience, your products, and your obligations. Priced per engagement.

You can read through the complete content of this course in our online service before deciding whether to purchase it. Access to the preview service is licensed per customer — get in touch and we will set it up for your organisation.

Ask for preview access

Course provenance

This course was developed by amending the Developing Secure Software course by the Open Source Security Foundation (OpenSSF), a project of the Linux Foundation focused on securing the open source ecosystem. Cyberismo extended the original material, added modules, and added knowledge checks and exams. The original material is released under the Creative Commons Attribution 4.0 licence (CC BY 4.0).

Other Cyberismo courses

EU Cyber Resilience Act (CRA) — A structured and practical introduction to the EU Cyber Resilience Act — from the regulatory rationale to what it means for your product development.
Vulnerability Management — Establish and operate a vulnerability management process for software products, based on IEC 62443-4-1.