<?xml version="1.0" standalone="no" ?>

<!--  AIT_Security_SDLC_1D.xml	Course Outline in XML format
 *
 * Copyright 2012 Affinity IT Training, LLC. All Rights Reserved.
 *
 -->

<!DOCTYPE FAI:CourseOutline SYSTEM "FAI_CourseOutline.dtd">

<?xml-stylesheet type="text/xsl" href="FAI_CourseOutline.xsl" ?>	

<FAI:CourseOutline FAI:link="AIT_Security_SDLC_1D.xml"
     xmlns:FAI="http://www.fisher-assoc.com/DTDs/FAI_CourseOutline.dtd" >

  <FAI:CourseTitle FAI:level="Intermediate"  FAI:code="AIT_SEC_SDLC">
    Application Security and the SDLC: A Holistic Approach
  </FAI:CourseTitle>  

  <FAI:CourseCategory>CyberSec</FAI:CourseCategory>
  <FAI:CourseCategory>Requirements</FAI:CourseCategory>
  <FAI:CourseCategory>Design</FAI:CourseCategory>
  <FAI:CourseCategory>Development</FAI:CourseCategory>

  <FAI:SummaryInfo>

    <FAI:CourseDesc FAI:version="X.X" >
	This course 
	describes how to integrate Security 
	throughout the Software Development Lifecycle (SDLC),
	from the earliest stages of the project all the way to maintenance and decommissioning.
	It presents a comprehensive understanding of 
	what to do at each stage 
	of the project and development process to assure 
	robust security is an integral part of your applications.
    </FAI:CourseDesc>

    <FAI:CourseDuration>
	1 Day
    </FAI:CourseDuration>

    <FAI:CourseAudience>
    	Software developers, Business Analysts,
    	Project Managers, and security staff
    	seeking to gain a practical understanding of 
    	key security considerations at each step 
    	of the project and development lifecycle.
    	Those seeking to improve the security of their applications 
    	through a disciplined and holistic approach to software development.
    </FAI:CourseAudience>

    <FAI:CourseObjectives>

      <FAI:Objective FAI:desc="Recognize the opportunities to introduce and validate security throughout the SDLC" />
      <FAI:Objective FAI:desc="Understand how to capture, communicate, and validate Security Requirements" />
      <FAI:Objective FAI:desc="Be familiar with Best Practices in secure application design" />
      <FAI:Objective FAI:desc="Be prepared to review software designs for vulnerabilities" />
      <FAI:Objective FAI:desc="Be familiar with how to avoid introducing vulnerabilities during software construction" />
      <FAI:Objective FAI:desc="Be prepared to test application security" />
      <FAI:Objective FAI:desc="Be familiar with security considerations during system Deployment" />
      <FAI:Objective FAI:desc="Understand how to maintain robust application security during the maintenance phase" />
      <FAI:Objective FAI:desc="Be familiar with security considerations during system Decommissioning" />

    </FAI:CourseObjectives>

    <FAI:CourseSetupList>
    </FAI:CourseSetupList>    

    <FAI:CourseTextList>

      <FAI:Text  FAI:title="Course Workbook" />

    </FAI:CourseTextList>    

    <FAI:CoursePrerequisiteList>
         <FAI:CoursePrerequisite FAI:title="A solid understanding of Software Development Lifecycle (SDLC)" />
    </FAI:CoursePrerequisiteList>    

  </FAI:SummaryInfo>  

  <FAI:TopicList>
      <FAI:SuperTopic FAI:title="Introduction" >
        <FAI:Topic FAI:title="Welcome" />
        <FAI:Topic FAI:title="Course Objectives" />
        <FAI:Topic FAI:title="Course Overview" />
        <FAI:Topic FAI:title="Motivation for Application Security" />
        <FAI:Topic FAI:title="Application Security in Perspective" />
        <FAI:Topic FAI:title="The Software Development Lifecycle (SDLC)" />
        <FAI:Topic FAI:title="Quiz" />
      </FAI:SuperTopic>
  
		
   
      <FAI:SuperTopic FAI:title="Security and Project Initiation" >
        <FAI:Topic FAI:title="Security and Project Initiation" />
        <FAI:Topic FAI:title="Project Charter: Rough Estimate" />
        <FAI:Topic FAI:title="Project Charter: Business Case" />
        <FAI:Topic FAI:title="Investments and Returns" />
        <FAI:Topic FAI:title="Investments and Time" />
        <FAI:Topic FAI:title="Economic Value Added (EVA)" />
        <FAI:Topic FAI:title="Net Present Value (NPV)" />
        <FAI:Topic FAI:title="A Project as an Investment" />
        <FAI:Topic FAI:title="Tangible and Intangible Benefits" />
        <FAI:Topic FAI:title="Investments and Risk" />
        <FAI:Topic FAI:title="The ROI of Application Security" />
        <FAI:Topic FAI:title="Business Case Review" />
        <FAI:Topic FAI:title="Constraints, Assumptions, and Issues" />
        <FAI:Topic FAI:title="Lab Exercise: Finding Motivation" />
        <FAI:Topic FAI:title="Quiz" />
      </FAI:SuperTopic>
 
      <FAI:SuperTopic FAI:title="Gathering Security Requirements" >
        <FAI:Topic FAI:title="Gathering Security Requirements" />
        <FAI:Topic FAI:title="Access Control: Authentication" />
        <FAI:Topic FAI:title="Access Control: Authorization" />
        <FAI:Topic FAI:title="Password Management" />
        <FAI:Topic FAI:title="Client / Server Input Validation" />
        <FAI:Topic FAI:title="Handling Malformed Input" />
        <FAI:Topic FAI:title="Data Handling" />
        <FAI:Topic FAI:title="System Integrity and Updates" />
        <FAI:Topic FAI:title="System Interfaces" />
        <FAI:Topic FAI:title="System Monitoring" />
        <FAI:Topic FAI:title="Infrastructure Requirements" />
        <FAI:Topic FAI:title="Accountability and Logging" />
        <FAI:Topic FAI:title="Avoiding Common Vulnerabilities" />
        <FAI:Topic FAI:title="The Security Requirements Review" />
        <FAI:Topic FAI:title="Lab Exercise: A Simple Form" />
        <FAI:Topic FAI:title="Quiz" />
      </FAI:SuperTopic>
  
 
      <FAI:SuperTopic FAI:title="Designing Secure Software" >
        <FAI:Topic FAI:title="Designing Secure Software" />
        <FAI:Topic FAI:title="Secure Application Design" />
        <FAI:Topic FAI:title="Finite State Machine (FSM) Modeling" />
        <FAI:Topic FAI:title="UML: State Machine Diagram" />
        <FAI:Topic FAI:title="Finite State Machine and Security" />
        <FAI:Topic FAI:title="State Management" />
        <FAI:Topic FAI:title="Data Management" />
        <FAI:Topic FAI:title="Application Security Configuration" />
        <FAI:Topic FAI:title="Data Sanitization" />
        <FAI:Topic FAI:title="Recognizing and Handling Invalid Transitions" />
        <FAI:Topic FAI:title="A Security Manager" />
        <FAI:Topic FAI:title="Direct Object References" />
        <FAI:Topic FAI:title="Avoiding Common Vulnerabilities" />
        <FAI:Topic FAI:title="The Security Design Review" />
        <FAI:Topic FAI:title="Lab Exercise: Affairs of State" />
        <FAI:Topic FAI:title="Quiz" />
      </FAI:SuperTopic>
  
      <FAI:SuperTopic FAI:title="Constructing Secure Software" >
        <FAI:Topic FAI:title="Constructing Secure Software" />
        <FAI:Topic FAI:title="Implementation Errors" />
        <FAI:Topic FAI:title="Numeric Overflow and Wrap Around" />
        <FAI:Topic FAI:title="Buffer Overflow" />
        <FAI:Topic FAI:title="Misuse of Pointers" />
        <FAI:Topic FAI:title="Format Strings" />
        <FAI:Topic FAI:title="Unsafe Functions" />
        <FAI:Topic FAI:title="Session Management" />
        <FAI:Topic FAI:title="Dynamic SQL" />
        <FAI:Topic FAI:title="Hardcoded Credentials" />
        <FAI:Topic FAI:title="The Security Code Review" />
        <FAI:Topic FAI:title="Lab Exercise: The Security Code Review" />
        <FAI:Topic FAI:title="Quiz" />
      </FAI:SuperTopic>
  
       <FAI:SuperTopic FAI:title="Testing Application Security" >
        <FAI:Topic FAI:title="Testing Application Security" />
        <FAI:Topic FAI:title="Testing Concepts and Terms" />
        <FAI:Topic FAI:title="Security Requirements Test Cases" />
        <FAI:Topic FAI:title="Security Testing Tools" />
        <FAI:Topic FAI:title="Internal Penetration Testing" />
        <FAI:Topic FAI:title="Miscellaneous" />
        <FAI:Topic FAI:title="Lab Exercise:  Discovering Test Cases" />
        <FAI:Topic FAI:title="Quiz" />
      </FAI:SuperTopic>
  
       <FAI:SuperTopic FAI:title="System Deployment, Maintenance, and Decommissioning" >
        <FAI:Topic FAI:title="System Deployment" />
        <FAI:Topic FAI:title="System Deployment Considerations" />
        <FAI:Topic FAI:title="System Maintenance" />
        <FAI:Topic FAI:title="System Maintenance Considerations" />
        <FAI:Topic FAI:title="System Decommissioning" />
        <FAI:Topic FAI:title="Decommissioning Considerations" />
        <FAI:Topic FAI:title="Lab Exercise: Maintaining Security" />
        <FAI:Topic FAI:title="Quiz" />
      </FAI:SuperTopic>

  </FAI:TopicList>

  <FAI:Appendix FAI:title="Quiz Answers " />
  <FAI:Appendix FAI:title="Lab Solutions" />
   
</FAI:CourseOutline>

