Career capstone: application security engineer
You live through a real quarter of an application security engineer: design reviews, code reviews, scan results, an outside vulnerability report and working with developers.
Level 401 · 12 lessons · 12 practice labs
Lessons
Design and code
- Design review and threat model for a new feature
- A security-focused code review
- A SAST rule for the flaw found in review
- Short task: write security review comments on a pull request
Testing and findings
- DAST in the test environment and manual verification
- The weekly findings triage meeting
- A vulnerability report from an outside researcher
- Verifying the fix and adding a regression test
- Short task: draft a reply to the researcher and a security advisory
Team and reporting
- A half-hour secure coding session for the team
- The end-of-quarter report
- Capstone: an application security assessment of a product
Practice labs
- Map the new feature’s data flow and assets: List the flows, trust boundaries and data to protect from the design document.
- Write the threat model and requirements for the feature: Write one threat per flow and a testable requirement that answers it.
- Remove in design the gravest risk the review found: Show authorisation is left to the client, draw the corrected design and present it to the team with reasons.
- Mark the security-sensitive changes in a pull request: Find the lines in the changed files that touch input, queries and authorisation code.
- Write security review comments on a pull request: Write comments for three flaws giving the problem, its impact and a suggested fix in a constructive tone.
- Write a SAST rule for the flaw found in review: Write a tested Semgrep rule that catches the flaw found and report how many other places it occurs in the codebase.
- Prepare the list for the weekly findings meeting: Group new findings by tool, severity and owner.
- Verify a DAST finding by hand in the test environment: Reproduce the reported finding against the app in your own lab and prove whether it is real.
- Validate, fix and answer an outside researcher’s report: Validate the report in the lab, add the fix and a regression test, and draft a reply to the researcher and a security advisory.
- Collect the metrics for the quarterly report: Extract the counts of opened and closed findings and the mean time to fix.
- Prepare a half-hour secure coding session for the team: Write a session plan built on the quarter’s most common flaw with examples from your own code and an exercise.
- Complete an application security assessment of a product: Combine design, code, scan and manual verification findings, rank them by risk and write a report with an executive summary.
About this course
You live through a real quarter of an application security engineer: design reviews, code reviews, scan results, an outside vulnerability report and working with developers.
What you will learn
- Design and code
- Testing and findings
- Team and reporting
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.