|
所在平台: Coursera |
课程主页: https://www.coursera.org/learn/application-security-for-developers-devops
课程评论：没有评论
课程名称：应用安全：开发人员与DevOps专业人员的课程 课程概述：你应用程序的安全风险和威胁有多脆弱？本课程将帮助你识别漏洞并监控应用程序和系统的健康状况。你将审查和实施安全编码实践，以防止数据泄露等事件，并了解监控和可观察性等实践如何保障系统的安全。课程让你掌握维护安全环境的各种实践、概念和流程。 课程大纲： 1. **应用开发安全导论** 本模块将帮助你识别安全在工作流程中的位置，了解安全概念和术语。你将学习如何在软件开发生命周期（SDLC）中设计安全，并了解DevSecOps的一系列实践。此外，你会探索OSI模型，识别开发人员所需的OSI层，并在应用开发的四个层面实施安全措施。你将了解安全模式及其组织方式，同时描述传输层安全（TLS）和安全套接字层（SSL），并学习如何在SDLC中保持TLS安全。模块还将引导你使用漏洞扫描工具和威胁模型来减轻安全漏洞，增加身份验证、加密和完整性等关键术语，并通过实际实验使用OpenSSL加密和解密文件，以及使用Nmap扫描网络环境。 2. **安全测试与缓解策略** 在此模块中，你将学习在整个开发和生产过程中保护应用程序的关键缓解策略。你将发现多种安全测试方法，如静态分析、动态分析、漏洞分析、软件组件分析和持续安全分析。你将探索代码审查的方法，确保应用开发的运行时保护，并基于静态分析、动态分析、漏洞扫描和漏洞检测进行动手实验。 3. **OWASP应用安全风险** 本模块将介绍开放网络应用安全项目（OWASP）及其十大安全关注点。你将学习应用程序的漏洞，发现安全专家和专业人员关注的主要漏洞，包括SQL注入、跨站脚本和安全存储秘密等问题。同时，你还将调查软件和数据完整性失败，学习如何检测这些类型的漏洞，并研究减轻其影响的方法。模块中将包括使用Snyk分析代码库和使用Vault Python API（hvac）读取、写入和删除Vault中的键值秘密的实验。 4. **安全最佳实践、最终项目及评估** 本模块将介绍编码最佳实践和软件依赖性。你还将探索如何通过决定在集中式存储库中存储哪些内容和在GitHub上不存储哪些内容来保护开发环境。每位学员将通过实际实验创建HTTP安全头，使用flask-talisman进行操作，并使用pass CLI安全存储和检索秘密。最终项目要求学员检查其GitHub上的代码以查找漏洞，并按严重性顺序修复漏洞，应用减少漏洞风险的最佳实践。 通过完成本课程，你将有效提升应用程序安全性，保障软件开发流程的安全性。
Name:Introduction to Security for Application Development
Description:In this module, you will identify how security fits into your workflow and gain a working knowledge of security concepts and terminology. You’ll discover how to design for security in the Software Development Lifecycle (SDLC) and find out about a set of practices known as DevSecOps. You will also discover the OSI model, identify the necessary OSI layers for developers, and implement security measures on the four layers of application development. You will gain insights into security patterns and learn how to organize them. You will describe TLS (Transport Layer Security) and SSL (Secure Sockets Layer), identify how to keep TLS secure in the SDLC, and explore OpenSSL and its purpose. You will learn the strategies, best practices, and methodologies for getting security early into your code to protect applications against threats and vulnerabilities. Further, you’ll find out how you can use tools like vulnerability scanners and threat models to mitigate security vulnerabilities. You’ll also get the opportunity to add key terms like authentication, encryption, and integrity to your security vocabulary. Finally, you will also perform hands-on labs to encrypt and decrypt files using OpenSSL and scan a network environment with Nmap.
Name:Security Testing and Mitigation Strategies
Description:In this module, you will learn the key mitigation strategies to secure your application throughout development and production. You will also discover a range of security testing methods like static analysis, dynamic analysis, vulnerability analysis, software component analysis, and continuous security analysis. You will explore ways to perform code review and ensure runtime protection for application development. You will also perform hands-on labs based on static analysis, dynamic analysis, vulnerability scanning, and vulnerability detection.
Name:OWASP Application Security Risks
Description:In this module, you will learn about the Open Web Application Security Project (OWASP) and its Top 10 security concerns. You’ll learn about application vulnerabilities and discover the top vulnerabilities concerning security experts and professionals. You will explore SQL injection, cross-site scripting, and storing secrets securely. You will also investigate software and data integrity failures, discover how to detect these types of vulnerabilities, and examine ways to mitigate their impact. You will also perform hands-on labs to analyze your code repository using Snyk and use the Vault Python API (hvac) to read, write, and delete key-value secrets in Vault.
Name:Security Best Practices , Final Project, and Assessment
Description:In this module, you will learn about coding best practices and software dependencies. You’ll also explore how to secure a development environment by deciding what to store in a centralized repository and what not to store in GitHub. You will also perform hands-on labs to create HTTP security headers using flask-talisman and safely store and retrieve secrets using the pass CLI (command-line-interface). As your final project, you will check your code on GitHub for vulnerabilities in order of severity and fix the vulnerabilities. You’ll apply the best practices for reducing the risk of vulnerability.
How vulnerable are your applications to security risks and threats? This course will help you identify vulnerabilities and monitor the health of your applications and systems. You’ll examine and implement secure code practices to prevent events like data breaches and leaks, and discover how practices like monitoring and observability can keep systems safe and secure. You will gain extensive knowledge on various practices, concepts, and processes for maintaining a secure environment, including
