Application & Infrastructure Security

Security Fundamentals & OWASP Top 10

Foundation + Vulnerability Assessment

Overview

Establish a comprehensive understanding of cybersecurity fundamentals and master the OWASP Top 10 web application security risks. Learn to identify, analyze, and mitigate critical vulnerabilities including injection flaws, broken authentication, sensitive data exposure, and cross-site scripting. Develop skills in threat modeling, risk assessment, and implementing security controls that form the foundation of secure application development.

Learning Resources

Course Title	Provider	Description	Level	Action
OWASP Top 10 Vulnerabilities	Snyk Learn	Understanding the most critical web application security risks including injection flaws, broken authentication, sensitive data exposure, XSS, CSRF	Beginner	Start Learning
OWASP Top 10 Web Application Vulnerabilities	FreeCodeCamp	Visual walkthrough of OWASP Top 10 with practical examples, demos and mitigation strategies (2h 15m)	Beginner	Watch Video
Common Security Mistakes: Real-World Examples	Coursera	Learning from high-profile security breaches caused by basic mistakes with case studies and prevention strategies	Beginner	Learn More
Developer Security Essentials	Secure Code Warrior	Avoiding basic security mistakes that lead to vulnerabilities including credentials management and API key protection	Beginner	Learn Controls
OWASP Application Security Verification Standard (ASVS)	OWASP	Comprehensive security requirements checklist for applications covering authentication, session management, access control	Intermediate	View Resource
OWASP Secure Coding Practices Quick Reference	OWASP	Easy-to-reference guide for secure coding practices including input validation, output encoding, error handling	Intermediate	Download Guide

Hands-On Activities

Vulnerability Assessment Lab: Use OWASP ZAP to scan a test application and identify security vulnerabilities
Secure Code Review: Analyze code samples to identify OWASP Top 10 vulnerabilities and propose fixes
Threat Modeling Exercise: Create a threat model for your Task Manager application using STRIDE methodology
Security Checklist Implementation: Apply OWASP security guidelines to harden your application

Secure Coding & Authentication

Implementation + Best Practices

Overview

Master secure coding principles and implement robust authentication and authorization systems. Learn to write code that validates input, handles errors securely, and prevents common vulnerabilities. Develop expertise in implementing OAuth 2.0, JWT tokens, multi-factor authentication, and session management while following security best practices for password storage, credential management, and secure communication protocols.

Learning Resources

Course Title	Provider	Description	Level	Action
Authentication and Authorization in Web Apps	Udacity	Implementing secure user authentication workflows and proper authorization controls with OAuth 2.0, JWT, MFA	Intermediate	Start Course
Secure Coding: Input Validation	LinkedIn Learning	Learning to validate and sanitize user inputs to prevent injection attacks, SQL injection prevention, XSS protection	Beginner	View Guide
Secure Coding Principles and Practices	Linux Foundation	Learning foundational principles for writing secure code including input validation, error handling, cryptography	Intermediate	Enroll
Spring Security Fundamentals	Baeldung	Implementing security in Spring-based applications with authentication, authorization, OAuth2, CSRF protection	Intermediate	Browse Tutorials
Security Hygiene for Developers	PluralSight	Building secure habits and practices for day-to-day development including password management, MFA	Beginner	Security Controls
Git Security: Avoiding Credential Leaks	GitHub Learning Lab	Preventing accidental exposure of sensitive information in code repositories with pre-commit hooks, credential scanning	Beginner	Security Guide

Hands-On Activities

Authentication System Implementation: Build OAuth 2.0 and JWT-based authentication for your Task Manager
Input Validation Exercise: Implement comprehensive input validation and sanitization across all endpoints
Secure Session Management: Configure secure session handling with proper timeout and invalidation
Multi-Factor Authentication: Integrate MFA using TOTP or SMS-based verification

Infrastructure Security & Zero Trust

Architecture + Cloud Security

Overview

Master infrastructure security principles and implement Zero Trust architecture patterns. Learn to secure cloud environments, configure firewalls, implement network segmentation, and manage identity and access controls. Develop expertise in secrets management, system hardening, and cloud security best practices across major providers including GCP, AWS, and Azure while understanding shared responsibility models and compliance requirements.

Learning Resources

Course Title	Provider	Description	Level	Action
Zero Trust Architecture Fundamentals	Cybrary	Understanding the principles and implementation of Zero Trust security model: never trust, always verify, least privilege	Intermediate	Start Course
Zero Trust Architecture Explained	IBM Technology	Clear explanation of Zero Trust principles and implementation with real-world examples (32m)	Intermediate	Watch Video
Cloud Security Fundamentals	Cloud Security Alliance	Understanding the unique security challenges in cloud environments including shared responsibility model, cloud threats	Beginner	Get Certified
GCP IAM Deep Dive	Google Cloud	Managing identity and access in Google Cloud environments with IAM roles, service accounts, policy bindings	Intermediate	Start Learning
pfSense Fundamentals & Advanced	Lawrence Systems	Detailed video series covering the open-source pfSense firewall with advanced configurations	Intermediate	Watch Series
Secrets Management with HashiCorp Vault	HashiCorp	Implementing secure storage and management for API keys, passwords, and certificates with key rotation	Intermediate	Start Learning

Hands-On Activities

Zero Trust Implementation: Design and implement Zero Trust architecture for your Task Manager infrastructure
Cloud IAM Configuration: Set up least privilege access controls and service accounts in GCP
Secrets Management Setup: Implement HashiCorp Vault or cloud-native secrets management
Network Security Hardening: Configure firewalls, VPCs, and network segmentation

AI Security & Ethical Considerations

Emerging Technologies + Ethics

Overview

Explore the unique security challenges and ethical considerations of AI systems. Learn to identify and mitigate AI-specific vulnerabilities including adversarial attacks, model poisoning, and prompt injection. Develop expertise in responsible AI implementation, bias detection, privacy-preserving machine learning, and compliance with AI governance frameworks while ensuring fairness, transparency, and accountability in AI applications.

Learning Resources

Course Title	Provider	Description	Level	Action
OWASP Top 10 for Large Language Models	OWASP	Understanding security risks specific to Large Language Models including prompt injection, insecure output handling	Intermediate	Learn More
OWASP Top 10 for Large Language Models	OWASP Foundation	Understanding security risks specific to LLM applications including prompt injection, training data poisoning (1h 5m)	Intermediate	Watch Video
AI Systems Security	Stanford Online	Understanding the security considerations unique to AI systems including ML vulnerabilities, adversarial attacks	Advanced	Learn More
Responsible AI Implementation	Microsoft Learn	Building AI systems that follow ethical guidelines and security best practices including fairness, transparency	Intermediate	Start Learning
AI Ethics and Governance	edX	Understanding ethical considerations and governance for AI systems including fairness, accountability, transparency	Intermediate	Learn Ethics
Intro to Adversarial Machine Learning	Kaggle Learn	Foundational machine learning course to understand ML models and security concepts	Advanced	Learn ML

Hands-On Activities

AI Security Assessment: Conduct security assessment of AI integration in your Task Manager application
Prompt Injection Testing: Test and defend against prompt injection attacks in LLM integrations
Bias Detection Implementation: Implement bias detection and fairness measures in AI recommendations
AI Governance Framework: Develop responsible AI guidelines and compliance documentation

Security Testing & Incident Response

Testing + Operations

Overview

Master comprehensive security testing methodologies and incident response procedures. Learn to perform vulnerability assessments, penetration testing, and security code reviews. Develop skills in threat modeling, security automation, and implementing security in the SDLC. Build expertise in incident detection, response planning, forensic analysis, and post-incident recovery while establishing security metrics and continuous monitoring practices.

Learning Resources

Course Title	Provider	Description	Level	Action
OWASP ZAP Security Scanning Workshop	OWASP	Using ZAP to perform automated and manual security testing of web applications with vulnerability identification	Beginner	Start Workshop
OWASP ZAP Tutorial Series	OWASP	Step-by-step guide to using ZAP for security testing including setup, scanning, intercepting, automating (1h 40m)	Beginner	Watch Series
Threat Modeling: Identifying and Mitigating Security Threats	Pluralsight	Learning to identify, analyze, and address potential security threats using STRIDE, DREAD, attack trees	Intermediate	Learn More
Security in the SDLC	SANS Institute	Integrating security practices throughout the development lifecycle including threat modeling, secure requirements	Intermediate	OWASP SAMM
Security Incident Response Planning	EC-Council	Developing and implementing security incident response procedures including containment strategies, forensic analysis	Intermediate	Professional Training
Penetration Testing Methodology	Offensive Security	Planning and executing systematic penetration tests including reconnaissance, vulnerability assessment, exploitation	Advanced	Advanced Training

Hands-On Activities

Automated Security Testing: Integrate security testing tools into your CI/CD pipeline
Vulnerability Assessment: Perform comprehensive security assessment of your Task Manager application
Incident Response Plan: Develop and test incident response procedures and playbooks
Security Monitoring Dashboard: Create security monitoring and alerting system for your infrastructure

Compliance & Security Documentation

Governance + Documentation

Overview

Master security compliance frameworks and documentation requirements for enterprise applications. Learn to create comprehensive security policies, risk assessments, and audit documentation. Develop expertise in regulatory compliance including GDPR, SOC 2, and industry-specific requirements while establishing security governance frameworks, incident documentation, and continuous compliance monitoring processes.

Learning Resources

Course Title	Provider	Description	Level	Action
Creating Effective Security Audit Reports	SANS Institute	Learning to create comprehensive and actionable security audit reports with vulnerability documentation	Intermediate	Security Reviews
System Hardening Checklist Development	CIS	Creating standardized checklists for system and application hardening with benchmark creation, configuration validation	Intermediate	Access Benchmarks
IAM Documentation and Governance	AWS Training	Creating comprehensive documentation for identity and access management with IAM policies, role definitions	Intermediate	AWS Security
Google Cloud Security Checklist	Google Cloud	Security best practices for Google Cloud resources including IAM, networking, data protection, logging	Intermediate	View Checklist
Secure Development Lifecycle Checklist	SANS Institute	Security tasks for each phase of development including requirements, design, implementation, verification	Intermediate	Download Checklist
AI Security and Privacy Checklist	OWASP	Security checklist specific to AI applications including data security, model security, inference security	Advanced	AI Security Guide

Hands-On Activities

Security Policy Development: Create comprehensive security policies and procedures documentation
Risk Assessment Report: Conduct and document security risk assessment for your Task Manager
Compliance Documentation: Prepare GDPR, SOC 2, or other relevant compliance documentation
Security Audit Preparation: Create audit trail and documentation for security controls