Secure Software Design: Principles and Best Practices

Introduction to the section, key topics to be covered, and call to action.

Analyzes three major breaches (Equifax, SolarWinds, MOVEit) covering root causes, business impact, and preventive controls. Establishes why developers must prioritize security from day one.

Compares reactive post-deployment patching with proactive security integration. Explains why fixing production vulnerabilities costs 30-100x more than preventing them during design. Introduces security-by-design principles.

Demonstrates attack surface analysis on a sample e-commerce application. Identifies entry points: input fields, APIs, authentication, file uploads, third-party integrations. Maps data flows and trust boundaries to prioritize where security controls are critical.

Defines the three fundamental security properties with concrete examples. Confidentiality (encryption, access controls), Integrity (checksums, digital signatures), Availability (redundancy, DDoS protection). Shows how to balance these properties based on business requirements.

Explains key design principles: Least Privilege (minimum necessary permissions), Defense in Depth (layered controls), Zero Trust (continuous verification), Fail-Safe Defaults (deny by default), and Separation of Duties. Real-world examples show how violations lead to breaches.

Builds RBAC system in Python from scratch. Defines roles and permissions, creates authorization decorators, implements permission checking, and handles unauthorized access. Covers common implementation mistakes and provides reusable code patterns.

Introduces STRIDE for threat categorization (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) and DREAD for risk scoring (Damage, Rep roducibility, Exploitability, Affected Users, Discoverability). Shows how to apply both frameworks together.

Teaches preliminary threat modeling steps: inventorying assets (credentials, data, IP), identifying trust boundaries (security zone transitions), and mapping attack surfaces (entry points). Demonstrates creating data flow diagrams to visualize components and risks.

Complete threat modeling walkthrough of authentication system. Maps data flows, applies STRIDE to identify threats (credential stuffing, session hijacking, password leaks, DoS), uses ChatGPT/Claude APIs to generate additional attack scenarios, applies DREAD scoring, and documents findings. Students create a complete threat model template ready for real-world use.

Introduction to the section, key topics to be covered, and call to action.

Introduces OWASP Top 10 2021 as the industry standard for critical web application risks. Explains injection attacks (SQL, NoSQL, OS command, LDAP) where untrusted data is sent to interpreters as commands. Covers attack mechanics, real-world exploitation examples, and why injection remains a top threat despite being well-understood.

Explains broken access control vulnerabilities including Insecure Direct Object References (IDOR), privilege escalation, and path traversal attacks. Shows how attackers manipulate URLs, parameters, or tokens to access unauthorized resources. Covers the difference between authentication (who you are) and authorization (what you can access), and why both are essential.

Demonstrates fixing vulnerable code samples with injection flaws using parameterized queries and prepared statements. Shows secure database interaction with SQLAlchemy ORM and proper input sanitization. Implements authorization checks for resource access, validates user permissions before database queries, and demonstrates IDOR prevention. Students gain working code patterns for secure data access.

Explains three XSS types: Stored (persistent malicious scripts in database), Reflected (script injected via URL/input immediately reflected), and DOM-based (client-side JavaScript manipulation). Demonstrates attack chain from injection to payload execution, showing how attackers steal cookies, hijack sessions, and deface websites. Covers why XSS remains prevalent despite widespread awareness.

Explains Cross-Site Request Forgery where attackers trick authenticated users into executing unwanted actions. Covers CSRF attack mechanics and token-based protection. Introduces input validation strategies (whitelist vs blacklist, client vs server-side) and output encoding for different contexts (HTML, JavaScript, URL, CSS). Explains why validation alone isn't sufficient without proper encoding.

Demonstrates exploiting XSS vulnerabilities in a sample application, then fixing them with output encoding and Content Security Policy headers. Implements CSRF protection using anti-CSRF tokens and SameSite cookie attributes. Shows framework-specific protections in Express.js/Node.js, configures CSP headers, and tests both exploits and mitigations. Students gain working defense implementations.

Explains why plain text and simple hashing are insufficient for password storage. Covers proper password hashing with bcrypt/Argon2, salt/pepper usage, and work factor configuration. Introduces Multi-Factor Authentication (MFA) as essential defense against credential theft. Discusses password complexity requirements, account lockout policies, and secure password reset flows.

Explains OAuth 2.0 and OpenID Connect for delegated authentication and authorization. Covers JWT structure, common security pitfalls (algorithm confusion, lack of expiration), and proper validation. Introduces secrets management using environment variables, HashiCorp Vault, and cloud services (AWS Secrets Manager). Explains encryption at rest (database, file storage) and in transit (TLS/SSL), plus key rotation strategies.

Builds complete authentication system in Python implementing secure password storage with bcrypt, OAuth  2.0 authorization code flow, JWT generation and validation, and session management. Demonstrates using environment variables for secrets, integrating AWS Secrets Manager or similar service, and implementing proper token lifecycle (access/refresh tokens). Shows common implementation mistakes and secure patterns. Students gain production-ready authentication code.

Introduction to the section, key topics to be covered, and call to action.

Introduces the OWASP Secure Coding Practices Cheat Sheet as authoritative guidance. Covers language-specific secure patterns in Python, JavaScript, and Java, including input validation, output encoding, authentication/authorization, session management, and cryptography. Explains how secure coding standards prevent vulnerabilities at the code level before testing or deployment.

Identifies dangerous coding patterns that introduce vulnerabilities: insecure deserialization attacks, unsafe use of eval() and dynamic code execution, race conditions (TOCTOU), hardcoded credentials and API keys, sensitive data in logs or error messages, and poor dependency management. Explains why each pattern is dangerous with real-world exploitation examples and secure alternatives.

Demonstrates refactoring vulnerable code samples to apply secure patterns. Fixes insecure deserialization by validating and sanitizing data, replaces eval() with safe alternatives, eliminates hardcoded secrets using environment variables, implements secure error handling without information leakage, and configures secure logging that excludes sensitive data. Students gain practical refactoring skills with before/after code comparisons.

Explains three complementary security testing approaches. SAST (Static Application Security Testing) analyzes source code without execution to find vulnerabilities early. DAST (Dynamic Application Security Testing) tests running applications to find runtime vulnerabilities. SCA (Software Composition Analysis) identifies vulnerabilities in third-party dependencies and libraries. Covers when to use each type, their strengths/limitations, and how they complement manual security reviews.

Introduces DevSecOps philosophy of integrating security throughout development rather than as final gate. Explains shift-left security: moving security testing earlier in SDLC to catch issues when they're cheaper to fix. Covers security gates in CI/CD pipelines, automated vulnerability blocking thresholds, Infrastructure as Code (IaC) security scanning, and fostering security ownership across development teams.

Demonstrates setting up an automated security testing pipeline. Installs and configures Bandit (Python SAST), Semgrep (multi-language SAST), OWASP ZAP (DAST), and Snyk (SCA). Integrates tools into GitHub Actions or GitLab CI pipeline with appropriate failure thresholds. Runs scans against a sample application, interprets results, and configures automated blocking for high-severity findings. Students gain a working CI/CD security configuration.

Teaches effective prompting strategies for security tasks: requesting secure implementations (authentication, encryption, validation), asking for vulnerability analysis with specific OWASP categories, generating security test cases covering edge cases, and creating security documentation. Provides prompt templates and examples showing how specificity and context improve AI output quality. Emphasizes importance of validating AI suggestions against authoritative sources.

Addresses critical limitations of AI in security: hallucinations (confidently incorrect information), outdated or incomplete security knowledge, vulnerability to prompt injection attacks, generating insecure code patterns, and risk of over-reliance without understanding. Covers ethical considerations including AI bias, privacy concerns when sharing code, and responsibility for AI-generated security decisions. Emphasizes AI as an assistant tool requiring human verification, not a replacement for security expertise.

Demonstrates practical workflow using ChatGPT/Claude APIs for security tasks. Reviews vulnerable code samples using AI prompts requesting OWASP-based analysis, generates security test cases covering authentication, authorization, and input validation scenarios, creates security documentation from code, and validates AI suggestions against OWASP guidelines. Shows how to integrate AI into development workflow while maintaining critical thinking. Students practice writing effective security prompts and evaluating AI responses.