Secure Software Requirements Secure Dev Series Course 2 of 8

Explore secure software requirements and the secure development life cycle, covering functional and non-functional needs, security requirements, policy, data classification, and use and misuse cases.

Meet Joseph Holbrooke, a 25-plus year IT veteran with government security and military secure systems experience, who guides you into software development with data engineering, storage networking, and certifications.

No prerequisites exist for this course, which teaches software development lifecycle essentials and IT security best practices, and encourages practice and completing the series for success.

Identify and distinguish functional and non-functional requirements by analyzing measurable criteria, like 200 transactions per second and 99.95% uptime, to ensure testable software expectations.

Identify security requirements through policy decomposition, data classification, privacy and regulatory obligations (PCI, Sarbanes-Oxley), and use case and misuse case modeling with a subject-object matrix.

Decompose high-level policy statements into lower level, repeatable security requirements and objectives, creating a detailed framework for compliance, audit risk management, and implementable technical controls.

Classify data to identify types, ownership, and labeling requirements, define data owner and custodian, and manage structured, unstructured, and semi-structured data with lifecycle controls.

Explore the subject object matrix, a role or access control matrix mapping subjects to objects by actions and capabilities, with columns as subjects and rows as objects.

Model use cases to design secure software that meets user needs and business requirements, then invert them into misuse cases to anticipate attacks like phishing or brute force.

Explore how regulatory and industry requirements drive software projects, detailing ownership, risk management, and controls across HIPAA, SOX, PCI DSS, GDPR, CCPA, FDA, Basel, NIST, and ISO.

Identify and apply key intellectual property concepts, including patents, copyrights, trademarks, and trade secrets, and recognize the role of warranties in software products.

Define and implement privacy requirements and data collection plans to protect PII, disclose a public privacy policy, obtain user consent, and apply encryption, obfuscation, logging, and ACLs.

Define and track security requirements with the security requirements traceability matrix (stm), a grid template that records requirements, sources, verification methods, compliance, and security features against the implementation plan.

Identify and plan data collection within the CIA and AAA frameworks, distinguishing non-functional from functional requirements, and map use cases with roles and objects to define permissions while prioritizing privacy.

Assess core security requirements, focusing on confidentiality and availability, through misuse cases. Examine how data lacking a predefined sequence, with no data model or schema, appears as unstructured data.

Explore additional IT resources, including Tech commanders, GCP gurus, and GitHub, and discover security, blockchain, and cloud computing courses, ebooks, and 1-to-1 cloud coaching with Cloud Interview Ace.