Advanced Application Security with NIST, OWASP & CSA

位教师： Derek Fisher 另外 1 个

包含在 Coursera Plus • 了解更多 中

推荐体验

您将学到什么

Apply secure coding practices and OWASP top 10 prevention techniques to eliminate vulnerabilities during development phases.

Analyze application architectures to identify critical security threats and design comprehensive threat models for risk mitigation.

Evaluate software supply chains and implement application security controls for open-source components, dependencies, and vendor relationships.

Design secure cloud-native and container architectures with automated monitoring and compliance validation capabilities.

您将获得的技能

Cloud Standards

Application Security

Dependency Analysis

CI/CD

Software Development

Security Testing

IT Security Architecture

Secure Coding

Cloud Security

Threat Modeling

Containerization

Supply Chain

Cloud-Native Computing

Security Controls

Application Development

Multi-Cloud

Hybrid Cloud Computing

Continuous Monitoring

显示全部

您将学习的工具

Open Web Application Security Project (OWASP)

要了解的详细信息

添加到您的领英档案

4 任务¹

了解顶级公司的员工如何掌握热门技能

该课程共有6个模块

As cyber threats grow in sophistication, organizations can no longer treat application security as an afterthought.This course equips software developers, cybersecurity professionals, and DevSecOps teams to embed security throughout the software development lifecycle (SDLC).

You'll master practical, up-to-date application security best practices aligned with industry frameworks from NIST, OWASP, CISA, and CSA.

Learn to integrate secure coding, threat modeling, and supply chain security from the ground up.

Explore secure development practices using NIST's SSDF, adopt Secure by Design principles endorsed by over 100 leading software firms, and implement controls from OWASP and CSA's Cloud Controls Matrix.

Gain hands-on experience with application security testing tools for static analysis, container security, SBOMs, and threat modeling methodologies like STRIDE.

Through a comprehensive fictional case study, you'll apply these skills in real-world scenarios, from legacy integration to cloud-native deployments, preparing you to lead security-first development in any organization.

Stay ahead of regulatory demands and design secure software from day one.

Course Introduction

In this course, you’ll learn how to implement advanced application security practices by embedding security throughout the software development lifecycle (SDLC).

You’ll focus on real-world techniques such as secure coding, vulnerability assessment, and DevSecOps integration to anticipate and prevent cyber threats.

Through expert instruction, case studies, and hands-on exercises, you’ll gain the skills to apply security controls, integrate automated security testing into pipelines, and align practices with industry standards.

By the end of this course, you’ll be equipped to strengthen organizational resilience, reduce risk exposure, and lead proactive application security initiatives that protect software across cloud, mobile, IoT, and enterprise environments.

涵盖的内容

1个视频 1篇阅读材料

Intro Video to Course • 3分钟

Welcome to the Course: Course Overview • 5分钟

Secure Development and Code Security

In this module, you’ll learn how to embed security directly into your applications and development processes.You’ll explore Secure by Design principles, secure coding techniques, and secure configuration practices to prevent critical vulnerabilities.

Through practical demonstrations, static and dynamic application security testing, and runtime protection strategies, you’ll develop the skills to identify, mitigate, and manage vulnerabilities throughout the software development lifecycle.

This module emphasizes proactive security practices aligned with industry standards such as OWASP Top 10 and SANS Top 25 to ensure robust, production-ready applications.

涵盖的内容

10个视频 1篇阅读材料 1个作业 1次同伴评审 2个讨论话题

Module Introduction • 3分钟

Secure by Design Principles • 5分钟

Secure Coding Practices • 5分钟

Secure Configuration and Defaults • 6分钟

Prevention of OWASP Top 10 • 6分钟

Stopping Insecure Design and Misconfiguration Failures • 6分钟

Defending Against Supply Chain Attacks and Logging Failures • 10分钟

Code Testing for Vulnerabilities • 5分钟

Testing an Application for Run-Time Vulnerabilities • 7分钟

Run-Time Protection • 7分钟

Foundations Section of the OWASP Developer Guide • 5分钟

Secure Development and Code Security • 20分钟

Hands-On-Learning: Secure Coding Practices: Identifying and Fixing Vulnerable Code in GitHub Codespaces • 10分钟

OWASP Top 10 Vulnerability Analysis and Prevention Strategy • 10分钟

Implementing Proactive Security Transformation in Development Teams • 10分钟

Threat Modeling Best Practices

In this module, you’ll learn how to systematically identify and analyze security threats before they become costly vulnerabilities.

You’ll explore industry-standard methodologies, including STRIDE, and gain hands-on experience with threat modeling tools like OWASP Threat Dragon, attack trees, and Rapid Threat Modeling Prototyping (RTMP).

By applying these techniques to real-world scenarios, you’ll develop the skills to anticipate attack vectors, prioritize risks using OWASP and CVSS frameworks, and translate findings into actionable security controls that strengthen application defenses from design through deployment.

涵盖的内容

10个视频 1篇阅读材料 1个作业 1次同伴评审 1个讨论话题

Intro Video to Module • 2分钟

Threats vs Risks • 5分钟

Intro to Threat Modelling • 5分钟

Utilizing STRIDE For Threat Modelling • 6分钟

Threat Modelling with OWASP Threat Dragon • 8分钟

Using Attack Trees in Threat Modelling • 6分钟

Completing a Rapid Threat Modeling Prototyping (RTMP) • 6分钟

Risk Rating Using OWASP Risk Rating • 7分钟

CVSS Scoring for Vulnerability Management • 7分钟

Transforming Threats into Secure Designs • 7分钟

NIST Threat Modeling Guidelines • 5分钟

Threat Modeling Best Practices • 20分钟

Hands-On-Learning: Attack Path Modeling: Creating Attack Trees with Deciduous • 10分钟

Threat Prioritization and Mitigation Strategy Development • 10分钟

Supply Chain Security

In this module, you’ll learn how to secure the software supply chain and CI/CD pipelines critical to modern development.

You’ll explore techniques for evaluating and securing open-source components, third-party dependencies, and vendor relationships while integrating automated security testing throughout development pipelines.

Hands-on exercises with Software Bill of Materials (SBOM) creation, dependency management, and monitoring tools equip you to prevent supply chain attacks, ensure compliance with industry standards, and maintain secure DevOps workflows without slowing delivery.

涵盖的内容

10个视频 1篇阅读材料 1个作业 1次同伴评审 2个讨论话题

Intro Video to Module • 2分钟

Software Supply Chain Threat Landscape • 6分钟

Software Bill of Materials (SBOM) Fundamentals • 5分钟

Dependency Management and Open-Source Risk Assessment • 7分钟

SLSA Framework and Build Provenance • 6分钟

Artifact Integrity and Code Signing • 9分钟

Vendor Risk Assessment and Third-Party Security • 8分钟

Continuous Supply Chain Monitoring • 6分钟

Compliance and Regulatory Requirements • 5分钟

Supply Chain Incident Response and Recovery • 7分钟

Securing the Software Supply Chain • 5分钟

Supply Chain Security • 20分钟

Hands-On-Learning: Software Supply Chain Security: SBOM Generation and Vulnerability Analysis with Syft and Grype • 10分钟

Open-Source Component Evaluation and Strategic Dependency Management • 10分钟

Implementing Continuous Supply Chain Monitoring Strategy • 10分钟

Cloud Security and Container Security

In this module, you’ll learn how to secure cloud-native applications, containers, and serverless environments while implementing continuous monitoring and governance.

You’ll explore cloud security architectures using CSA Cloud Controls Matrix standards, container and runtime security practices, and Infrastructure-as-Code (IaC) automation for secure deployments.

Hands-on exercises with monitoring tools, Kubernetes RBAC, and secrets management help you protect dynamic cloud workloads, detect threats in real time, and maintain compliance across hybrid and multi-cloud environments.

涵盖的内容

10个视频 1篇阅读材料 1个作业 1次同伴评审 2个讨论话题

Intro Video to Module • 3分钟

Cloud-Native Security Fundamental • 6分钟

Container and Serverless Security • 5分钟

Cloud Security Automation and Infrastructure as Code (IaC) Security • 6分钟

Kubernetes Security Architecture and RBAC • 5分钟

Container and Registry Security • 5分钟

Runtime Protection and Behavioral Monitoring • 5分钟

Network Security and Micro-Segmentation • 5分钟

Secrets Management and Data Protection • 5分钟

Compliance and Governance in Cloud-Native Environments • 4分钟

CCM v4.0 Implementation Guidelines • 5分钟

Cloud Security and Container Security • 20分钟

Hands-On-Learning: Cloud-Native Security: Container Vulnerability Scanning and Security Reporting with Trivy • 10分钟

Container Runtime Security Monitoring and Threat Detection • 10分钟

Cloud Migration Security Strategy and Monitoring • 10分钟

Course Conclusion

In this final module, you will synthesize your learning across secure coding, threat modeling, supply chain protection, and cloud-native security practices.

You’ll bring these core concepts together in a hands-on capstone project where you will perform a complete threat modeling exercise using OWASP Threat Dragon.

This project demonstrates your ability to identify risks, design effective mitigations, and integrate security into the software development lifecycle.

By the end, you will be prepared to showcase your expertise in applying industry-standard frameworks and tools to build secure, resilient applications that align with both technical requirements and organizational goals.

涵盖的内容

1个视频 1次同伴评审

Course Wrap-up Video • 3分钟

Project: Comprehensive Application Security Assessment: From Code to Container • 60分钟

位教师

提供方

从 Security 浏览更多内容

S STARWEAVER Fundamentals of Secure Software Design 课程 类别：预览 预览

M Microsoft Application and DevSecOps 课程 状态：免费试用 免费试用

P Packt Application Security Program Ignition Guide 课程

I IBM Application Security for Developers and DevOps Professionals 课程 状态：免费试用 免费试用

人们为什么选择 Coursera 来帮助自己实现职业发展

Felipe M.

Jennifer J.

Larry W.

Chaitanya A.

通过订阅解锁 10,000 多门课程的访问权限 开始试用

通过在线学位推动您的职业生涯 获取世界一流大学的学位 - 100% 在线 探索学位

加入全球超过 4,700 家选择 Coursera for Business 的公司 了解更多

常见问题

What is application security, and why is it important?

Application security is the discipline of protecting software from threats by integrating safeguards across the entire software development lifecycle (SDLC).

It is critical because applications are among the most targeted assets in any organization, and a single unaddressed vulnerability can result in data breaches, financial loss, and regulatory penalties.

For this reason, modern teams build security in from day one rather than treating it as an afterthought.This course is designed to teach the security-first approach.

What is the main purpose of application security?

The main purpose of application security is to identify, prevent, and remediate vulnerabilities before they can be exploited.Rather than adding protection after development, it embeds security throughout the SDLC to keep software safe, reliable, and compliant.

This course develops that capability through application security best practices aligned with industry frameworks from NIST, OWASP, CISA, and CSA.

What jobs can I get with application security skills?

Application security skills support roles such as application security engineer, security analyst, DevSecOps engineer, secure software developer, and security architect.

As organizations increasingly embed security into the development lifecycle, professionals who can apply secure coding and threat modeling are in growing demand across both development and security teams.

What skills do I need to learn for application security?

A solid foundation in software development and the SDLC is recommended, along with secure coding, threat modeling, and familiarity with frameworks such as OWASP and NIST.

This course builds on those fundamentals, advancing into software supply chain security, cloud application security, and the practical use of application security testing tools.

How do I learn application security?

The most effective path combines structured learning with hands-on application.

This course teaches application security best practices through real-world scenarios, guiding you from secure coding and threat modeling to supply chain and cloud-native security via a comprehensive case study you complete end to end.

What topics are typically covered in application security courses?

A comprehensive application security course covers secure coding, the OWASP Top 10, threat modeling, supply chain and dependency security, and cloud application security.

This course further includes leading industry frameworks (NIST SSDF, OWASP, CISA, and CSA), static analysis, container security, SBOMs, and STRIDE-based threat modeling.

When will I have access to the lectures and assignments?

To access course materials, assignments, and earn a Certificate, you'll need to purchase the Certificate experience when you enroll in a course.Eligible learners may also have the option to start with a Free Trial.Some courses may also offer a Full Course, No Certificate option.

This lets you access course materials, submit required assessments, and receive a final grade, but you won't be able to earn or purchase a Certificate.

What will I get if I purchase the Certificate?

When you purchase a Certificate you get access to all course materials, including graded assignments.Upon completing the course, your electronic Certificate will be added to your Accomplishments page - from there, you can print your Certificate or add it to your LinkedIn profile.

Is financial aid available?

Yes. In select learning programs, you can apply for financial aid or a scholarship if you can’t afford the enrollment fee. If fin aid or scholarship is available for your learning program selection, you’ll find a link to apply on the description page.

更多问题

提供助学金， 了解详情

¹ 本课程的部分作业采用 AI 评分。

对于这些作业，将根据 Coursera 隐私声明 使用您的数据。