starweaver-logo
LOG INGET STARTED
LOG INGET STARTED
  • Browse
  • Doing

  • On Air
  • Channels
  • Career Paths
  • LEARNING

  • Courses
  • Certifications
  • Journeys
  • Test Prep
  • CONNECTING

  • How It Works
  • Community
  • Techbytes
  • Podcasts
  • Leaderboards
  • SUPPORT

  • Support & FAQs
  • Starweaver for Business
  • Starweaver for Campus
  • Teach with Starweaver
footer-brand-logo
  • COMPANY
  • About Us
  • Support and Knowledge Base
  • Policies & Terms
  • Contact
  • CONTENT
  • Courses
  • Certifications
  • Journeys
  • Test Prep
  • Meet the Gurus
  • Techbytes
  • FOR ORGANIZATIONS
  • Starweaver for Business
  • Starweaver for Campus
  • Catalogue
  • Pricing
  • Private Classes
  • PARTNER WITH US
  • Instructors & Teachers
  • Books, Writing & Publishing
  • FOLLOW US
    • facebook
    • twitter
    • linkedin
    • pinterest
    • instagram
    • youtube
Our trademarks include Starweaver®, Make genius happen™, Education you can bank on®, People are your most important assets!®, Body of Knowledge™, StarLabs™, LiveLabs™, Journeys™
© Starweaver Group, Inc. All Rights Reserved.
  1. Courses
  2. >
  3. Advanced Practices in Application Security

Advanced Practices in Application Security

In this course, you’ll learn how to implement advanced application security practices by embedding security throughout the software development lifecycle (SDLC).

Derek Fisher
Cybersecurity | intermediate | 8 hours 45 minutes |   Published: Oct 2025

    Discussions

Overview

1KSTUDENTS*
97.8%RECOMMEND*

This course includes:

  • On-demand videos
  • Practice assessments
  • Multiple hands-on learning activities
  • Exposure to a real-world project
  • 100% self-paced learning opportunities
  • Certification of completion

Software rules the world whether it runs a datacenter, a cloud workload, on an IoT device in a factory, or an application running on a mobile device; software is inescapable. Traditionally, security approaches have “bolted-on” security in the final stages of development. But these last-minute techniques are no longer sufficient in providing security against sophisticated cyber threats. Each year cyberattacks become more prevalent and more dangerous, and organizations face unprecedented pressure to embed security into their development processes rather than treating it like an afterthought. This course empowers cybersecurity professionals, software developers, and DevSecOps teams to implement application security techniques that integrate into and throughout the entire software development lifecycle (SDLC). 

Skills You Will Gain

Secure Software Development
Application Security Training
DevSecOps
Threat Modeling Techniques
NIST SSDF Framework

Learning Outcomes (At The End Of This Program, You Will Be Able To...)

  • Apply secure coding practices and OWASP top 10 prevention techniques to eliminate vulnerabilities during development phases. 
  • Analyze application architectures to identify critical security threats and design comprehensive threat models for risk mitigation. 
  • Evaluate software supply chains and implement security controls for open-source components, dependencies, and vendor relationships. 
  • Design secure cloud-native and container architectures with automated monitoring and compliance validation capabilities. 

Prerequisites

To gain the most from this course, learners should already have a strong foundation in software development processes, particularly SDLC and Agile/DevOps methodologies. Familiarity with common web application vulnerabilities (such as the OWASP Top 10), hands-on experience with at least one modern programming language, and a working understanding of cloud, containerization, and infrastructure patterns are essential. A baseline knowledge of network security and common attack vectors will further ensure learners can apply the advanced practices covered effectively.

Who Should Attend

This course is tailored for experienced professionals working at the intersection of software development, security, and operations. It is ideal for Security Engineers and Architects driving DevSecOps practices, Senior Developers ensuring secure coding in applications, and DevOps Engineers embedding security into CI/CD workflows. IT Managers, Directors, Compliance Specialists, and Security Consultants will also benefit by gaining the frameworks and practical approaches needed to oversee, assess, and strengthen organizational software security initiatives.

Curriculum

Instructors

*Where courses have been offered multiple times, the “# Students” includes all students who have enrolled. The “%Recommended” shown is also based on this data.
Derek Fisher

Derek Fisher

Derek Fisher brings nearly 30 years of experience in cybersecurity and engineering across sectors including finance, healthcare, and defense. He’s the author of Alicia Connected, a children’s book series on cybersecurity, and The Application Security Program Handbook. As Program Director and Associate Professor at Temple University, Derek teaches software security and leads efforts to develop the next generation of cyber professionals. A frequent speaker and content creator, he’s passionate about making security accessible and impactful—from classrooms to codebases.

VIEW MY CHANNEL
1Chapter 1: Introduction
2Chapter 2: Building Security from the Ground Up
3Chapter 3: OWASP Top 10 Prevention
4Chapter 4: Application Security Testing and Protection
5Chapter 5: Threat Modeling
6Chapter 6: Utilizing Threat Modeling Tools
7Chapter 7: Managing Findings from Threat Modeling
8Chapter 8: Understanding the Software Supply Chain
9Chapter 9: Collecting Artifacts and Understanding Risk
10Chapter 10: Managing and Monitoring the Supply Chain
11Chapter 11: Understanding Cloud and Container Fundamentals
12Chapter 12: Understanding Container Security Practices
13Chapter 13: Understanding Cloud Security Defenses

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 02: Chapter Introduction

Segment 03: Secure by Design Principles

Segment 04: Secure Coding Practices

Segment 05: Secure Configuration and Defaults

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 06: Prevention of OWASP Top 10

Segment 07: Stopping Insecure Design and Misconfiguration Failures

Segment 08: Defending Against Supply Chain Attacks and Logging Failures

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 15: Chapter Introduction

Segment 16: Threats vs Risks

Segment 17: Intro to Threat Modelling

Segment 18: Utilizing STRIDE For Threat Modelling

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 22: Risk Rating Using OWASP Risk Rating

Segment 23: CVSS Scoring for Vulnerability Management

Segment 24: Transforming Threats into Secure Designs

Segment 26: Reading - NIST Threat Modeling Guidelines

Segment 27: Hands-On-Learning: Attack Path Modeling: Creating Attack Trees with Deciduous

Segment 28: Quiz - Threat Modeling Best Practices

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 09: Code Testing for Vulnerabilities

Segment 10: Testing an Application for Run-Time Vulnerabilities

Segment 11: Run-Time Protection

Segment 12: Reading - Foundations Section of the OWASP Developer Guide

Segment 13: Hands-On-Learning: Secure Coding Practices: Identifying and Fixing Vulnerable Code in GitHub Codespaces

Segment 14: Quiz - Secure Development and Code Security

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 29: Chapter Introduction

Segment 30: Software Supply Chain Threat Landscape

Segment 31: Software Bill of Materials (SBOM) Fundamentals

Segment 32: Dependency Management and Open-Source Risk Assessment

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 33: SLSA Framework and Build Provenance

Segment 34: Artifact Integrity and Code Signing

Segment 35: Vendor Risk Assessment and Third-Party Security

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 00: Welcome to the Course: Course Overview

Segment 01: Intro Video to Course

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 19: Threat Modelling with OWASP Threat Dragon

Segment 20: Using Attack Trees in Threat Modelling

Segment 21: Completing a Rapid Threat Modeling Prototyping (RTMP)

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 36: Continuous Supply Chain Monitoring

Segment 37: Compliance and Regulatory Requirements

Segment 38: Supply Chain Incident Response and Recovery

Segment 39: Reading - Securing the Software Supply Chain

Segment 40: Hands-On-Learning: Software Supply Chain Security: SBOM Generation and Vulnerability Analysis with Syft and Grype

Segment 41: Quiz - Supply Chain Security

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 42: Chapter Introduction

Segment 43: Cloud-Native Security Fundamental

Segment 44: Container and Serverless Security

Segment 45: Cloud Security Automation and Infrastructure as Code (IaC) Security

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 46: Kubernetes Security Architecture and RBAC

Segment 47: Container and Registry Security

Segment 48: Runtime Protection and Behavioral Monitoring

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 49: Network Security and Micro-Segmentation

Segment 50: Secrets Management and Data Protection

Segment 51: Compliance and Governance in Cloud-Native Environments

Segment 52: Reading - CCM v4.0 Implementation Guidelines

Segment 53: Hands-On-Learning: Cloud-Native Security: Container Vulnerability Scanning and Security Reporting with Trivy

Segment 54: Project: Comprehensive Application Security Assessment: From Code to Container

Segment 55: Course Wrap-up Video

Segment 56: Quiz - Cloud Security and Container Security