Application Security and Secure Development
Integrate security into the software development lifecycle - security requirements, STRIDE threat modeling, static + dynamic + composition analysis, and secure coding. Hands-on Node.js labs refactor vulnerable code into secure code so you can threat-model a service and read SAST results effectively.
View badge details
About This Course
Learn how security integrates with the software development lifecycle (SDL): security requirements, threat modeling with STRIDE, static + dynamic + composition analysis, and secure coding practices. Hands-on labs use a Node.js security-focused container to fix real vulnerabilities. By the end you can threat-model a service, read SAST results effectively, and refactor vulnerable code into secure code.
Course Curriculum
7 Lessons
The Security Development Lifecycle (SDL)
Learn Microsoft's SDL — the mature process for integrating security into every phase of software development (requirements → design → implementation → verification → release → response). By the end you can define security requirements for a new Beacon Harbor service and know when each SDL activity happens.
Threat modeling with STRIDE
Learn Microsoft's STRIDE threat modeling methodology — the dominant framework for identifying security threats in system designs. By the end you can decompose a system into data-flow diagrams, apply STRIDE to each component + flow, and produce a mitigation plan.
Threat model a Beacon Harbor service - Lab Exercises
Apply STRIDE threat modeling to a new Beacon Harbor service (customer self-service portal). Produce the data-flow diagram, STRIDE threat table, and mitigation plan. Deliverable: the threat model document a security architect would present at design review.
SAST, DAST, and SCA in the pipeline
Learn the three dominant application security scanning categories: Static Application Security Testing (SAST, analyzes code), Dynamic (DAST, tests running app), Software Composition Analysis (SCA, tracks dependencies). By the end you know when each fits in the pipeline, read their output effectively, and handle false positives.
Fix a vulnerable Node.js application - Lab Exercises
Note: This lab pre-provisions a VS Code container with Node.js security tooling at start — allow up to 10 minutes.
Work in a VS Code environment with a vulnerable Node.js Express app. You will run SAST (ESLint security plugin) and SCA (npm audit), identify specific vulnerabilities, refactor the code to fix them, and verify fixes with the same scans.
Secure coding practices
Learn the specific coding patterns that prevent common vulnerabilities: input validation, output encoding, parameterized queries, secrets management, cryptographic choices, dependency hygiene. By the end you can review code for these patterns + know when to use which library/framework feature.
AppSec capstone - full review + remediation - Lab Exercises
Note: This lab pre-provisions a VS Code container with Node.js security tooling at start — allow up to 10 minutes.
Course 7 capstone: perform a complete AppSec review on a Beacon Harbor service — SAST + SCA + manual code review + remediation + verify fixes. Produce the AppSec review document a dev lead would present at design review.
This course is currently being updated. Check back soon!
This course includes:
- 24/7 AI Instructor Support
- Live Lab Environments
- 3 Hands-on Lessons
- Completion Badge
Earn Your Badge
Complete all lessons to unlock the CYBER-700 Application Security and Secure Development achievement badge.
CYBER-700 Application Security and Secure Development
Awarded for completing CYBER-700: SDL integration, STRIDE threat modeling, SAST/DAST/SCA pipeline, secure coding patterns, and vulnerability remediation in a Node.js VS Code environment.
Skills You'll Earn
Complete all lessons in this course to earn this badge