Purpose
These learning paths provide a structured progression through security engineering, from understanding basic threats to designing secure architectures.
Beginner Path
Objective
Understand common threats, follow secure coding practices and participate in security reviews.
Prerequisites
- Basic understanding of web applications and networking.
Topics
-
Security Principles
- Defense in depth, least privilege, secure by default.
- Reference: Security Engineering Handbook
-
Common Web Vulnerabilities
- OWASP Top 10 overview.
- SQL injection, XSS, CSRF, IDOR.
- Reference: Web Vulnerabilities Guide
-
Secure Coding Practices
- Input validation, authentication, output encoding.
- Reference: Secure Coding Guide
-
Using Security Tools
- Running SAST scanners (Brakeman, RuboCop).
- Running dependency scanners (bundler-audit).
- Reference: Dependency Security Guide
-
Participating in Security Reviews
- What to look for as a reviewer.
- Basic threat identification.
- Reference: Security Review Playbook
Assessment
Demonstrate by: Identifying vulnerabilities in a code review. Running security tools and interpreting results correctly.
Intermediate Path
Objective
Conduct security reviews, perform threat modeling and implement security controls.
Prerequisites
- Completed Beginner Path or equivalent experience.
Topics
-
Threat Modeling
- STRIDE framework.
- Identifying trust boundaries.
- Reference: Security Engineering Handbook
-
Authentication and Authorization
- Implementing secure authentication.
- Role-based and attribute-based access control.
- Reference: Authentication and Authorization Guide
-
Security Testing
- SAST, DAST, and manual testing.
- Writing security test cases.
- Reference: Security Review Playbook
-
Dependency Management
- Vulnerability response workflow.
- Dependency evaluation and selection.
- Reference: Dependency Security Guide
-
Security Configuration
- Security headers (CSP, HSTS).
- Secure deployment configuration.
- Reference: Security Engineering Handbook
Assessment
Demonstrate by: Leading a security review. Performing threat modeling for a new feature. Implementing security controls in an application.
Advanced Path
Objective
Design secure architectures, establish security standards and respond to security incidents.
Prerequisites
- Completed Intermediate Path or equivalent experience.
Topics
-
Secure Architecture Design
- Architecture-level threat modeling.
- Zero trust architecture.
- Security patterns and anti-patterns.
-
Incident Response
- Detection, containment, eradication, recovery.
- Post-incident analysis.
- Reference: Incident Response Playbook (not yet developed)
-
Security Standards and Compliance
- Defining security standards for an organization.
- Compliance frameworks (SOC 2, ISO 27001).
- Security audit preparation.
-
Cryptography
- Applied cryptography for engineers.
- Key management.
- TLS and certificate management.
-
Security Mentoring
- Conducting security training.
- Reviewing for security mindset, not just vulnerabilities.
Assessment
Demonstrate by: Designing a secure system architecture. Establishing security standards for a team. Mentoring others in security practices.