Menu

    Quests Security Awareness and Design Concepts catalogue

    Avatar
    Secure Code Warrior Elves
    • Updated
    Follow

    The following topics are available for selection as specific concepts in Quests.

    AI/LLM Security

    Authentication and Authorization Protocols

    Cloud Security

    Cryptography

    Data Security

    Industry-Specific Security

    Internet of Things

    Open-Source and Supply Chain

    Payment Card Industry (PCI)

    Privacy

    Secure Software Design

    Security Foundations

     

    AI/LLM Security


    Coding With AI

    This topic will help engineers understand how Large Language Models (LLMs) work and how to use them for coding. They will learn the best ways to work with AI in coding while avoiding security risks and legal problems.

    Audience: Architects, Engineers of all disciplines, Engineering Managers

    Topics covered in this template:

    • How Large Language Models Work
    • Potential Dangers of using AI when Writing Code
    • Security and Legal Pitfalls
    • Advantages of using AI when Writing Code
    • Best Practices
    • Using Rulesets
    • Version Control Practices
    • Secure Code Reviews

     

    Introduction to AI Risk & Security

    This beginner topic introduces AI risk and security for developers and technical professionals, covering key concepts, risk assessment, mitigation strategies, and resilience. It also emphasizes AI governance and accountability.

    Audience: Architects, Engineers, Engineering Managers, QA, Product Managers, and Business Analysts

    Topics covered in this template:

    • Foundations of AI Risk, Security, Safety, and Resilience
    • Identifying AI Risks
    • Assessing AI Risks
    • Mitigating AI Risks
    • AI Governance and Accountability
    • Technical Measures for AI Security
    • Evaluating AI Trustworthiness

     

    OWASP Top 10 for Large Language Model (LLM) Applications

    This topic explores the 2025 OWASP TOP 10 for Large Language Model (LLM) applications. It provides a conceptual overview of each item in the top 10, and interactive Missions to help learners better understand the impact and risks of key vulnerabilities emerging in LLM applications.

    Audience: Architects, Engineers, Engineering Managers

    Topics covered in this template: 

    • How Large Language Models Work
    • Direct Prompt Injection 
    • Indirect Prompt Injection
    • Sensitive Information Disclosure
    • Supply Chain
    • Data and Model Poisoning
    • Improper Output Handling
    • Excessive Agency
    • System Prompt Leakage
    • Vector and Embedding Weaknesses
    • Misinformation
    • Unbounded Consumption

    Authentication and Authorization Protocols


    OAuth 2.0 Security

    OAuth 2.0 is a widely used framework for securing access to APIs. In this topic, we introduce the core concepts of OAuth 2.0 and investigate the recommended flows. We also briefly discuss deprecated flows and look at common security pitfalls and misconceptions.

    Audience: Architects, Engineers, Engineering Managers

    Topics covered in this template: 

    • The Need for OAuth 2.0
    • Delegated Access with OAuth 2.0
    • Overview of OAuth 2.0 Grant Types
    • Delegated Access from a Confidential Client
    • Delegated Access from a Public Client
    • Long-Term Delegated Access
    • Common Pitfalls and Misconceptions
    • Wrapping up OAuth 2.0

     

    Cloud Security


    Introduction to Cloud Security

    This topic explores secure cloud infrastructures, focusing on data protection, identity management, compliance, and securing containerized and serverless environments. Through theory and hands-on examples across AWS, Azure, and GCP, participants will gain skills to design and maintain secure cloud solutions for evolving challenges.

    Audience: Architects, Cloud Engineers, QA Engineers and Engineering Managers

    Topics covered in this template:

    • Introduction to Cloud Computing and Security
    • Core Principles of Cloud Security
    • Managing Cloud Security Risks
    • Identity and Access Management Strategies
    • Protecting Data in the Cloud
    • Network Security and Segmentation
    • Monitoring, Compliance, and Incident Response
    • Advanced Cloud Security Practices

     

    Securing Amazon Web Services (AWS)

    This topic offers a comprehensive overview of AWS security, covering cloud security, compliance, infrastructure and application security, identity and data management, and incident response.

    Audience: Architects, Cloud Engineers, QA Engineers, and Engineering Managers

    Topics covered in this template:

    • Introduction to AWS Security
    • Compliance and Governance
    • Infrastructure Security Essentials
    • Web and Application Security
    • Identity and Access Management Basics
    • Data Security Essentials
    • Monitoring and Alerting Fundamentals
    • Incident Response and Threat Detection

     

    Securing Microsoft Azure

    This topic explores the ins and outs of securing software built and deployed on the Microsoft Azure cloud platform. Learn how to use Azure-specific features to ensure your application's production data is adequately protected and monitored.

    Audience: Architects, Cloud Engineers, QA Engineers, and Engineering Managers

    Topics covered in this template:

    • Introduction to Microsoft Azure
    • Network Security on Azure
    • Identity and Access Management
    • Data Security and Encryption
    • Azure Platform Security Features
    • Azure Monitoring and Logging

     

    Securing Google Cloud Platform

    This topic guides you in building and operating a secure environment in Google Cloud Platform, covering security features and services to protect your infrastructure and data. By the end, you'll be able to set up a secure GCP infrastructure for deploying cloud-native applications and services.

    Audience: Architects, Cloud Engineers, QA Engineers, and Engineering Managers

    Topics covered in this template:

    • Introduction to Google Cloud Platform (GCP)
    • GCP Infrastructure and Network Security
    • Identity and Access Management in GCP
    • Data Security and Encryption
    • Security Management
    • Logging and Monitoring

     

    Securing Infrastructure as Code (IaC)

    This topic covers a wide range of concepts, from the architecture and security features of the iOS operating system to the intricacies of app development and deployment.

    Audience: Platform Engineers, Architects, and other Engineers and Engineering Managers working with IaC tooling

    Topics covered in this template:

    • Introduction to IaC and Security
    • Core Concepts in IaC
    • Overview of IaC Tools
    • Deep Dive into Security in IaC
    • Secrets Management in IaC
    • IaC Best Practices with a Security Focus
    • IaC in CI/CD: Security Concerns

    Cryptography

     

    Introduction to Cryptography for Developers and Architects

    This topic will teach learners the cryptography basics that will help them design and develop secure applications and systems.

    Audience: Architects, Engineers, Engineering Managers

    Topics covered in this template:

    • Cryptography Foundations
    • Encryption
    • Symmetric Encryption
    • Asymmetric Encryption
    • Cryptographic Hash Functions
    • Message Authentication Codes
    • Digital Signatures
    • Practical Cryptography

    Data Security


    Database Security

    This topic covers essential steps for securing databases, from understanding threats and compliance to implementing authentication, encryption, and effective monitoring and auditing.

    Audience: Architects, Data Scientists, Data Engineers, Engineering Managers

    Topics covered in this template: 

    • Introduction to Database Security
    • Governance and Compliance
    • Authentication and Access Control
    • Encryption
    • Operation and Monitoring
    • Summary

     

    Security for Data Scientists & Analysts

    This topic covers key topics including cybersecurity, data security, advanced security principles, data pipeline security, anomaly detection, SIEM, threat intelligence, and secure coding practices.

    Audience: Data Scientists, Data Engineers, Data Analysts, Architects

    Topics covered in this template: 

    • Introduction to Cybersecurity
    • Data Security Fundamentals
    • Beyond the CIA Triad with Modern Security Principles
    • Security for Data Pipelines
    • Machine Learning for Anomaly Detection
    • Security Information and Event Management (SIEM)
    • Threat Intelligence Fundamentals
    • Secure Coding for Data Science

     

    Secure Password Storage

    This topic provides in-depth insights into the evolving field of password security, guiding learners through fundamental concepts to advanced strategies for safeguarding user credentials.

    Audience: Architects, Engineers, Engineering Managers

    Topics covered in this template:

    • The Modern Landscape of Passwords
    • Understanding the Nuances of Password Storage
    • Going Beyond Basic Hash Functions
    • The Science and Art of Salting Passwords
    • One-way Functions: The New Frontier
    • Secure Vault Services and Hardware Security Modules (HSMs)
    • Transitioning to Modern Password Storage Mechanisms
    • Crafting the Optimal Password Security Blueprint

     

    Industry-Specific Security


    Introduction to Automotive Security 

    This topic offers an overview of automotive security, covering threats, fundamentals, threat modeling and standards with a deep dive into ISO 26262. It also addresses coding practices, testing, and maintenance to help mitigate vehicle security risks.

    Audience: Architects, Engineers, QA Engineers, Engineering Managers

    Topics covered in this template: 

    • Introduction to Automotive Security
    • Fundamentals of Automotive Technology
    • Automotive Vehicle Security Threat Modeling
    • Secure Design Principles
    • Regulatory Requirements, Standards, and Guidelines
    • Secure Software and Hardware Development
    • Secure Testing and Maintenance

     

    Secure Development for Healthcare

    This topic explores the compliance landscape for healthcare applications and medical device software, focusing on legal requirements and best practices for protecting sensitive health information.

    Audience: Architects, Engineers, Engineering Managers, QA, Product Managers, Business Analysts

    Topics covered in this template:

    • Developing Secure Healthcare Applications
    • Legal and Regulatory Compliance in the Healthcare Industry
    • Health Information Protection
    • Developing Secure Healthcare Applications
    • Medical Devices Security
    • Testing and Responding to Incidents

    Internet of Things


    Introduction to Securing the Internet of Things

    This topic explores IoT complexities and security challenges, focusing on privacy and vulnerabilities. It provides the knowledge needed to make informed decisions as an IoT vendor, enterprise, or consumer.

    Audience: Architects, Engineers, Engineering Managers, QA, Product Managers, and Business Analysts

    Topics covered in this template:

    • Introduction to the Internet of Things
    • IoT Architecture
    • IoT Communication Protocols
    • IoT Threat Modeling
    • IoT Security Concerns
    • IoT Regulatory Concerns

    Open-Source and Supply Chain


    Open-Source Software (OSS)

    This topic explores Open-Source Software, its advantages and disadvantages, and strategies for effectively managing associated risks. Participants will examine real-world case studies of prominent OSS vulnerabilities to understand key lessons and best practices for mitigating security risks.

    Audience: Architects, Engineers, Engineering Managers

    Topics covered in this template: 

    • Introduction to Open Source Software
    • Open Source Licenses
    • Using Open Source Licenses Correctly
    • Overview of OWASP Top 10 Risks for Open Source Software
    • Case Studies 
    • Managing Open Source Software Risk
    • Building an Open Source Policy

     

    Open-Source Policies and Risks

    This topic covers key open-source licenses, their obligations, associated security risks, and steps for building a corporate policy for organisation-wide use.

    Audience: Architects, Engineers, Engineering Managers, Product Managers, Business Analysts

    Topics covered in this template: 

    • Introduction to Open Source Policies and Their Risks 
    • Open Source Licences
    • Using Open Source Licenses Correctly
    • Security Risks of Open Source Software
    • Building an Open Source Policy
    • Summary of Open Source Policies and Their Risks

    Payment Card Industry (PCI)


    PCI DSS v4.0 Concepts and Compliance

    This conceptual topic is intended as basic security training for any developers that work on PCI DSS relevant applications. It will explain the annual PCI DSS training requirements for developers and then proceed into providing the necessary training.

    Audience: Architects, Engineers, Engineering Managers, QA, Product Managers, Business Analysts

    Topics covered in this template: 

    • Introduction to PCI DSS Developer Training
    • PCI DSS v4.0 Requirements 1-4
    • PCI DSS v4.0 Requirements 5-12
    • Real-World Examples
    • Preparing for a PCI DSS Assessment

    Privacy


    Introduction to GDPR

    This topic covers the principles, roles, and regulations of personal data use, focusing on data subject rights and the impact of GDPR on the software development lifecycle.

    Audience: Architects, Engineers, Engineering Managers, QA, Product Managers, Business Analysts

    Topics covered in this template:

    • What is GDPR and why is it Important
    • Timeline and Notable Fines
    • Key Roles in GDPR
    • Personal Data
    • GDPR Principles for Processing and Protecting Personal Data
    • Data Protection and Data Breach Concepts
    • Key Rights of the Data Subject

     

    GDPR for Developers and Architects

    This intermediate topic covers GDPR principles and requirements for software developers and architects. Concepts include obtaining consent, managing personal data access and sharing, data subject access requests, and international data transfers.

    Audience: Architects, Engineers, Data Engineers, Data Scientists, Engineering Managers

    Topics covered in this template:

    • Principle of Data Protection by Design and by Default
    • Privacy Requirements
    • Personal Data
    • Getting Consent
    • Personal Data Collection and Processing
    • Collecting Personal Data of Children
    • Accessing Personal Data
    • Sharing Personal Data with Law Enforcement
    • Data Portability and Deletion
    • Anonymisation and Encryption
    • Data Subject Access Requests (DSARs)
    • International Data Transfers (IDTs)
    • Access Control and Logging

     

    GDPR for Development and Project Managers

    This intermediate topic covers GDPR principles for developers and project managers. Concepts include data protection by design, data subject rights, design and production requirements, privacy impact assessments, data sharing, and international transfers.

    Audience: Architects, Engineers, Engineering Managers, Product Managers, Business Analysts, Project Managers

    Topics covered in this template:

    • Principle of Data Protection by Design and by Default
    • Performing Personal Data Mappings
    • Data Subjects Rights
    • Design Requirements
    • Data Privacy Impact Assessment (DPIA)
    • Requirements for Development, Testing and Production
    • Sharing Personal Data with Law Enforcement
    • International Data Transfers (IDTs)

     

    Introduction to CCPA

    This topic will provide all necessary guidelines to ensure that your applications achieve compliance with the CCPA (California Consumer Privacy Act). It details the required notices that must be provided to consumers and outlines the processes for implementing them effectively.

    Audience: Architects, Engineers, Engineering Managers, QA, Product Managers, Business Analysts

    Topics covered in this template:

    • What is CCPA?
    • Consumer Rights
    • Requirements for Businesses
    • Roadmap to CCPA Compliance

    Secure Software Design


    Architecture Risk Analysis

    This conceptual topic covers Architecture Risk Analysis (ARA), a set of techniques that aim to discover design flaws and the risks they pose within a system. This topic teaches the skills needed to identify design-level defects.

    Audience: Architects, Engineers, QA Engineers, Engineering Managers

    Topics covered in this template: 

    • ARA Overview
    • Design Flaws and the Techniques that Find Them
    • ARA in a Nutshell
    • The Role of Diagrams and Diagramming in ARA
    • Business Context
    • Dependency Analysis
    • Applying Design Principles for ARA
    • Known Attack Analysis
    • Fitting ARA into an SDL

     

    Risk-Based Security Testing Strategy

    This topic provides learners with a comprehensive understanding of methodologies, tools, and best practices to effectively assess and enhance the security posture of software systems. Learners will explore the core concepts of risk assessment, test planning, test design, execution, and reporting.

    Audience: Engineers, QA Engineers, Engineering Managers

    Topics covered in this template: 

    • Introduction to Risk-Based Security Testing
    • Identifying Risks in Software Systems within the Enterprise
    • Risk Assessment and Prioritization Techniques
    • Risk-Based Test Planning, Design and Implementation
    • Test Execution, Evaluation and Reporting
    • Tools and Techniques for Risk-Based Security Testing
    • Continuous Improvement and Adaptation

     

    Threat Modelling

    In this topic, participants will learn systematic methodologies for identifying and mitigating potential threats to software systems. Topics include understanding system architecture, data flows, and threat landscapes, and applying threat modelling tools.

    Audience: Architects, Engineers, Engineering Managers

    Topics covered in this template: 

    • Threat Modelling Overview
    • Threat Modelling Introduction
    • Understanding your System and Environment
    • Threat Modelling Methodologies
    • S.T.R.I.D.E.
    • Threat Modelling Tools
    • Implementation of Threat Modelling Practices
    • Threat Modelling Case Study

     

    Security Requirements

    This conceptual topic covers methodologies for gathering, defining, and verifying security requirements. Participants will learn what they are and how to write actionable security requirements that align with organisational goals.

    Audience: Architects, Engineering Managers, Product Managers, Business Analysts

    Topics covered in this template: 

    • Introducing Software Security Requirements
    • Requirements Gathering and Methodologies
    • How to Write Security Requirements
    • Verifying Security Requirements

    Security Foundations


    Foundations of Software Security

    This language-agnostic topic introduces fundamental software security concepts throughout the Software Development Life Cycle (SDLC). Participants will learn to establish Software Security Initiatives (SSI), conduct secure code reviews, and implement application security testing.

    Audience: Architects, Engineers, Engineering Managers, QA, Product Managers, Business Analysts

    Topics covered in this template: 

    • Introduction and Overview of Software Security Concepts
    • Software Security Initiatives (SSI)
    • Software Development Life Cycle (SDLC) and SSDLC
    • Secure Code Reviews
    • Application Security Testing
    • Introduction to SAST
    • Introduction to DAST
    • Introduction to Penetration Testing
    • Introduction to Security Standards
    • Introduction to OWASP
    • Introduction to OWASP ASVS
    • Introduction to SEI CERT Coding Standards

     

    Attack and Defense

    This conceptual topic provides learners with an overview of how attackers discover and exploit vulnerabilities in the real world, and provide best practices about how to build a strong line of defense.

    Audience: Architects, Engineers, Engineering Managers

    Topics covered in this template: 

    • The Diamond Adversary Model
    • Attacker Quadrants, Advanced Persistent Threat (APT) Groups, and Real-World examples of Tactics, Techniques, and Procedures (TTPs)
    • Supply Chain Vulnerabilities and Testing Open Source Libraries
    • Cloud Security and Infrastructure Protection
    • Secure Architecture Design, Secure Configuration, Management, and Monitoring and Alerting
    • Examples of Good and Bad Application Security Defenses
    • Further Defense Strategies and Best Practices

     

    Hardening Your APIs

    This topic explores how attackers use offensive techniques to target APIs and how to implement defensive security measures to counter these threats. By the end of the topic, a set of best practices will be developed to enhance API security.

    Audience: Architects, API Engineers, Back End Engineers, Engineering Managers

    Topics covered in this template:

    • Introduction to APIs
    • The Role of the Client in Security
    • Using Rate Limiting and Abuse Protection
    • Mitigating Server-Side Request Forgery (SSRF)
    • Deploying CORS for APIs
    • Configuring Security Headers for APIs
    • Conclusion: Hardening Your APIs

     

    Low-Code and No-Code (LCNC)

    This topic introduces the fundamentals of no-code and low-code platforms, highlighting their benefits and limitations. It covers the OWASP Low and No-Code Top 10 to help identify and mitigate key security risks in low and no-code development.

    Audience: Architects, Engineers, Engineering Managers, Product Managers

    Topics covered in this template:

    • Intro to Low-Code
    • Intro to No-Code
    • Overview of the OWASP Low-Code/No-Code Top 10

     

    Application Security Concepts

    This topic equips developers with essential principles and practices to build resilient software, emphasizing topics such as defense in depth, least privilege, and secure defaults. Learners will explore strategies like robust error handling, trusted frameworks, input validation, and data protection to ensure applications are secure by design and fail safely.

    Audience: Architects, Engineers, Engineering Managers, QA, Product Managers, Business Analysts

    Topics covered in this template: 

    • Defense In Depth
    • Open Design
    • Logging
    • Robust Error Checking
    • Reuse of Existing Security Controls in a Framework or Language
    • Data Protection
    • Least Privileges
    • Secure by Default
    • Trust No Input
    • Fail Securely

     

    Web Application Security 101

    This topic dives deep into web application security, focusing on client-side vulnerabilities and server-side defences. Topics include secure session handling, browser security policies, access control, injection risks, and best practices for authentication and password storage.

    Audience: Architects, Engineers, Engineering Managers, QA, Product Managers, Business Analysts

    Topics covered in this template: 

    • In-depth into Cookies and Sessions
    • Local Storage
    • Issues with Client-Side Security Measures
    • CSP, SOP, CORS
    • Insufficient Data Escaping
    • Improper or Missing HTTP Headers
    • Missing Function Level Access Control
    • SQL Injection
    • Improper Authentication
    • Plaintext Storage of Passwords

     

    Non-Human Identities (NHI)

    This topic on the OWASP Top 10 for Non-Human Identities (NHI) outlines the most critical security risks associated with integrating NHIs, such as application identities and machine credentials, into software systems.

    Audience: Architects, DevOps Engineers, Platform Engineers, Cloud Engineers, Backend and API Engineers, QA Engineers, Product Managers

    Topics covered in this template:

    • Improper Offboarding
    • Secret Leakage
    • Vulnerable Third-Party NHI
    • Insecure Authentication
    • Overprivileged NHI
    • Insecure Cloud Deployment Configurations
    • Long-Lived Secrets
    • Environment Isolation
    • NHI Reuse
    • Human Use of NHI

    Related articles

    Comments

    0 comments

    Please sign in to leave a comment.