Course Syllabus — Secure Software Development Lifecycle (SSDLC) with Hands-On Coding
Cyber School · Professional Training · English · Adults
Security that is bolted on at the end of a project is expensive, fragile, and frequently too late. This workshop teaches you to build security into every phase of the software development lifecycle — from the first requirements meeting to production monitoring — and to prove it with working code.
📄 Syllabus document. Prefer a beautifully formatted version? View the designed syllabus below, or download it as a PDF to share and print.
1. Course Information
| Course title | Secure Software Development Lifecycle (SSDLC) with Hands-On Coding |
| Provider | Cyber School — Professional Training |
| Format | Instructor-led workshop combining structured theory, guided labs, and independent challenges |
| Duration | 4.5 hours across six sessions (30 + 60 + 45 + 45 + 45 + 45 minutes) |
| Language | English |
| Audience | Software developers, security engineers, QA testers, IT professionals |
| Prerequisites | Working familiarity with at least one programming language and basic web application concepts |
2. Course Description
This workshop moves security from an afterthought to a first-class engineering concern. Participants analyze real-world breaches such as the MOVEit file-transfer breach and the T-Mobile data breach, write and fix vulnerable code, build a threat model for a realistic e-commerce system, and run industry-standard security testing tools against a live application. Every topic is anchored in code: participants leave having personally exploited, detected, and repaired the vulnerability classes that dominate modern incident reports.
3. Learning Outcomes
Upon successful completion of this workshop, participants will be able to:
- Explain why security must be incorporated into every phase of the SDLC, and quantify the cost of deferring it.
- Define security requirements alongside functional requirements, using use cases and misuse cases.
- Construct a threat model for a realistic system and propose concrete, prioritized mitigations.
- Identify and remediate common vulnerability classes in code — SQL injection, XSS, CSRF, and buffer overflows.
- Operate security testing tools across SAST, DAST, and penetration testing against a running application.
- Design a DevSecOps pipeline that makes security continuous rather than episodic.
4. Instructional Approach
Every topic in this workshop follows the Cyber School learning arc:
📘 Learn — structured theory framed by real-world context, with measurable objectives.
🛠 Practice — guided, hands-on exercises with clear steps and defined success criteria.
🏆 Challenge — independent tasks that prove mastery: live code fixes, tool runs, and a team deliverable.
5. Course Schedule
| # | Session & Duration | Topics | Hands-On Component |
|---|---|---|---|
| 1 | Introduction to SSDLC 30 min |
Traditional SDLC phases; why secure development matters; CIA Triad; Least Privilege; Defense in Depth; MOVEit and T-Mobile case studies | Group breach analysis: in which SDLC phase was each vulnerability introduced? |
| 2 | Phase-by-Phase Breakdown with Code 60 min |
Security requirements and misuse cases; threat modeling at design time; secure coding vs. the OWASP Top 10; SAST/DAST/IAST; hardened deployment; continuous maintenance | Live code: parameterized queries vs. SQL injection; output escaping vs. XSS; secure logging in Python |
| 3 | Hands-On Threat Modeling 45 min |
Threat modeling methodology with Microsoft Threat Modeling Tool / OWASP Threat Dragon | Team deliverable: threat model of an e-commerce platform, presented with mitigations |
| 4 | Secure Coding Practices Workshop 45 min |
Buffer overflows in C; injection attacks; XSS; CSRF token protection | Challenge: receive insecure code snippets, identify and correct the flaws |
| 5 | Security Testing Hands-On 45 min |
Automating SAST, DAST, and IAST in the development workflow | Tool lab: dynamic testing of a deliberately vulnerable web app with OWASP ZAP / Burp Suite |
| 6 | DevSecOps Integration & Wrap-Up 45 min |
Security in the CI/CD pipeline; automated scanning; real-time monitoring with ELK Stack / Datadog; recap and Q&A | Design exercise: a DevSecOps pipeline for the participant’s own organization |
6. Assessment & Completion Criteria
This workshop is assessed on demonstrated competence, not attendance alone. To complete the workshop, participants must:
- Actively participate in all hands-on exercises.
- Submit the team threat-modeling deliverable with proposed mitigations.
- Successfully identify and correct the vulnerable code snippets in the secure coding challenge.
- Pass the end-of-workshop knowledge check quiz.
7. Materials & Tools
- Provided: A demo environment with deliberately vulnerable web applications (OWASP Juice Shop), all tools required for the duration of the workshop, and the full workshop textbook.
- Required: A laptop capable of running a modern web browser.
- Toolset used: OWASP ZAP, Burp Suite, SonarQube, Microsoft Threat Modeling Tool, OWASP Threat Dragon, Dependabot.
8. References & Further Reading
- SAFECode (2018). Fundamental Practices for Secure Software Development.
- OWASP. OWASP Top 10 — The Ten Most Critical Web Application Security Risks.
- Ponemon Institute (2021). Cost of a Data Breach Report.
- CERT Secure Coding Standards (2020).
- Microsoft Threat Modeling Tool and OWASP ZAP official documentation.