Unit 12 — Secure Software Engineering

Learning objectives

• Integrate security concerns into requirements, design, implementation, testing, and deployment.
• Perform lightweight threat modeling.
• Recognize common classes of implementation and supply-chain risk.

Security is a lifecycle concern

Security cannot be added only at the end. Requirements define protected assets, architecture establishes trust boundaries, implementation introduces vulnerabilities, dependencies create supply-chain risk, and operations determine exposure.

Lightweight threat modeling

Ask:

1. What are we building?
2. What valuable assets exist?
3. Where are the trust boundaries and entry points?
4. What can go wrong?
5. What mitigations and detection mechanisms exist?
6. How will we verify them?

Secure engineering checklist

• Validate untrusted input.
• Enforce authentication and authorization separately.
• Apply least privilege.
• Protect secrets and sensitive data.
• Keep dependencies managed and scanned.
• Log security-relevant events without leaking secrets.
• Include negative and abuse-case tests.
• Review high-risk changes carefully.

Danger

Never place real credentials in coursework repositories, screenshots, logs, or example configuration files.