The Open Source Security Foundation (OpenSSF) is updating its Developing Secure Software (LFD121) course with new interactive learning labs that provide developers with more hands-on learning opportunities.
LFD121 is a free course offered by OpenSSF that takes about 14-18 hours to complete. Any student who passes the final exam gets a certificate that is valid for two years.
The course is broken down into three parts. The first part covers the basics of secure software development, like how to implement secure design principles and how to secure the software supply chain. Part two covers implementation of those basics and then part three finishes up with security testing and also covers more specialized topics like threat modeling, fielding, and formal methods for verifying that software is secure.
The new interactive labs are not required for completing the course, but do enhance the experience, OpenSSF explained. The labs launch directly in the web browser, meaning no additional software needs downloading.
Each lab involves working through a specific task, such as validating input of a simple data type. “Learning how to do input validation is important,” said David Wheeler, director of open source supply chain security, at OpenSSF. “Attackers are *continuously* attacking programs, so developers need to learn to validate (check) inputs from potential attackers so that it’s much harder for attackers to malicious inputs into a program.”
Each lab includes a general goal, background on the issue, and information about the specific tasks. Students will work through a pre-written program that has some areas that will need to be filled in by the student.
According to Wheeler, the goal of all of the labs isn’t to learn specific technologies, but to learn core concepts about writing secure software. For example, in the input validation lab, the student only needs to fix one line of code, but that line of code is the one that does the validation, and therefore, is critically important.
“In fact, without the input validation line to be crafted by the user, the code has a vulnerability (specifically a ‘cross-site scripting vulnerability’),” said Wheeler.
Students can also get help throughout the lab by requesting context-specific hints that take into account where they are stuck. Wheeler explained that the hints help students progress through the labs even if they’re not familiar with the particular programming language used in the lab.