Following are the curriculum modules that the working group for OCSD has arrived at:
- Secure Architecture and Threat Modeling
- Secure SDLC practices
- Secure Architecture/Design Principles
- Common design flaws
- Threat Modeling / Risk Concepts
- Authentication and Credential Management
- Password Best Practices
- Multi-Factor Authentication (MFA)
- Credential Lifecycle Management
- Federated Identity and Single Sign-On (SSO)
- Authentication Bypass and Brute-Force Attacks
- Authorisation
- Session and Identity Management
- Access Control Approaches
- Function- and Object-Level Authorization
- Session Abuse and Privilege Escalation Attacks
- Input Validation and Output Encoding
- Input Validation
- Output Encoding and Sanitization
- Injection Attacks
- Cryptography and Key Management
- Cryptography Best Practices
- Secure Random-Number Generation
- Cryptographic Key Management
- Digital signatures and HMACs
- Error Handling
- Logging Sensitive Operations Securely
- Avoiding Stack Traces / Information Leaks
- Secure Logging
- Log Protection Best Practices
- Log Aggregation, Monitoring, and Alerting
- Data Protection and Privacy
- Encryption at Rest and Encryption in Transit
- Client-Side Storage Threats
- Regulatory (e.g., GDPR, CCPA) Considerations
- Data Retention and Destruction
- Caching and Privacy Headers
- Secure Communications
- Transport-Layer Security (TLS) Enforcement
- TLS 1.2+ Best Practices
- HTTPS Everywhere and HSTS
- Certificate Pinning
- Secure Protocol Selection
- Software Supply Chain Security
- Dependency Management
- Software Bills of Materials (SBOMs)
- Secure Deserialization
- Subdomain Takeover Attacks
- Code Signing and Verification
- Open-Source Software and Licensing
- Business Logic Security
- Business Logic Flaws (Race Conditions, Inconsistent State)
- Anti-Automation Best Practices (CAPTCHA, Rate Limiting)
- Anomaly Detection and Misuse Cases
- Secure File and Resource Handling
- Upload/Download Controls
- Path Traversal Prevention
- RFI, SSRF Protections
- MIME Sniffing and Validation
- API and Web Service Security
- REST, GraphQL, and SOAP Security Models
- Authentication and Authorization for APIs
- Throttling and Abuse Protection
- JSON and XML Parser Safety
- Secure Configuration and Deployment
- Secure Defaults
- Secrets Management
- CORS, CSP, and HSTS
- SBOM and CI/CD Hardening
- Security of and for AI
- Securing Models
- Securing Data Sets