Curriculum for

Certified Professional for
Software Architecture (CPSA)^®
Advanced Level:
Module
WEBSEC

Web Security

CPSA-A graduates can:

Security requirements are among the key challenges when designing and developing software. There are often a variety of potential attack points in IT systems that could be successfully exploited by potential attackers (with appropriate effort).

The lack of basic knowledge on security, high time pressure or carelessness frequently leads to seemingly small errors, which can then be exploited with fatal consequences in terms of security. Web applications, in particular, often have a potentially large, globally distributed user group with access via the Internet. As a result of this, the circle of attackers increases massively and so, too, does the likelihood of errors being discovered and exploited. In addition, web applications are often victims of automated attack attempts shortly after implementation. Information systems may only be used by the company’s own employees and are thus exposed to other attack scenarios. After all, embedded systems can now be found almost everywhere, so security issues can have a massive impact. Updates are not always possible in embedded systems.

If you take a look at the most common attack methods, they can usually be prevented by a “clean” architecture and clear communication. This curriculum aims to combine the somewhat academic world of security in software development with common technical practice.

Security cannot be considered independently of the context in which the systems are used. The reference to web applications, information systems, or embedded systems limits the thematic focus and ensures that the relevant information for the security of the respective systems is communicated. The curriculum focuses on web applications, but content about embedded systems or information systems can be inserted at the relevant points instead.

This curriculum excludes the following topics:

The times stated below are recommendations. The duration of a training course on the WEBSEC module should be at least 2 days, but may be longer. Providers may differ in terms of duration, teaching method, type and structure of the exercises and the detailed course structure. In particular, the curriculum provides no specifications on the nature of the examples and exercises.

Licensed training courses for the WEBSEC module contribute the following credit points towards admission to the final Advanced Level certification exam:

The requirements for training depend on the area on which the training focuses. For example, the requirements for security in the web area are:

There are other requirements for information systems and embedded systems. However, basic knowledge of the architecture and implementation of such systems is sufficient.

The individual sections of the curriculum are described according to the following structure:

This section therefore also outlines the skills to be acquired in corresponding training courses.

To the extent necessary for understanding the curriculum, we have added definitions of technical terms to the iSAQB glossary and complemented them by references to (translated) literature.

Security in software development often involves greater effort when designing, developing, maintaining, and operating an application. These measures are intended to increase the security of the application and thus support fundamental architectural objectives. This includes an analysis of the following aspects: - data and system functions worth protecting - potential attack vectors - dealing with problems caused by potential security vulnerabilities. In addition, there are common guidelines and standards. These analyses serve as the basis for all other security concepts.

Important terms:

Risk management, risk management framework, threat modeling, threat management, attack tree, attack vector, operational concept, audit, guidelines, standards, business context analysis, risk appetite

Security must be taken into account when an application is created. This extends across all stages of development. Security-specific design decisions often relate to specific requirements. However, there are established tools and process models to make design and implementation fundamentally more secure.

Important terms: Documentation security concept, access concept, secure development infrastructure, handling 3rd party code, supporting tools, application security lifecycle, security by design

Hash procedures, random numbers, entropy, symmetric encryption, asymmetric encryption, common standards and their lifetime, general recommendations

Specific security issues such as authentication or secure data transmission are often solved with technically similar measures. Some of these solutions require a specific application design. Subsequent refactoring in the direction of these designs is often associated with high expenses and is prone to errors at these critical points.

This section relates to the security of web systems. For information systems or embedded systems, other content must be conveyed accordingly.

Important terms:

Authentication principles, multifactor, single sign-on, identity management, federation, tools, secure protocols, authorization concepts

Although attack methods such as SQL injections have been known for several decades, their prevalence shows that this problem still exists. A recurring pattern of attacks is evident, especially for web applications. An understanding of common attacks is required for designing and developing secure applications.

This section relates to the security of web systems. For information systems or embedded systems, other content must be conveyed accordingly.

Important terms:

Attack vectors, network attacks, common web attack methods, injection, fuzzing, hijacking, cross-site attacks, social engineering, denial of service (DoS), credential stuffing

Web applications do not run as completely isolated systems, but are surrounded by infrastructure. In order to increase security, the same components are used again and again. This is not about specific products from a manufacturer, but about the basic ideas and principles behind them.

This section relates to the security of web systems. For information systems or embedded systems, other content must be conveyed accordingly.

Important terms: WAF, DMZ, firewall, IDS, IPS, logging, monitoring, ongoing feedback