SecAppDev Academy

SecAppDev original

Secure coding: Back to Basics

Video and handoutsSecAppDev 2024

Secure codingDomain-driven design

Abstract

In this lecture we will look at how we write and how we can influence the security of the code by writing it in a different way. We will look at constructs in the code and borrow a bit from modern Domain Driven Design to help make the code more secure. We will also challenge some of the ways developers typically write software. The lecture should be relevant to both junior and experienced developers.

Handouts available for this lecture

Download

Chapters

  1. Intro
  2. Domain Driven Security: the Concept
  3. The what & why of Input Validation
  4. Input Validation Pitfalls
  5. Input Validation Guidelines
  6. Bringing in Domain Driven Security
  7. The Domain Primitive
  8. API’s
  9. What about TypeScript?
  10. Limitations of Input Validation
  11. Encoding & Language Constructs
  12. API’s with Guardrails
  13. When DSL’s and API’s Fail
  14. In Conclusion
  15. Q & A

In-person course

Erlend Oftedal taught at a previous edition of SecAppDev

SecAppDev is an immersive course in secure application development, running annually since 2005. World-renowned faculty from industry and academia deliver in-depth 90-minute lectures and full-day workshops in an intimate setting, typically in early June.

More about SecAppDev

Regular updates, at most twice a month

We will email you about new talks on the SecAppDev Academy, along with updates on the annual in-person course. No tracking, and you can unsubscribe at any time.