Comments on Proposed Curriculum Content

Hi @Shruti-s-kulkarni, I have some initial thoughts for each module for consideration:

Modules:

1. Secure Architecture and Threat Modelling

• A few things to consider that may be beneficial for threat modelling purposes:
• Psychology, usability, and human-computer interfaces
• An overview of modern threats/attacks

2. Authentication and Credential Management

• MFA implementation: how about "Authentication factors and multi-factor authentication (MFA)"
• Credential recovery securely: IMO security is implied so this could just be "Credential recovery", but I would also suggest modifying to "Account recovery" if I understand the intent correctly
• Secure password storage (hashing/salting): I think this ought to be broadened to coverage of the security properties of passwords in practice as well as policies and handling. Perhaps "securing passwords"?

3. Authorisation

• How about "Authorisation, Sessions, and Access Controls" as a module title?
• Token vs cookie-based sessions: "Token" refers to the data but HTTP cookies are a mechanism for transport and storage. We have had multiple debates over at the ASVS with regard to terminology here. IMO it could be avoided (at least for now) with something like "Session Management", bundling "Session timeout, renewal" with it
• Horizontal vs vertical privilege escalation: this term refers to a consequence, but not a specific control/mechanism. I think it would be worth mentioning, but not as a dedicated section/topic.
• Testing access control effectively: this is the only topic that mentions testing. Is this the only area where testing should be taught? Perhaps there could be a section for testing that covers security testing and the use of traditional dev-driven testing (like "Security" unit testing).
• Object-level authorization: consider expanding to "Object- and Property-Level Authorization"
• Security of authorisation tokens (JWT etc): For the ASVS, we decided to adopt the term "Self-Contained Token" for these types of tokens, see: https://github.com/OWASP/ASVS/blob/master/5.0/en/0x90-Appendix-A_Glossary.md

4. Input Validation and Output Encoding

• Consider also the term "allow-list" in addition or in place of "whitelist"
• Some coverage of common utilities like regular expressions may be valuable
• Looking at validating more complex structured data (JSON/XML) I think would be valuable

5. Cryptography and Key Management

• Consider also covering key container formats and basic tooling to work with them

6. Error Handling

• IMO Modules 6 and 7 could be combined
• Logging sensitive operations securely: I think the "securely" is implied and could be removed

7. Secure Logging

• I think log protection may be less of a dev concern - thoughts?
• It may be appropriate in another section, but client-side reporting (Reporting API and similar) is worth covering, especially in respect to security violations like CSP

8. Data Protection and Privacy

• It may be redundant to have TLS here and in module 9
• In addition to GDPR, consider other major compliance international frameworks like PCI DSS

9. Secure Communications

• Instead of TLS 1.2+ best practices, I think it would just be worth covering the basics of TLS and maybe some web-specific issues they should be aware of
• Certificate pinning: this is still somewhat common in mobile apps, but is there relevance for web? What is the scope of the curriculum?
• Secure protocol selection: I think this is less and less important knowledge for developers. Even if they are managing it, secure (enough) defaults are common here.

10. Malicious Code and Software Supply Chain Security including usage of open source software

• Subdomain takeover: I think this isn't not super relevant for developers, but I would definitely recommend covering other takeover attacks like cloud resource name hijacking and dependency confusion. Perhaps a general section "Resource takeover attacks"?

11. Business Logic Security

• IMO "Security" can be removed from the module title
• I think it might be valuable to have coverage of common patterns and anti-patterns with respect to securing business logic

12. Secure File and Resource Handling

• IMO "Secure" can be removed from the title
• This module should probably also cover cloud storage, which is very common (including signed uploads/downloads)

13. API and Web Service Security

• Throttling and abuse protection: this might already be covered by anti-automation in module 11

14. Secure Configuration and Deployment

• CORS, CSP, HSTS: HSTS is already covered in module 9. I think also CORS, CSP, and related concepts may warrant a dedicated section for client-side/browser security (other topics like CSRF could be included as well).

15. Security of and for AI

• IMO this might be slightly beyond the intended scope

Start by reviewing the proposed curriculum content in the issue and the linked OWASP ASVS glossary entry. Group the feedback by module and terminology, then confirm the intended curriculum scope before making changes. Done means the proposed module titles, topics, and terminology have been resolved and reflected consistently in the curriculum.