Web Application Security Fundamentals

Built to span two audiences usually trained apart, this intermediate course carries enough technical grounding for people who build and configure web applications, and enough plain-language framing for the system owners, security officers and program staff who oversee them without writing code. Most web application security training targets developers only; here a developer, a system owner and a security officer take the same course and come away able to hold the same conversation. There's no lab, by design — nothing to provision, no technical prerequisites — reinforced instead through interactive scenario prompts: "given this situation, what is the most appropriate action."

Topics are anchored to a real policy and standards landscape. The first module covers security risk management frameworks and the system-authorization process, a major executive cybersecurity order and its amendments, and NIST Cybersecurity Framework 2.0, including the rare skill of recognizing when a policy has been superseded. The second module organizes around the OWASP Top 10 (2025 edition), staying focused on recognizing risk over writing exploit code; the course then moves through the secure development lifecycle, the Secure Software Development Framework, identity and access control with Zero Trust and FIPS-validated encryption, and finishes on continuous monitoring, event logging and incident reporting. A graded final (70% to pass, unlimited retakes) covers all five modules, weighted toward application over recall.

What You Will Learn

• Explain why web application security is a shared responsibility across technical and non-technical staff
• Identify the laws, executive orders and NIST, OMB and CISA guidance that govern how organizations secure their web applications
• Recognize when a policy or memorandum has been superseded, and why confirming currency matters
• Recognize the most common categories of web application vulnerability and the risk each poses to an organization's systems and data
• Describe secure software development lifecycle practices and how they reduce risk
• Apply core secure-coding principles including input validation, output encoding, least privilege, secure defaults and failing securely
• Manage risk from third-party and open-source components
• Explain identity, access control and data protection principles, including Zero Trust and FIPS-validated encryption
• Describe best-practice expectations for continuous monitoring, event logging and incident reporting
• Apply all of the above to realistic scenarios without needing a technical lab

Course Outline

Module 1

• Foundations of Web Application Security and the Federal Policy Landscape
• What a web application is and why it is a common attack surface
• The CIA triad applied to federal systems
• Threat actors from nation-state to insider
• Shared responsibility across developers, system owners, ISSOs and users
• FISMA, the Risk Management Framework and the authorization process, Executive Order 14028 and its amendments, and Cybersecurity Framework 2.0
• How to tell when a policy has been superseded

Module 2

• Common Web Application Vulnerabilities
• How the OWASP Top 10 is developed and why federal secure-coding guidance references it
• The 2025 edition categories including broken access control, cryptographic failures, injection, insecure design and misconfiguration, software supply chain failures, authentication failures, mishandling of exceptional conditions, and logging and alerting failures
• Why each is consequential for federal systems

Module 3

• Secure Development Practices and the Secure SDLC
• The phases of a secure development lifecycle
• Input validation, output encoding, least privilege, secure defaults and failing securely
• Security requirements and threat modeling before code is written
• Static and dynamic testing at a conceptual level
• Open-source and software supply chain risk
• How secure development supports the path to an authorization to operate

Module 4

• Authentication, Access Control, and Data Protection
• Authentication versus authorization
• Multifactor authentication and federal digital identity assurance levels
• Role-based and attribute-based access control and least privilege
• Zero Trust principles applied to web applications
• Protecting data at rest and in transit including FIPS-validated encryption
• Common mistakes such as exposing sensitive data in URLs and weak session management

Module 5

• Monitoring, Incident Response, and Ongoing Compliance
• Continuous monitoring under the Risk Management Framework
• Federal event-logging expectations for incident investigation
• Recognizing and reporting a suspected web application incident
• How FISMA reporting and periodic reauthorization keep systems accountable
• What any employee should do on suspecting a compromise

This course is available for 365 days. You can choose when to start your access period. Once you activate, you will have 365 days to complete it (access the course materials, quizzes, projects and videos). You may request one extension of seven (7) days. Other extension requests will be evaluated on a case-by-case basis. Videos are not downloadable.