Module 1: Secure Software Architecture

7 dot points across 2 inquiry questions, in syllabus order. Each dot point has a focused answer, with exam-style questions and worked answers where available.

Inquiry Question 1: How are secure systems designed?

Describe how hashing and salting protect stored passwords, and identify weaknesses in storing passwords in plain text or with reversible encryption

Password hashing. Why passwords are hashed and not encrypted, salting, slow hash functions like bcrypt, the worked example, and the traps markers look for.

5 min read →

Explain the role of authentication and authorisation in restricting access to a system, and identify common implementation methods including multi-factor authentication and role-based access control

Authentication and authorisation. The difference between the two, multi-factor authentication, role-based access control, the worked SaaS-app example, and the traps markers look for.

6 min read →

Compare symmetric and asymmetric encryption, and describe their roles in securing data in transit and at rest

Encryption. Symmetric (AES) versus asymmetric (RSA), where each is used, how HTTPS combines them, the worked example, and the traps markers look for.

6 min read →

Describe how the confidentiality, integrity and availability (CIA) triad is applied to the design of secure software

CIA triad. Confidentiality, integrity, availability, how each is enforced in a real system, the worked banking-app example, and the traps markers look for.

5 min read →

Inquiry Question 2: How can the security of a developed solution be evaluated?

Identify the OWASP Top 10 web application security risks and describe mitigations for each

OWASP Top 10. Each risk, an example, and a mitigation, the worked broken-access-control example, and the traps markers look for.

7 min read →

Describe the secure development lifecycle, including threat modelling, secure coding practices, security testing and ongoing monitoring

SDLC. Threat modelling, secure coding standards, code review, SAST and DAST tools, penetration testing, ongoing monitoring, and the traps markers look for.

9 min read →

Apply input validation, sanitisation and output encoding to defend against injection attacks

Input validation. Allow-list vs deny-list, sanitisation, output encoding, parameterised queries, the worked SQL injection example, and the traps markers look for.

6 min read →