---
# System prepended metadata

title: Untitled

---

1. Threat Modeling - Nikita
	- task:
		- study threat modeling concepts (reference materials)
		- perform threat modeling for a typical web application
	- todo:
		- preparation 21 Feb - 27 Feb
2. Code analysis 1 (defensive)
	- task:
		- study coding secure practices (reference materials)
		- fix code snippets in a defensive way
	- todo:
		- preparation 7 Mar - 13 Mar
		- prepare code snippets - in C lang (optional) and in Java >= 150 LoC
3. Code analysis 2 (secure design)
	- task:
		- study security by design practices (reference materials)
		- fix code snippets in a DDD way practising good design
	- todo:
		- preparation 14 Mar - 20 Mar
		- prepare code snippet in Java appx 2000-5000 LoC that would contain design vulnerabilities from "Secure by design"
4. IAM (Keylock) - Nikita 
	- task:
		- setup keylock and integrate it with some sample app
		- add role based access control to the app
		- add another sample app and enable SSO that works in both apps
	- todo:
		- preparation 28 Feb - 6 Mar
5. Security Testing - Anna
	- task:
	    - study basic OWASP threats and testing against them
		- either design test requirements for some typical test (against XSS or MillionLaugh) or find problems in an existing code snippet
	- todo:
		- read for inspiration https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing. Describe the situation "as a security specialist you see that input is passed as an XML file. Component owner says that they tested it against bad XML. But you need to check..."
6. Secure API design - Anna
	- task:
		- analyze weaknesses of API presented in Swagger
		- propose fixes and role model
	- todo:
		- prepare a swagger of bookstore with the following weaknesses:
		    - no role modes
		    - only basic auth
		    - only HTTP (not HTTPS)
		    - credit cards details passed in a plain (? optional, payment could be out of the scope)



