Unit 5: Securing Applications and Data
Unit Overview
Unit 5 focuses on securing applications and data, representing the final layer in a comprehensive defense-in-depth strategy. Students learn about application vulnerabilities, cryptographic techniques, and data protection methods. The unit emphasizes the importance of securing both the applications that process data and the data itself, covering symmetric and asymmetric cryptography, hashing, and application security best practices.
Students engage with professional scenarios that demonstrate how cybersecurity professionals protect applications and sensitive data in organizational environments.
Lessons in This Unit
5.1 Application and Data Vulnerabilities and Attacks
Identify common vulnerabilities in applications and data systems, and understand how adversaries exploit these weaknesses.
5.2 Protecting Applications and Data: Managerial Controls
Learn about policy-based controls and management practices used to secure applications and protect sensitive data.
5.3 Protecting Stored Data: Cryptography
Explore symmetric cryptography and its role in protecting data confidentiality and integrity.
5.4 Asymmetric Cryptography
Understand public key cryptography, digital signatures, and how asymmetric cryptography enables secure communications.
5.5 Protecting Applications
Learn about secure coding practices, application security testing, and protective measures for software systems.
5.6 Detecting Attacks on Data and Applications
Understand monitoring techniques and tools used to identify attacks targeting applications and data systems.
Course Skills Emphasized
- Skill 1.A: Identify, with and without the support of AI, vulnerabilities, threats, and attack methods, and explain how they generate risk.
- Skill 1.B: Determine ways adversaries exploit vulnerabilities to compromise an asset.
- Skill 2.A: Identify security controls, and explain how they mitigate risks.
- Skill 2.B: Determine layered security controls that address vulnerabilities.
- Skill 2.C: Evaluate, with and without the support of AI, the impact of protective risk-management strategies.
- Skill 3.A: Identify methods for monitoring systems, and explain how they detect attacks.
- Skill 3.D: Detect and classify cyberattacks by analyzing digital evidence with and without the support of AI.
Key Topics Covered
- Application vulnerabilities (injection attacks, broken authentication, sensitive data exposure)
- Data classification and handling procedures
- Symmetric cryptography (AES, data encryption)
- Asymmetric cryptography (RSA, public key infrastructure)
- Cryptographic hashing and digital signatures
- Secure coding practices and application security testing
- Database security and access controls
- Data loss prevention (DLP) systems
- Application firewalls and security gateways
- Security monitoring and logging for applications
- Incident response for data breaches
- Compliance and regulatory requirements for data protection