An all-encompassing, opinionated cybersecurity curriculum designed for enterprise use at software companies using the Elixir programming language.
关于 | Curriculum | Usage | Contributing | License
Originally developed for Podium's Elixir engineers by its Product 安全 team, the ESCT was designed to be integrated into developer onboarding processes - teaching developers about Application 安全 using context that applies to them.
The content originally focused exclusively on what technology Podium uses, but quickly grew to encapsulate more areas of Application 安全. The material itself is composed of views from the Product 安全 team at Podium as well as information sourced from reputable public information - attribution has been given wherever possible.
Today, individuals or companies wishing to try out the ESCT can and are encouraged to fork a copy of their own - please follow the relevant instructions below depending on your use case.
If you find an issue, wish to suggest an idea, or start a discussion; please see our CONTRIBUTING Guide!
Currently the curriculum is broken into the following 8 primary topics, each containing multiple lessons:
- OWASP
- OWASP Top 10
- Secure SDLC
- No Secrets In Code
- Making Secret Rotation Easy
- Rate Limiting
- Principle of Least Privilege
- GraphQL 安全
- Disabling Introspection
- Error Disclosure
- Resource Exhaustion
- Cost Theory
- Elixir 安全
- Atom Exhaustion
- Protecting Sensitive Data
- Untrusted Code
- Timing Attacks
- Boolean Coercion
- Cookie 安全
- Ingredients of a Cookie
- The Perfect Cookie
- Elixir Phoenix Cookies
- 安全 Anti-Patterns
- 安全 Through Obscurity
- Frontend Authorization Checks
- CI/CD Tooling
- Sobelow
- Salus
- Semgrep
- Sobelow
- The Secure Road
- Service to Service Authentication
- User Authorization
If you do not see a topic or lesson you would like covered, please review our open issues and our CONTRIBUTING Guide before opening a new issue - but we encourage requests!
Using the ESCT as a consumer of the content is easy by just following these simple steps:
- 复刻 this repo into a space you control
- Important to note: if you were instructed to use this course by your company, double check with the folks who are running things for your company to ensure they don't have a customized version of the training materials
- Clone your forked repo
- Load the Live Markdown files in an instance of Livebook
- For further instructions on getting Livebook setup locally, please refer to their documentation.
- Complete the training as instructed and save your progress along the way!
- Feedback will be provided directly within Livebook via the "Graded Cell" smart cell
Using the ESCT as a purveyor of the curriculum is relatively straight-forward:
- Determine if you need to customize the content to better suit your business - whether that's changing the contents to reflect internal only information or if you simply want to remove modules your engineers won't find useful.
- If you determine that you wish to customize the content, fork the repository into your companies VCS with the necessary adjustments made.
- In the future, there may need to be additional configuration steps regarding establishing configuration secrets for reporting purposes - at which you would also do that at this time.
- Instruct your workforce to follow the "Learners" instructions above using whichever version of the ESCT you would rather them use
Please refer to our CONTRIBUTING Guide for more details on how to add to this project!
In addition to our contributors, this library receives support and maintenance from TV Labs
