OWASP Certified Secure Developer (OCSD)

Welcome to the OCSD curriculum repository. The scope of this certification is Web Application Security. The OCSD is a foundation-level exam. This is the official OWASP project link: https://owasp.org/www-project-certified-secure-developer/

This certification program is an answer to the questions a hiring manager for a developer might ask, to validate security knowledge of the candidate. It is also for the developers who want to showcase their skills in developing secure code.

Remember:

• Writing secure code != testing the security of code with tools
• If developers do not put security in the code, no one else will

The questions we may want to ask are:

• If I am hiring a web application developer, what are the security related skills I would look for?
• If I were a web application developer, what security skills would I like to be validated for?

CONTRIBUTING explains the structure of this repository.

Curriculum Modules

Here are the curriculum modules that the working group for OCSD has arrived at:

1. Secure Architecture and Threat Modeling
2. Authentication and Credential Management
3. Authorisation
4. Input Validation and Output Encoding
5. Cryptography and Key Management
6. Error Handling
7. Secure Logging
8. Data Protection and Privacy
9. Secure Communications
10. Software Supply Chain Security
11. Business Logic Security
12. Secure File and Resource Handling
13. API and Web Service Security
14. Secure Configuration and Deployment
15. Security of and for AI
16. Secure Developer Environment and Security Awareness

Body of Knowledge

We try to include references to established OWASP projects first, but are open to other open-source materials too, if the license is suitable for our use case. Here is an excerpt of OWASP projects that we are referencing:

• https://owasp.org/www-project-application-security-verification-standard/
• https://cheatsheetseries.owasp.org/index.html
• https://devguide.owasp.org/
• https://owaspsamm.org/
• https://owasp.org/www-project-mobile-app-security/
• https://owasp.org/www-project-top-ten/
• https://owasp.org/www-project-web-security-testing-guide/
• https://owasp.org/www-project-code-review-guide/