Merge pull request #6 from NovatecConsulting/security

feat: added security part resources
NovatecConsulting · Dec 9, 2023 · 004ec6d · 004ec6d
2 parents 1b2f854 + ea405b7
commit 004ec6d
Show file tree

Hide file tree

Showing 8 changed files with 63 additions and 0 deletions.
diff --git a/1_security/1_theorie/Anwendungssicherheit.md b/1_security/1_theorie/Anwendungssicherheit.md
@@ -0,0 +1,63 @@
+# Anwendungssicherheit
+
+![Übersicht](../99_assets/images/appsec_overview.png)
+
+## Planung
+
+### Methoden zum Planen sicherer Anwendungen:
+
+* Threat Modeling
+  1. Anwendung zerlegen
+  2. Bestimmen Sie Vermögenswerte und Sicherheitsziele
+  3. Ermitteln Sie Bedrohungen
+  4. Bedrohungen einstufen
+  5. Bestimmen Sie Gegenmaßnahmen und Schadensbegrenzung
+
+## Coden
+
+### Sichres Design: Die wichtigsten Sicherheitsprinzipien
+* Geringstes Privileg 
+* Aufgabentrennung 
+* Verteidigung in der Tiefe 
+* Sicher scheitern 
+* Offenes Design 
+* Sicherheit durch Dunkelheit vermeiden 
+* Minimierung der Angriffsfläche
+
+### Nützliche Ressourcen für Entwickler
+[OWASP Web Security Top 10](https://owasp.org/www-project-top-ten/)
+
+[OWASP API Security Top 10](https://owasp.org/API-Security/editions/2023/en/0x00-header/)
+
+## Bauen & Testen
+
+![Testing Pyramide](../99_assets/images/testing_pyramide.png)
+
+### ToDo's für jeden Layer der Pyramide
+
+* Static Application Security Testing (SAST)
+  ![SAST](../99_assets/images/SAST.png)
+
+
+* Dynamic Application Security Testing (DAST)
+  ![DAST](../99_assets/images/DAST.png)
+
+
+* Security Tools für die CI-/CD-Pipeline
+  ![CICD Tooling](../99_assets/images/CICD_tools.png)
+
+
+* Code Reviews
+
+
+* Pentests
+  ![Pentestflow](../99_assets/images/pentest_schritte.png)
+
+
+* Software Composition Analysis (SCA)
+  ![SCA](../99_assets/images/SCA.png)
+
+### Nützliche Ressourcen für Entwickler
+[OWASP Websecurity Testing Guide](https://owasp.org/www-project-web-security-testing-guide)
+
+[OWASP Security-C4PO Anwendung](https://owasp.org/www-project-security-c4po/)
diff --git a/1_security/99_assets/images/CICD_tools.png b/1_security/99_assets/images/CICD_tools.png
diff --git a/1_security/99_assets/images/DAST.png b/1_security/99_assets/images/DAST.png
diff --git a/1_security/99_assets/images/SAST.png b/1_security/99_assets/images/SAST.png
diff --git a/1_security/99_assets/images/SCA.png b/1_security/99_assets/images/SCA.png
diff --git a/1_security/99_assets/images/appsec_overview.png b/1_security/99_assets/images/appsec_overview.png
diff --git a/1_security/99_assets/images/pentest_schritte.png b/1_security/99_assets/images/pentest_schritte.png
diff --git a/1_security/99_assets/images/testing_pyramide.png b/1_security/99_assets/images/testing_pyramide.png