Standards, References and Glossary

References for further study and the course glossary.

Standards and References

Use official and maintained sources. Check the current edition and applicability before using a reference as a compliance requirement.

OWASP Top 10 — awareness of common web application risks.

OWASP ASVS — verifiable application security requirements.

OWASP Cheat Sheet Series — practical implementation guidance.

OWASP API Security Top 10 — API-specific risk categories.

NIST SSDF (SP 800-218) — secure software development practices.

NIST CSF — cybersecurity risk management framework.

CWE — common weakness taxonomy.

CVE — identifiers for publicly disclosed vulnerabilities.

CVSS — vulnerability severity scoring framework.

RFC 8446 — TLS 1.3.

RFC 6749 and current OAuth security best-current-practice guidance — OAuth 2.0.

OpenID Connect Core — identity layer on OAuth 2.0.

FIDO Alliance / W3C WebAuthn — phishing-resistant authentication ecosystem.

SPDX and CycloneDX — SBOM formats.

ISO/IEC 27001 — information security management systems.

ISO/SAE 21434 — road-vehicle cybersecurity engineering, where applicable.

Glossary

AEAD: authenticated encryption with associated data.

API: application programming interface.

AppSec: application security.

ASVS: Application Security Verification Standard.

ABAC/RBAC/ReBAC: attribute-, role-, and relationship-based access control.

BOLA/IDOR: broken object-level authorization / insecure direct object reference.

CORS: Cross-Origin Resource Sharing.

CSP: Content Security Policy.

CSRF: cross-site request forgery.

CWE/CVE/CVSS: weakness classification / vulnerability identifier / severity scoring.

DAST/SAST/SCA: dynamic analysis / static analysis / software composition analysis.

HMAC: keyed-hash message authentication code.

IAM: identity and access management.

IaC: infrastructure as code.

MFA: multi-factor authentication.

OIDC: OpenID Connect.

PKCE: Proof Key for Code Exchange.

SBOM: software bill of materials.

SDLC/SSDLC: software development lifecycle / secure software development lifecycle.

SSRF: server-side request forgery.

TLS: Transport Layer Security.

TOCTOU: time-of-check to time-of-use.

XSS: cross-site scripting.

Zero Trust: security approach that avoids implicit trust based solely on network location.