Back to roadmap
Application security

Application Security Study Plan

A milestone-based AppSec roadmap for shift-left security, threat modeling, secure code review, secure design, developer enablement, SDL, OWASP Web, and API security.

Use this after Common Security Skills. AppSec is not just pentesting: it blends developer thinking, attacker mindset, design review, code review, and security program work.

Expected pace

6-12 months

Entry-level fundamentals.

AppSec mindset

AppSec is not pentesting or generic web security.
Think like both developer and attacker.
Talking to developers, training them, and reading code should feel normal.
AppSec can be tougher than pentesting depending on scope.
Write code for PoCs, exploits, or demos with comfort.
API security should be a core area of interest.
IAM knowledge helps with auth-related design and reviews.
Web Security Study PlanAPI Security Study PlanIAM Security Study PlanMobile Application Security
Web Application ConceptsThreat ModelingSecure Code ReviewCryptographySecurity Development LifecycleBooksVideosCoursesCertificationsInterview QuestionsApplication Security ToolsWhom to Follow on Twitter

Section 1

Web Application Concepts

6 weeks

Learn web security fundamentals from a defender's lens: HTTP, headers, CSRF, injection, JWT, crypto, hashing, encoding, SAST, SCA, and mitigation patterns.

Week 1-2: Basics

HTTP methods, PUT vs POST, UPDATE vs PATCH, and OPTIONS methodHTTP response status codes
Analyze what 200 means after malicious input.
Understand what to do after 403.
Trigger and understand 500 responses and what they reveal.
Learn status codes pentesters and defenders should care about.
HTTP headers, especially response headers
TCP 3-way handshake.
How SSL works.
Cybersecurity terminologiesEssential security concepts

Week 3-4: Security Concepts

Use OWASP Cheat Sheet Series to learn what each issue is, how exploitation works, and how mitigation works.

OWASP Cheat Sheet Series
Authentication and authorization implementation, exploitation, mitigation, and defense.
Sessions and cookies: behavior, vulnerabilities, bypasses, and exploitation.
Session Management Cheat Sheet
XSS from exploit and mitigation perspectives.
REST concepts like CRUD.
SQLi, RFI, LFI, and RCE injection classes.
Mass assignment.
Rate limit, bruteforce, replay attack, MITM, session fixation, session hijack, and credential stuffing.
CORS concepts.
SSRF prevention.
JWT tokens in depth.
Encoding, decoding, and hashing basics.
Cryptography and application implementation.
SAST vs SCA.

Week 5-6: Advanced Application Security Skill Sets

OWASP Top 10 for Web 2021OWASP Top 10 for API 2019OWASP Secure Code Review GuideOWASP ASVSOWASP SAMMUseful for architect pathBOLA causes and testingBFLA causes and testing
Weak cipher suites: test and educate developers.
Authentication Cheat SheetAuthorization Cheat Sheet
Advanced SQL injection.
XML Security Cheat Sheet
JSON injection.
SAML Security Cheat Sheet
LDAP injection.
NoSQL injection.
GraphQL Cheat SheetXXE Prevention Cheat SheetServer-side template injectionDeserialization Cheat SheetContent Security Policy Cheat Sheet

Section 2

Threat Modeling

2-3 weeks

Threat modeling is core AppSec work for finding design risks before implementation.

Threat Modeling Study Plan

Section 3

Secure Code Review

6-8 weeks

Secure code review helps AppSec engineers find security flaws directly in source code.

Secure Code Review Study Plan

Section 4

Cryptography

3 weeks

Cryptography knowledge helps with implementation reviews, storage, transport, secrets, and auth design.

Cryptography Study Plan

Section 5

Security Development Lifecycle

4 weeks

SDL ties AppSec work into planning, design, development, testing, release, and training.

Secure SDLC Study Plan