Course Description:

The Security Development Lifecycle training course and workshop was created specifically for developers of industrial control system products with a particular focus on network-enabled embedded control system products such as PLCs, DCSs, SISs, RTUs, VFDs, etc.  The objective of this course is to train R&D teams, through a combination of lecture and workshop, on how to properly and effectively integrate software security assurance practices and techniques into their existing software development lifecycle. The training covers all phases of IEC 62443-4-1 (Product Development Lifecycle Requirements) as well as IEC 62443-4-2 (Technical Security Requirements for IACS components), and the ISASecure™ Software Development Security Assurance (SDSA) certification program.

Agenda:

1. Security Development Lifecycle Introduction
2. PC & Networking Best Practices
3. System Integration and Maintenance
4. Security Management Process
5. Software Exploitation
6. Security Requirements
7. Software Architecture Design
8. Threat Modeling Training
9. Module Implementation and Verification
10. Security Integration Testing
11. Security Validation Testing
12. Incident response Planning and Execution
13. Document Security Guidelines