Course 7 - Secure SDLC (Software Development Life Cycle) | Episode 2: Malware, Social Engineering, GRC, and Secure Development Practices

In this lesson, you’ll learn about: Security Awareness Training — Secure SDLC Phase 1 1. Security Awareness Training (SAT) FundamentalsSAT is the education process that teaches employees and users about cybersecurity, IT best practices, and regulatory compliance.Human error is the biggest factor in breaches: 95% of breaches are caused by human error.SAT reduces human mistakes, protects sensitive PII, prevents data breaches, and engages developers, network teams, and business users.Topics covered in SAT:Password policy and secure authenticationPII managementPhishing and phone scamsPhysical securityBYOD (Bring Your Own Device) threatsPublic Wi-Fi protectionTraining delivery methods:New employee onboardingOnline self-paced modulesClub-based training portalsInteractive video trainingTraining with certification exams2. Malware & Social Engineering Threats Malware ClassificationsVirus: Infects other files by modifying legitimate hosts (the only malware that infects files).Adware: Exposes users to unwanted or malicious advertising.Rootkit: Grants stealthy, unauthorized access and hides its presence; may require OS reinstallation to remove.Spyware: Logs keystrokes to steal passwords or intellectual property.Ransomware: Encrypts data and demands cryptocurrency payments, usually spread via Trojans.Trojans: Malicious programs disguised as legitimate files or software.RAT (Remote Access Trojan): Allows long-term remote control of systems without the user’s knowledge.Worms: Self-replicating malware that spreads without user action.Keyloggers: Capture keystrokes to steal credentials or financial information.Social Engineering AttacksSocial engineering = manipulating people to obtain confidential information.Attackers target trust because it is easier to exploit than software.5 Common Types:Phishing: Most common attack; uses fraudulent links, urgency, and fake messages.93% of successful breaches start with phishing.Baiting: Offers something attractive (free downloads/USBs) to trick users into installing malware or revealing credentials.Pretexting: Creates a false scenario to build trust and steal information.Distrust Attacks: Creates conflict or threatens exposure to extort money or access.Tailgating/Piggybacking: Attacker physically follows an authorized employee into a restricted area.Defense strategies include:Understanding the difference between phishing and spear phishing.Recognizing that 53% of all attacks are phishing-based.Using 10 email verification steps, including:Check sender display nameLook for spelling errorsBe skeptical of urgency/threatsInspect URLs before clicking3. Governance, Risk, and Compliance (GRC) GRC Components:Governance: Board-level processes to lead the organization and achieve business goals.Risk Management: Predicting, assessing, and managing uncertainty and security risks.Compliance: Ensuring adherence to laws, regulations, and internal policies.Key compliance frameworks:HIPAA — Healthcare data protectionSOX — Corporate financial reporting integrityFISMA — Federal information system standardsPCI-DSS — Secure cardholder data; employees must acknowledge policies in writingISO/IEC 27001 — International information security standardGDPR — EU data privacyCCPA — California privacy law4. Secure Development & Operations Awareness Focused training for developers, security engineers, and network consultants. Core resources include:OWASP Top 10 — Most critical web application security risksSANS CWE Top 25 — Most dangerous software weaknessesOWASP ASVS — Security verification requirements for secure developmentBSIMM — Framework for building and assessing software security programsOWASP Mobile Top 10 — Mobile application security risksAPI and IoT security guidelinesThis training ensures developers write secure code, configure systems safely, and understand modern threats across web, mobile, API, and embedded systems. 5. Continuous Improvement & Organizational RolesSecurity awareness must be continuously updated to address new threats.Security Operations Center (SOC):Monitors systemsDetects and analyzes threatsCoordinates defense and responseInformation Security Communication:Acts as the bridge between business units and IT securityEnsures employees remain informed and educatedProduced by:https://www.podcaistudio.com/