Welcome to the OCSD curriculum repository. OWASP Certified Secure Developer (OCSD) is a proposed foundation-level certification focused on web application security for developers. This repository contains the curriculum being developed by the OWASP OCSD working group, supporting references, and sample assessment questions. This is the official OWASP project link: https://owasp.org/www-project-certified-secure-developer/
This repository is a curriculum-development resource, not an exam registration service or a finalized certification handbook.
OCSD is intended for web application developers who want to demonstrate foundational security knowledge and for hiring managers who need to assess that knowledge.
This certification program is an answer to the questions a hiring manager for a developer might ask, to validate security knowledge of the candidate. It is also for the developers who want to showcase their skills in developing secure code.
Remember:
- Writing secure code != testing the security of code with tools
- If developers do not put security in the code, no one else will
The questions we may want to ask are:
- If I am hiring a web application developer, what are the security-related skills I would look for?
- If I were a web application developer, what security skills would I like to be validated for?
CONTRIBUTING explains the structure of this repository.
Here are the curriculum modules that the working group for OCSD has arrived at:
- Secure Design, Architecture and Threat Modeling
- Authentication and Credential Management
- Authorization
- Input Validation and Output Encoding
- Cryptography and Key Management
- Error Handling
- Secure Logging
- Data Protection and Privacy
- Secure Communications
- Software Supply Chain Security
- Business Logic Security
- Secure File and Resource Handling
- API and Web Service Security
- Secure Configuration and Deployment
- Security of and for AI
- Secure Developer Environment and Security Awareness
The curriculum prioritizes established OWASP resources and projects, but the working group is open to include other open-source materials too, if the license is suitable for our use case.
Here is an excerpt of OWASP projects that we are referencing:
- https://owasp.org/www-project-application-security-verification-standard/
- https://cheatsheetseries.owasp.org/index.html
- https://devguide.owasp.org/
- https://owaspsamm.org/
- https://owasp.org/www-project-mobile-app-security/
- https://owasp.org/www-project-top-ten/
- https://owasp.org/www-project-web-security-testing-guide/
- https://owasp.org/www-project-code-review-guide/
Contributions can improve the certification objectives, clarify the body of knowledge, add relevant references and teaching examples, or review sample questions. Please read the contributing guidelines before submitting any changes (PRs), and keep module revisions separate from repository-wide changes. For proposals that affect the whole curriculum, please open a GitHub issue first.