Applications and APIs form the backbone of digital services, enabling everything from online banking to global supply chains. Students study common weaknesses cataloged in the OWASP Top 10, including injection, misconfiguration, and weak session management, as well as the specific risks of mobile and API security. Case studies of T-Mobile and Peloton highlight how weak APIs expose sensitive data, while the persistence of SQL injection shows that technical knowledge alone is not enough—cultural and organizational discipline are required.

Attention is also given to testing methodologies such as static, dynamic, and interactive analysis, as well as runtime protections. Learners explore the secure software development lifecycle, where security is embedded from design through deployment. By the end of this week, students will appreciate that application security is both technical and cultural, demanding governance, training, and communication alongside tools and frameworks.
 Produced by BareMetalCyber.com