STUDY GUIDE · GKU 3
Software security: development, secure coding, design and algorithms study guide (Cybersecurity)
Most breaches enter through software that was written to work, not to resist an adversary. This unit follows the life of a program. It starts with the development process and the execution model: how requirements become code, how compiled, interpreted and just-in-time languages run it, and where the stack and the heap live. It then narrows to secure coding: validate input at the boundary, keep data out of code, avoid the shell, handle errors without leaking, and review the diff. The design section moves up a level to the principles that make a system defensible before a single function is written — least privilege, fail-safe defaults, complete mediation, separation of privilege, defence in depth, trust boundaries, threat modelling and usable security. The last two sections give the algorithmic vocabulary an examiner expects: growth rates, recurrences, the standard design strategies, P and NP, and the data structures and representations that decide whether a blocklist lookup costs one step or a million. Examples use short listings that can be traced by hand.
Structured by the official ETEC subject standard for this topic: every listed topic and learning outcome, with formulas, figures and worked examples. The full sections are available to members in the app.
SKU 3.1 · Basic scripting and programming
Software design, development and execution models
The software life cycle and its waterfall, iterative and DevOps arrangements; compiled, interpreted and JIT execution; the stack and heap; variables, conditions, loops, functions, exceptions and concurrency; and the security consequence of each.
Secure coding and debugging techniques
Input validation with allow-lists, output encoding, parameterised queries, command injection, path traversal, unsafe deserialisation, secrets management, error handling, logging, dependency pinning, memory safety and code review, with vulnerable and fixed Python pairs.
SKU 3.2 · Cybersecurity design principles
Secure system design, access control and usable patterns
The Saltzer and Schroeder principles, defence in depth, trust boundaries, STRIDE threat modelling, access-control models, secure design patterns and usability, with flaws mapped to the principle each violates.
SKU 3.3 · Algorithms and data structures
Algorithm analysis, strategies and complexity classes
Big-O, Omega and Theta, growth rates, best and worst case, recurrences, divide and conquer, greedy, dynamic programming, sorting and searching, P and NP, decidability and the security uses of each.
Data structures and data representation
Arrays, linked lists, stacks, queues, hash tables, trees, heaps, graphs, sets and Bloom filters, their trade-offs for blocklists and session stores, and binary, hexadecimal, two's complement, text encodings, endianness and serialisation security.
MORE CYBERSECURITY GUIDES
- Cybersecurity foundations: principles, threats, risk and governance study guideGKU 1 · 3 sections
- Data security: cryptography, forensics and databases study guideGKU 2 · 6 sections
- Component security: architecture, vulnerabilities and environments study guideGKU 4 · 2 sections
- Network security study guideGKU 5 · 5 sections
- System security study guideGKU 6 · 4 sections
- Human security: threat actors, techniques and awareness study guideGKU 7 · 2 sections
- Organisational security: ethics, law, risk and economics study guideGKU 8 · 3 sections