Training and Awareness for Application Security

What it is

Developers write the code that runs in the cloud, so their knowledge is a security control. Training and awareness give them the cloud development basics, warn them about common pitfalls, and teach the well known vulnerability lists that describe how applications are attacked.

The CCSP professional advocates for this training. The aim is fewer flaws written in the first place, not more flaws found later.

How it works

Cloud development basics

Cloud applications differ from traditional ones in ways that change security:

• Everything is an API: services talk over networks through authenticated calls, and the management plane itself is an API.
• Infrastructure as code: templates create networks, storage and permissions, so a code error can be a security misconfiguration.
• Shared responsibility: developers must know which security tasks the platform does and which they must do.
• Statelessness and scale: instances come and go, so sessions, secrets and logs cannot depend on a single server.
• Managed services: databases, queues and identity are consumed as services and configured rather than installed.

Common pitfalls

OWASP Top 10

The OWASP Top 10 is an awareness list of the most critical web application security risks. The 2021 edition is:

OWASP has since released a newer edition that keeps Broken Access Control first and gives software supply chain failures more weight. Learn the risks rather than the numbering. SSRF is especially dangerous in cloud, where a server can be tricked into calling an internal metadata service that hands out credentials.

OWASP ASVS

The Application Security Verification Standard is not a top risks list but a set of testable security requirements. It has three levels: Level 1 for basic assurance, Level 2 for most applications handling sensitive data, and Level 3 for the most critical applications. Teams use it as both requirements and a testing checklist.

OWASP API Security Top 10

APIs are the main interface of cloud applications. The 2023 edition lists:

Broken object level authorization means changing an ID in a request, such as /invoices/1001 to /invoices/1002, returns another user's data.

OWASP Top 10 for LLM Applications

The 2025 list covers Prompt Injection, Sensitive Information Disclosure, Supply Chain, Data and Model Poisoning, Improper Output Handling, Excessive Agency, System Prompt Leakage, Vector and Embedding Weaknesses, Misinformation and Unbounded Consumption. It matters wherever applications call large language models.

SANS and CWE Top 25

The CWE Top 25 Most Dangerous Software Weaknesses, published by MITRE and long promoted with SANS, ranks common coding weaknesses such as cross-site scripting, out of bounds write, SQL injection and missing authorization. It speaks the language of root causes (CWE IDs), which suits developer training.

A worked example

A fintech company's new API passes functional testing, but a bug bounty researcher retrieves other customers' statements by incrementing an account number in the URL. The developers had never heard of object level authorization.

Beyond fixing the code, the security lead introduces mandatory training on the OWASP API Security Top 10, adds ASVS Level 2 requirements to every new API story, and makes "authorization check per object" a code review item.

How the exam asks about this

• "Which OWASP resource provides testable security requirements at three levels?" The Application Security Verification Standard.
• "An attacker changes a record ID in an API call and receives another user's data. What is this?" Broken object level authorization.
• "What is the MOST effective way to reduce recurring coding flaws?" Developer security training combined with secure coding standards.