Modern computer systems are almost universally connected, which creates wider attack surfaces well beyond code to users, hardware, and more. Securing systems is thus a fundamental skill for modern software engineers.

This course is a comprehensive introduction to cyber security best practices. You’ll start with an overview of common threats and vulnerabilities, as well as high-level concepts like privilege, integrity, logging, and mediation. With these concepts in mind, you’ll then learn common protection mechanisms and defense strategies from endpoint protection to firewalls, gateways, and proxy servers. Next, you’ll learn monitoring and detection techniques, alerts, and event management. Finally, when you detect a threat, you’ll know how to respond with support tickets, data preservation, and change management.

By the end of this course, you’ll have a better understanding of modern cyber security practices and a clear roadmap to implementing these as a developer.

Cyber Security Best Practices for Developers

**Digital certificates** are a way to give entities digital identities. It’s the digital equivalent of signing paper checks.

## Creating a public-private key

First, a public-private key pair needs to be made to create a digital signature. There are several tools—both open source and vendor—available to do this.

## Importance of the private key

The private key used to create digital certificates needs to be protected, and the keys for those certificates shouldn’t be exportable. This means the private key can’t be extracted from the certificate. If the key can be copied, it’s difficult to verify the authenticity of anything done with the key, such as authentication or code signing.

## Generating a certificate request

The next step to obtain a digital certificate is to generate a certificate request, also known as a **certificate signing request (CSR)**. The private key is used to generate a CSR and once created, it’s sent to a **certificate authority (CA)**. The CA needs to be trustworthy if we want other people, software, web browsers, and operating systems to consider any certificate it creates as valid. By default, web browsers trust a slew of certificate authorities, meaning any HTTPS website that uses a certificate signed by one of these trusted CA’s is also considered trustworthy by proxy. 

> **Note:** Have a look at the list of CA’s that your web browser trusts by going to the browser settings. You might be surprised at some of the CA’s that are trusted by default.




**Digital certificates** are a way to give entities digital identities. It’s the digital equivalent of signing paper checks.

# Creating a public-private key

First, a public-private key pair needs to be made to create a digital signature. There are several tools—both open source and vendor—available to do this.

# Importance of the private key

The private key used to create digital certificates needs to be protected, and the keys for those certificates shouldn’t be exportable. This means the private key can’t be extracted from the certificate. If the key can be copied, it’s difficult to verify the authenticity of anything done with the key, such as authentication or code signing.

# Generating a certificate request

The next step to obtain a digital certificate is to generate a certificate request, also known as a **certificate signing request (CSR)**. The private key is used to generate a CSR and once created, it’s sent to a **certificate authority (CA)**. The CA needs to be trustworthy if we want other people, software, web browsers, and operating systems to consider any certificate it creates as valid. By default, web browsers trust a slew of certificate authorities, meaning any HTTPS website that uses a certificate signed by one of these trusted CA’s is also considered trustworthy by proxy. 

> **Note:** Have a look at the list of CA’s that your web browser trusts by going to the browser settings. You might be surprised at some of the CA’s that are trusted by default.




Learn about the importance of digital certificates in providing credibility to various entities, including how to create them and their properties.

Introduction

Basics of Security

Detect

Protect

Respond

Conclusion

Digital Certificates

Creating a public-private key

Importance of the private key

Generating a certificate request