A solid 2010-era defensive-security syllabus (NIST/ISO standards, RBAC/ABAC, DES/AES/RSA, IDS/IPS, syslog/SIEM) that prepares the student to think like a security analyst — but leaves the modern security engineer's day-to-day vocabulary (OWASP Top 10, TLS, OAuth/OIDC/SAML, threat modeling, zero trust, secrets management, Argon2, PCI/SOC2) as named-but-not-taught.
OWASP Top 10 web-application risks (enumerate-and-map)
The course names OWASP twice but never enumerates the list. Ch4 Slide 1 (speaker notes) cites 'The Open Web Application Security Project's 2021 report [OWAS21] on the 10 most critical Web application security risks listed broken access control in first place,' and Ch2 Slide 1 cites the same report listing 'cryptographic failures ... as the second highest risk.' Two of the ten categories are already implicitly framed by the existing access-control and cryptography units. Conceptual extension: dedicate one slide that enumerates the 2021 OWASP Top 10 categories and maps each back to a unit already in the course (A01 Broken Access Control → Ch4; A02 Cryptographic Failures → Ch2; A07 Identification & Authentication Failures → Ch3; A09 Logging & Monitoring Failures → Ch18; etc.). This stays at the principles/mechanism level required by the depth bound and turns two passing references into an organising framework. 10 of 12 security postings explicitly demand it.
TLS handshake, certificate validation, and modern transport security configuration
TLS is named only once in the course — Ch2 Slide 28 lists 'X.509 certificates are used in most network security applications, including IP Security (IPsec), Transport Layer Security (TLS), Secure Shell (SSH), and Secure/Multipurpose Internet Mail Extension (S/MIME).' The course already teaches the underlying primitives (X.509, RSA/ECC, AES, HMAC, digital signatures, certificate authorities). Conceptual extension: add 1–2 slides explaining the TLS handshake as an application of those primitives — server-cert validation chain, ephemeral key agreement (Diffie-Hellman), AEAD record-layer encryption — plus one slide on common deployment failures (expired certs, weak ciphers, downgrade) and the role of mTLS in zero-trust architectures. No protocol implementation work is needed; this stays at the mechanism level. 9 of 12 security postings demand TLS competence.
OAuth 2.0 / OpenID Connect federated identity flows
The course already teaches the conceptual framework that OAuth/OIDC implements but never names the protocols. Ch3 Slide 5 introduces the NIST SP 800-63-3 model with 'Registration authority (RA), Credential service provider (CSP) ... Relying party (RP) ... Verifier ... Authenticated assertion between RP and verifier' — these are exactly the OAuth/OIDC roles (Authorization Server, Resource Server, Relying Party). Ch3 Slide 32 then walks through a concrete redirect-based authentication flow for the German eID. Conceptual extension: present OAuth 2.0 (authorization-code + PKCE) and OIDC ID tokens as the dominant web realisation of the NIST 800-63-3 federation roles already taught — at the mechanism/sequence-diagram level used elsewhere in the chapter. 9 of 12 security postings explicitly require OAuth.
SAML / SSO federation patterns
Same partial-coverage anchor as OAuth/OIDC — Ch3 Slide 5's NIST 800-63-3 'Identity proofing ... assertion about the identity of the subscriber to the relying party' is the SAML assertion model in textbook form. Ch3 Slide 36 already discusses 'WebAuthn ... user agent, such as a web browser ... as an intermediary between the authenticator and the authenticating service' — the same broker pattern SAML uses. Conceptual extension: add one slide presenting SAML SP-initiated SSO as an XML-based realisation of the same RP/IdP/verifier triad, contrasted against OIDC for protocol selection. Stays at the protocol-flow level the course already uses. 6 of 12 security postings demand it.
Threat modeling methodologies (STRIDE, systematic attack-tree analysis)
The course teaches the raw materials of threat modeling but never names the methodology. Ch1 Slide 22 already presents 'An Attack Tree for Internet Banking Authentication' with an explicit hierarchical breakdown (User credential compromise → Malicious software installation → Vulnerability exploit, etc.), and Ch14 Slide 23 'Threat Sources' frames threats by 'Motivation / Capability / Resources / Probability of attack / Deterrence' and cites NIST SP 800-30 threat-source taxonomy. Conceptual extension: introduce STRIDE (Spoofing/Tampering/Repudiation/Information disclosure/DoS/Elevation of privilege) as a structured threat-elicitation taxonomy that complements the attack tree already taught, and walk through one worked example using the Ch14 Silver Star Mines case study. No tool-specific lab work needed. 7 of 12 security postings demand it; this is one of the most universally listed core skills for security engineers.
Zero-trust architecture (perimeter-less access, continuous verification)
The course already teaches the principles that zero trust operationalises but stops at the classical perimeter-defence model. Ch9 Slide 8 explicitly states firewalls' limits — 'cannot protect against attacks bypassing firewall ... may not protect fully against internal threats ... laptop ... may be infected outside the corporate network and then used internally' — and Ch9 Slide 30 notes 'enterprise endpoint, including desktop and laptop systems, as the main target.' Ch1 Slide 17 already teaches 'Complete mediation: Every access must be checked against the access control mechanism' and 'Least privilege.' Conceptual extension: present zero-trust architecture as the architectural realisation of complete mediation + least privilege in a perimeter-less / cloud era — every request authenticated, authorised, and encrypted regardless of network location. Builds directly on slides already in the course; no specific vendor framework needed. 6 of 12 security postings list it.
Secrets management as a discipline (centralised vaults, rotation, scoping)
The course teaches cryptographic key management but stops short of operational secrets management. Ch15 Slide 19 (NIST SP 800-53 family 'System and Communications Protection') explicitly lists 'Cryptographic Key Establishment and Management' as a control family, Ch2 Slide 33 discusses 'effective encryption key management scheme' for data at rest, and Ch3 covers shadow password files (separating credentials from application code). Conceptual extension: extend the existing key-management slides by introducing the modern operational pattern — central secrets store, short-lived credentials, automated rotation, machine identity — as the contemporary realisation of the NIST 800-53 key-management control. Stays at the mechanism level (no Vault / AWS-KMS lab walkthrough needed). 8 of 12 security postings demand it.
Argon2 password hashing (modern PHC-winner alongside bcrypt)
The course already teaches the password-hash progression but stops in 1999. Ch3 Slide 15 explicitly enumerates 'crypt(3) ... MD5 ... OpenBSD uses Blowfish block cipher based hash algorithm called Bcrypt ... Bcrypt also includes a cost variable; an increase in the cost variable causes a corresponding increase in the time required.' Conceptual extension: extend that same slide to include Argon2 (Password Hashing Competition winner, 2015) as the current OWASP-recommended algorithm, with a one-sentence note on its memory-hard parameters (m, t, p) and why memory-hardness defeats GPU/ASIC attacks of the kind already discussed on Slide 17 ('AMD Radeon HD7970 GPU ... 8.2 × 10⁹ password combinations each second'). Pure conceptual extension of an existing slide. 5 of 12 security postings demand Argon2 specifically.
PCI-DSS / SOC 2 commercial compliance regimes
The course teaches the government / international standards landscape extensively but does not extend it to the commercial compliance regimes security engineers most often encounter. Ch14 Slides 3–4 catalogue the 'ISO/IEC 27000 Series of Standards on IT Security Techniques,' Ch15 Slides 11–20 walk through 'NIST SP 800-53 Security Controls,' and Ch18 Slide 28 'Security Compliance' already frames audit as 'a process to review the organization's security processes ... verify compliance with the security plan ... use checklists.' Conceptual extension: add one slide to the standards survey naming PCI-DSS (cardholder-data scope) and SOC 2 (trust-services criteria) as the dominant commercial regimes that map onto the same NIST/ISO control families already taught — including which existing 800-53 control families satisfy the most common SOC 2 / PCI requirements. Stays at the standards-and-mappings level the course already operates at. PCI-DSS appears in 5/12 and SOC 2 in 4/12 postings.