Cyber Security Course Path
This guide gives an overview of the suggested course path for education about the cyber security lifecycle for teams that work with ABB products, systems, or solution offerings that are software related.
The table below lists mandatory and optional internal courses for specific roles within R&D with references and links to the training as well as suggestions to some external courses. The estimated time of the courses vary between 5 - 90 minutes. Most courses take less than 10 minutes.
Security-related courses (internal and external) can also be found at Security Development Lifecycle under the section "Security Expertise". There is also a short description to some of the classes listed below.
In addition to the suggested course path below, it is advisable to look through the other courses and select additional courses applicable for the need of the individual employee or team. If you find good security related courses on 3rd party portals inform the cyber security process group so that they can be shared on this page.
| Course ID | Name | Condition |
|---|
| SDIP150e | Cyber Security - Security Development Lifecycle | Mandatory |
| 9CSC021793-GLB-EN | Introduction to the new ABB Cyber Security Standards | Mandatory |
| 9CSC021794-GLB-EN | Introduction to the ABB Security Development Lifecycle Standard | Mandatory |
| 9CSC021795-GLB-EN | Introduction to the ABB Product Security Standard | Mandatory |
| 9CSC023957-GLB-EN | Introduction to the ABB Cloud Offering Security and Cloud Operations Security Standards | Mandatory |
All software developers
| Course ID | Name | Condition |
|---|
| SDIP550e | Writing Secure Code | Mandatory |
| SDIP450e | Threat Modeling | Mandatory |
| SDIP589e | Neutralization of Special Elements Used in a Command | Mandatory |
| SDIP582e | Exposure of System Data to an Unauthorized Control Sphere | Optional |
| SDIP584e | Usage of Insecure Temporary Files | Optional |
C/C++ developers
| Course ID | Name | Condition |
|---|
| SDIP587e | Use of Uninitialized Variable (CWE-457) | Mandatory |
| SDIP581e | Improper Validation of Array Indices (CWE-129) | Optional |
| SDIP585e | Improper Release of Memory Before Removing Last Reference (CWE-401) | Optional |
| SDIP583e | Improper Null Termination (CWE-583) | Optional |
| SDIP586e | Double Freeing of Allocated Memory (CWE-415) | Optional |
| SDIP588e | NULL Pointer Dereference (CWE-476) | Optional |
Klocwork users
| Course ID | Name | Condition |
|---|
| SDIP580v | How to Use Klocwork Insight to Find Security Vulnerabilities | Mandatory |
Black Duck Binary Analysis (BDBA) users
SonarQube users
Support level SL3 and SL4
| Course ID | Name | Condition |
|---|
| SDIP151e | Working with Customer Systems | Mandatory |