Module 5 - Software Security & Code Auditing (NERO)

NERO Module 5 – Software Security & Code Auditing provides trainees with a structured and practical introduction to software security. The module focuses on secure coding principles, DevSecOps practices, vulnerability identification, and the use of Snyk.io (or other similar tools) for hands-on code analysis. Trainees learn how to detect common security issues, understand their impact, and apply appropriate remediation steps within a modern development workflow.

Registration Information

Participants can register for this module through the NERO Moodle platform, where they will find enrolment instructions, schedules, prerequisites, and access to preparatory materials. All required tools and resources—including links to Snyk.io, lab exercises, and course documentation—are available through the NERO Marketplace. Upon registration, trainees gain access to the full course page and materials.

Topics Covered

The training covers a structured set of foundational and practical topics, including:

• Introduction to core software security concepts
• Secure coding principles and common insecure patterns
• DevSecOps fundamentals and integrating security into the SDLC
• Identifying vulnerabilities in source code and dependencies
• Using Snyk.io (or other similar tools) for static code analysis and dependency scanning
• Basic code auditing techniques
• QA’s role in software security and testing for secure behaviour
• Interpreting vulnerability reports and prioritising fixes

These topics are supported by short lectures, demonstrations, and guided lab work.

Learning Approach

The module uses an interactive format combining:

• Concise expert-led presentations
• Step-by-step lab exercises using Snyk.io (or other similar tools)
• Demonstrations of real-world vulnerability scenarios

Learning Outcomes

After completing the module, trainees will be able to:

• Explain essential software security concepts and secure development practices
• Apply DevSecOps principles in a practical environment
• Identify common vulnerabilities in codebases and open-source components
• Use Snyk.io (or other similar tools) to scan, interpret reports, and prioritise remediation
• Perform basic code auditing to detect weaknesses
• Understand how QA contributes to building more secure software
• Confidently apply these skills in real development or QA workflows