Opleiding: Software Quality Assurance in the age of open source, outsourcing & AI (English) (Virtual)

Lesmethode :

Virtueel

Algemeen :

In this course, you will learn how to assess software quality and security, including code written by external suppliers or generated by AI. You will examine the checks required during development, at delivery and throughout maintenance. This will help you identify security risks and maintainability issues earlier.

You will examine the entire software lifecycle through four different lenses: functionality, security, architecture, and governance. We cover how to map risks using threat modeling and explore the role that tools such as SAST, DAST, and SBOM play in providing evidence of quality. Additionally, you'll learn how to counter architectural erosion and identify where human judgment remains essential alongside automated quality gates.

Using a continuous case study, you will analyze software resulting from a mix of internal development, external vendors, and AI agents. You will practice identifying assurance gaps and determining which measures are proportional to mitigate risks. This approach will help you ask targeted questions about software quality in your own work and make informed, defensible decisions about whether to accept or reject code.

Doel :

After this course, you will be able to systematically gather evidence regarding the quality and security of software, regardless of whether it was written internally, by partners, or by AI.

Doelgroep :

Software professionals who want to controle the quality of a growing code base, like software developers, architects, QA-engineers and Dev(Sec)Ops experts.

Voorkennis :

The following prior knowledge is required:
- Experiencewith software development or quality assurance
- Basic understanding of the software development lifecycle (SDLC)

Onderwerpen :

- Introduction
+nbsp;+nbsp;+nbsp;- Growth in code volume, maintenance burden, and verification debt
+nbsp;+nbsp;+nbsp;- Code provenance: in-house, outsourcing, open source, and GenAI
+nbsp;+nbsp;+nbsp;- Software assurance as a system of evidence and feedback
- Plan
+nbsp;+nbsp;+nbsp;- Risk classification, ownership, and accountability
+nbsp;+nbsp;+nbsp;- Quality objectives, definition of done, and GenAI policy
+nbsp;+nbsp;+nbsp;- Supplier governance, maintenance, and phase-out
- Specify
+nbsp;+nbsp;+nbsp;- Testable functional and non-functional requirements
+nbsp;+nbsp;+nbsp;- Security, privacy, performance, misuse cases, and abuse cases
+nbsp;+nbsp;+nbsp;- Acceptance criteria and traceability for humans, suppliers, and agents
- Design
+nbsp;+nbsp;+nbsp;- Modularity, coupling, cohesion, and architectural decisions
+nbsp;+nbsp;+nbsp;- Trust boundaries, data flows, and threat modelling
+nbsp;+nbsp;+nbsp;- Secure by design, reference architectures, and early debt prevention
- Develop
+nbsp;+nbsp;+nbsp;- Coding standards, peer review, and manageable changes
+nbsp;+nbsp;+nbsp;- SAST, linting, secret detection, and dependency selection
+nbsp;+nbsp;+nbsp;- Unit tests and repository instructions such as AGENTS.md and RULES.md
+nbsp;+nbsp;+nbsp;- Generated and outsourced code treated as untrusted contributions
- Verify
+nbsp;+nbsp;+nbsp;- Test portfolio: unit, integration, contract, system, and end-to-end testing
+nbsp;+nbsp;+nbsp;- Positive, negative, exploratory, and security testing
+nbsp;+nbsp;+nbsp;- Coverage, mutation testing, DAST, and fuzzing
+nbsp;+nbsp;+nbsp;- False positives and negatives, false confidence, and agentic QA
- Release & Deploy
+nbsp;+nbsp;+nbsp;- CI, quality gates, SCA, and CVE prioritisation
+nbsp;+nbsp;+nbsp;- SBOM, build provenance, artifact integrity, and configuration validation
+nbsp;+nbsp;+nbsp;- Release evidence, risk acceptance, rollback, and supplier acceptance
- Operate & Maintain
+nbsp;+nbsp;+nbsp;- Observability, incident response, patch management, and vulnerability management
+nbsp;+nbsp;+nbsp;- Dependency updates, regression testing, and architectural erosion
+nbsp;+nbsp;+nbsp;- Technical debt, knowledge loss, ownership, and use of the SBOM
+nbsp;+nbsp;+nbsp;- Feedback from operations into planning, requirements, and design