<aside> 💡 Ask for more details, a quote and customize your course: [email protected]

Booking/registration: [email protected] Drop us a message with the details for billing info and a payment link.

</aside>

Legend

This training course introduces developers to Secure Software Development Life Cycle (S-SDLC) methodologies and practices and provides a clear strategy for recognizing insecure patterns using various technologies (mobile and web) and programming languages. Attendees will familiarize themselves with commonly-used security tools, exploit vulnerabilities in real code, create a fix based on the OWASP ASVS, mASVS (for mobile) and SKF recommendations and validate the effectiveness of their solution.

Description

Topics outline

• Standardized approaches to handling application vulnerabilities (ASVS, mASVS)
• Finding vulnerabilities in damn-vulnerable code
• Vulnerability management in production (SKF)
• Testing tools (SAST, DAST and dependency checker tools)
• Security pipelines (GitLab runners and automated security testing)
• Security-focused code review

Schedule

• Suggested schedule: 3 weeks (e.g. each Friday is a training day)
• Weekly group consultations with the trainer
• Weekly homework and DIY activities
• An extra day for the post-training examination

Story

During the training we will explore what are the activities across the complete SDLC to build secure code, and recognize unsecure code using two different Java applications (Javula, Webgoat). Using different security tools (used by security engineers) we will exploit the vulnerabilities, create a fix based on the ASVS v4, MASVS (for mobile) and SKF recommendations, and validate their effectiveness using previous exploits. The first day will focus on understanding the security standards (using ASVS and SKF), how to do threat modelling and how to apply the security principles. After that, using security tools, we will start exploiting web application vulnerabilities using the WebGoat Java app. Each attendee will exploit, fix and retest the vulnerabilities. The second day introduces some of the Spring boot security features (like the Java Security Manager) and explores well known issues that affected the Spring Boot. The second part keeps the focus on another batch of backend vulnerabilities and briefly touches how to detect them through source code review processes for mobile and web. Finally an exciting and fun security quiz will take place in the last 30 mins where the winner will be awarded with a defdeveu gadget.

Takeaway skills

On a base level students will: