C/C++ Secure Coding Training Course

This instructor-led, live training in Botswana (online or onsite) is tailored for developers who wish to employ advanced C++ programming techniques to develop complex, secure, and high-performance systems and applications.

By the end of this training, participants will be able to:

• Set up a development environment that includes all C++ libraries, packages and frameworks.
• Understand the features, components, and basic elements of C++.
• Create complex C++ applications using advanced programming techniques.
• Learn how to write readable, fast, and secure code in C++.
• Know the common security pitfalls in C++ language and how to mitigate them.
• Implement test strategies for code quality and security control.
• Use the diagnostics and debugging tools in C++ development.

Developing secure networked applications can be challenging, even for developers who have previously worked with cryptographic building blocks like encryption and digital signatures. To help participants grasp the role and application of these cryptographic primitives, the course first establishes a solid foundation on the core requirements of secure communication—namely secure acknowledgement, integrity, confidentiality, remote identification, and anonymity. It also addresses typical threats that can undermine these requirements alongside practical, real-world solutions.

Given that cryptography is a critical component of network security, the course examines essential algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. Rather than focusing on complex mathematical theory, these topics are approached from a developer's perspective, featuring typical use-case examples and practical considerations such as public key infrastructures. The course introduces security protocols used across various domains of secure communication, offering an in-depth look at widely adopted protocol families like IPSEC and SSL/TLS.

Common cryptographic vulnerabilities are discussed in the context of both specific algorithms and protocols. Topics include BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and the RSA timing attack. For each issue, the practical implications and potential consequences are explained without delving into deep mathematical details.

Finally, since XML technology is central to data exchange in networked applications, the course covers XML security aspects. This includes the use of XML in web services and SOAP messages, along with protective measures like XML signature and XML encryption. The course also examines weaknesses in these protections and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Understand the requirements of secure communication
• Learn about network attacks and defences at different OSI layers
• Have a practical understanding of cryptography
• Understand essential security protocols
• Understand some recent attacks against cryptosystems
• Get information about some recent related vulnerabilities
• Understand security concepts of Web services
• Get sources and further readings on secure coding practices

Audience

Developers, Professionals

Even seasoned Java developers do not necessarily master every security service offered by Java, nor are they always aware of the various vulnerabilities relevant to web applications written in Java.

The course, while introducing the security components of Standard Java Edition, also addresses security issues concerning Java Enterprise Edition (JEE) and web services. Before discussing specific services, the course covers the foundations of cryptography and secure communication. Various exercises focus on declarative and programmatic security techniques in JEE, alongside discussions on both transport-layer and end-to-end security for web services. Participants can apply these concepts through practical exercises, allowing them to test out the discussed APIs and tools themselves.

The course also examines and explains the most common and severe programming flaws in the Java language and platform, as well as web-related vulnerabilities. Beyond typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems arising from the runtime environment. All vulnerabilities and relevant attacks are demonstrated through easy-to-understand exercises, followed by recommended coding guidelines and possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and know how to avoid them
• Understand the security concepts of web services
• Learn to use various security features of the Java development environment
• Gain a practical understanding of cryptography
• Understand the security solutions of Java EE
• Learn about typical coding mistakes and how to avoid them
• Get information about some recent vulnerabilities in the Java framework
• Acquire practical knowledge in using security testing tools
• Obtain sources and further readings on secure coding practices

Audience

Developers

Today, a variety of programming languages are available to compile code for the .NET and ASP.NET frameworks. While this environment offers robust tools for security development, developers must understand how to apply architecture- and coding-level programming techniques to implement desired security functionalities, avoid vulnerabilities, or limit their exploitation.

The aim of this course is to equip developers with the ability to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization, facilitate remote procedure calls, manage sessions, and introduce diverse implementations for specific functionalities, among other skills, through numerous hands-on exercises.

The introduction to various vulnerabilities begins by presenting typical programming problems encountered when using .NET. The discussion on ASP.NET vulnerabilities also covers various environment settings and their effects. Finally, the topic of ASP.NET-specific vulnerabilities addresses not only general web application security challenges but also special issues and attack methods, such as attacking the ViewState or employing string termination attacks.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and understand how to avoid them
• Learn to utilise various security features of the .NET development environment
• Gain practical knowledge in using security testing tools
• Learn about typical coding mistakes and how to avoid them
• Gain information about some recent vulnerabilities in .NET and ASP.NET
• Access sources and further readings on secure coding practices

Audience

Developers

The course provides essential skills for PHP developers necessary to make their applications resistant to contemporary attacks through the Internet. Web vulnerabilities are discussed through PHP-based examples going beyond the OWASP top ten, tackling various injection attacks, script injections, attacks against session handling of PHP, insecure direct object references, issues with file upload, and many others. PHP-related vulnerabilities are introduced grouped into the standard vulnerability types of missing or improper input validation, incorrect error and exception handling, improper use of security features and time- and state-related problems. For this latter we discuss attacks like the open_basedir circumvention, denial-of-service through magic float or the hash table collision attack. In all cases participants will get familiar with the most important techniques and functions to be used to mitigate the enlisted risks.

A special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5. A number of security-related extensions to PHP are introduced like hash, mcrypt and OpenSSL for cryptography, or Ctype, ext/filter and HTML Purifier for input validation. The best hardening practices are given in connection with PHP configuration (setting php.ini), Apache and the server in general. Finally, an overview is given to various security testing tools and techniques which developers and testers can use, including security scanners, penetration testing and exploit packs, sniffers, proxy servers, fuzzing tools and static source code analyzers.

Both the introduction of vulnerabilities and the configuration practices are supported by a number of hands-on exercises demonstrating the consequences of successful attacks, showing how to apply mitigation techniques and introducing the use of various extensions and tools.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Have a practical understanding of cryptography
• Learn to use various security features of PHP
• Learn about typical coding mistakes and how to avoid them
• Be informed about recent vulnerabilities of the PHP framework
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers

This comprehensive core training offers a deep dive into secure software design, development, and testing, guided by the Microsoft Secure Development Lifecycle (SDL). It provides a foundational overview of the SDL's essential building blocks, followed by design techniques aimed at detecting and rectifying flaws during the early stages of the development process.

Focusing on the development phase, the course outlines common security-related programming bugs found in both managed and native code. It presents attack methods for the discussed vulnerabilities alongside their corresponding mitigation techniques. Through numerous hands-on exercises, participants engage in live hacking scenarios, making the learning process interactive and practical. The training introduces various security testing methods and demonstrates the effectiveness of different testing tools. Participants will gain a clear understanding of how these tools operate by applying them to vulnerable code examples discussed throughout the course.

By the end of this course, participants will be able to

Understand the fundamental concepts of security, IT security, and secure coding

Familiarize themselves with the essential steps of the Microsoft Secure Development Lifecycle

Adopt secure design and development practices

Comprehend the principles of secure implementation

Understand security testing methodologies

• Access resources and further reading materials on secure coding practices

Target Audience

Developers, Managers

Is C++ appropriate for embedded systems like microcontrollers and real-time operating systems?

Should object-oriented programming be applied in microcontrollers?

Is C++ too abstracted from the hardware to be efficient?

This instructor-led, live training addresses these questions and demonstrates through discussion and practice how C++ can be used to develop embedded systems with code that is accurate, readable, and efficient. Participants put theory into practice through the creation of a sample embedded application in C++.

By the end of this training, participants will be able to:

• Understand the principles of object-oriented modelling, embedded software programming and real-time programming
• Produce code for embedded systems that is small, fast and safe
• Avoid code bloat from templates, exceptions, and other language features
• Understand the issues related to using C++ in safety-critical and real-time systems
• Debug a C++ program on a target device

Audience

• Developers
• Designers

Format of the course

• Part lecture, part discussion, exercises and heavy hands-on practice

This is a 2 day course aimed at C++ programmers who are interested in applying the new C++11 standard in their industry. It is particularly useful for financial applications developers covering all new features with coding examples to be executed within the lab

This instructor-led, live training in Botswana (online or onsite) is aimed at C++ developers who wish to use CUDA to accelerate applications, write high-performance GPU kernels, and leverage parallel algorithm libraries for scientific computing, data processing, and machine learning workloads.

In this instructor-led, live course in Botswana, participants will learn how to formulate an appropriate security strategy to address the DevOps security challenge.

The EC-Council Certified DevSecOps Engineer (ECDE) is a practical course crafted to empower professionals with the capabilities to embed security throughout the DevOps lifecycle, facilitating secure software development from the planning phase through to deployment.

This instructor-led, live training (available online or onsite) is tailored for intermediate-level software and DevOps professionals who aim to integrate security practices into CI/CD pipelines, ensuring the delivery of secure and compliant code.

Upon completion of this training, participants will be able to:

• Grasp the principles and practices of DevSecOps.
• Secure every stage of the CI/CD pipeline using automated tools.
• Implement secure coding practices and vulnerability scanning.
• Prepare for the ECDE certification through practical labs and review.

Format of the Course

• Interactive lecture and discussion.
• Hands-on use of DevSecOps tools in simulated pipelines.
• Guided exercises focused on secure development and deployment.

Course Customization Options

• To request a customized training for this course based on your team’s workflows or toolchain, please contact us to arrange.

This training aims to present C++ as the natural extension of C for object-oriented embedded system development. Since C++ encompasses C, this course guides participants from C to C++ in a logical manner, exploring the underlying implementation of C++. This understanding is particularly valuable when applying C++ within the resource-constrained environments typical of embedded systems. The C++ standard has recently undergone significant revisions, known as C++11, with C++14 being released subsequently. This course covers features introduced in these revisions that are especially beneficial, such as high-performance memory management, concurrency in multicore environments, and low-level hardware programming.

OBJECTIVES/BENEFITS

The primary goal of this course is to equip you with the ability to use C++ correctly and effectively.

• Introduce C++ as an object-oriented alternative for embedded systems
• Highlight the similarities and differences between C and C++
• Understand various memory management strategies, particularly move semantics introduced in C++11
• Examine the underlying mechanisms to understand how different C++ paradigms translate into machine code
• Utilise templates to create type-safe, high-level abstractions for low-level, hardware-adjacent programming (including memory-mapped I/O and interrupts), with a focus on variadic templates from C++11
• Explore useful design patterns, particularly those applicable to embedded contexts
• Engage in practical exercises to reinforce key concepts

TARGET AUDIENCE/PARTICIPANTS

This training is designed for C++ programmers who wish to begin applying C++ within an embedded systems context.

PREREQUISITES

Participants require a fundamental understanding of C++ programming, equivalent to that covered in our trainings "C++ – Level 1" and "C++ Level 2 – Introducing C++11".

PRACTICAL EXERCISES

Throughout the training, you will practice the concepts presented through a series of exercises. We will utilise the open-source and free integrated development environment provided by Eclipse.

This course aims to help in the following:

1. Help developers master the techniques of writing secure code.
2. Assist software testers in evaluating application security before publishing to the production environment.
3. Enable software architects to understand the risks associated with applications.
4. Support team leaders in establishing security baselines for developers.
5. Guide webmasters in configuring servers to avoid misconfigurations.

This course explores secure coding principles and practices in Java, utilizing the testing methodologies of the Open Web Application Security Project (OWASP). The Open Web Application Security Project is a global online community dedicated to producing freely accessible articles, methodologies, documentation, tools, and technologies aimed at enhancing web application security.

This course delves into secure coding concepts and principles using ASP.NET, guided by the testing methodology of the Open Web Application Security Project (OWASP). OWASP is an online community that provides freely available articles, methodologies, documentation, tools, and technologies in the realm of web application security.

This course examines the .NET Framework's security features and demonstrates how to safeguard web applications.