How to Write Secure Code Training Course

Developing secure networked applications can be challenging, even for developers who have previously worked with cryptographic building blocks like encryption and digital signatures. To help participants grasp the role and application of these cryptographic primitives, the course first establishes a solid foundation on the core requirements of secure communication—namely secure acknowledgement, integrity, confidentiality, remote identification, and anonymity. It also addresses typical threats that can undermine these requirements alongside practical, real-world solutions.

Given that cryptography is a critical component of network security, the course examines essential algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. Rather than focusing on complex mathematical theory, these topics are approached from a developer's perspective, featuring typical use-case examples and practical considerations such as public key infrastructures. The course introduces security protocols used across various domains of secure communication, offering an in-depth look at widely adopted protocol families like IPSEC and SSL/TLS.

Common cryptographic vulnerabilities are discussed in the context of both specific algorithms and protocols. Topics include BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and the RSA timing attack. For each issue, the practical implications and potential consequences are explained without delving into deep mathematical details.

Finally, since XML technology is central to data exchange in networked applications, the course covers XML security aspects. This includes the use of XML in web services and SOAP messages, along with protective measures like XML signature and XML encryption. The course also examines weaknesses in these protections and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Understand the requirements of secure communication
• Learn about network attacks and defences at different OSI layers
• Have a practical understanding of cryptography
• Understand essential security protocols
• Understand some recent attacks against cryptosystems
• Get information about some recent related vulnerabilities
• Understand security concepts of Web services
• Get sources and further readings on secure coding practices

Audience

Developers, Professionals

Developing secure C and C++ software demands rigorous defence against malicious exploitation, memory corruption, and input validation bypasses. This programme explores vulnerability patterns such as buffer overflows, use-after-free errors, integer overflows, and type confusion. Participants implement secure coding guidelines, static analysis tools, and defensive programming techniques to eradicate weaknesses, enforce input sanitization, and deliver hardened software resilient against cyberattacks.

Even seasoned Java developers do not necessarily master every security service offered by Java, nor are they always aware of the various vulnerabilities relevant to web applications written in Java.

The course, while introducing the security components of Standard Java Edition, also addresses security issues concerning Java Enterprise Edition (JEE) and web services. Before discussing specific services, the course covers the foundations of cryptography and secure communication. Various exercises focus on declarative and programmatic security techniques in JEE, alongside discussions on both transport-layer and end-to-end security for web services. Participants can apply these concepts through practical exercises, allowing them to test out the discussed APIs and tools themselves.

The course also examines and explains the most common and severe programming flaws in the Java language and platform, as well as web-related vulnerabilities. Beyond typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems arising from the runtime environment. All vulnerabilities and relevant attacks are demonstrated through easy-to-understand exercises, followed by recommended coding guidelines and possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and know how to avoid them
• Understand the security concepts of web services
• Learn to use various security features of the Java development environment
• Gain a practical understanding of cryptography
• Understand the security solutions of Java EE
• Learn about typical coding mistakes and how to avoid them
• Get information about some recent vulnerabilities in the Java framework
• Acquire practical knowledge in using security testing tools
• Obtain sources and further readings on secure coding practices

Audience

Developers

Today, a variety of programming languages are available to compile code for the .NET and ASP.NET frameworks. While this environment offers robust tools for security development, developers must understand how to apply architecture- and coding-level programming techniques to implement desired security functionalities, avoid vulnerabilities, or limit their exploitation.

The aim of this course is to equip developers with the ability to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization, facilitate remote procedure calls, manage sessions, and introduce diverse implementations for specific functionalities, among other skills, through numerous hands-on exercises.

The introduction to various vulnerabilities begins by presenting typical programming problems encountered when using .NET. The discussion on ASP.NET vulnerabilities also covers various environment settings and their effects. Finally, the topic of ASP.NET-specific vulnerabilities addresses not only general web application security challenges but also special issues and attack methods, such as attacking the ViewState or employing string termination attacks.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and understand how to avoid them
• Learn to utilise various security features of the .NET development environment
• Gain practical knowledge in using security testing tools
• Learn about typical coding mistakes and how to avoid them
• Gain information about some recent vulnerabilities in .NET and ASP.NET
• Access sources and further readings on secure coding practices

Audience

Developers

The course provides essential skills for PHP developers necessary to make their applications resistant to contemporary attacks through the Internet. Web vulnerabilities are discussed through PHP-based examples going beyond the OWASP top ten, tackling various injection attacks, script injections, attacks against session handling of PHP, insecure direct object references, issues with file upload, and many others. PHP-related vulnerabilities are introduced grouped into the standard vulnerability types of missing or improper input validation, incorrect error and exception handling, improper use of security features and time- and state-related problems. For this latter we discuss attacks like the open_basedir circumvention, denial-of-service through magic float or the hash table collision attack. In all cases participants will get familiar with the most important techniques and functions to be used to mitigate the enlisted risks.

A special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5. A number of security-related extensions to PHP are introduced like hash, mcrypt and OpenSSL for cryptography, or Ctype, ext/filter and HTML Purifier for input validation. The best hardening practices are given in connection with PHP configuration (setting php.ini), Apache and the server in general. Finally, an overview is given to various security testing tools and techniques which developers and testers can use, including security scanners, penetration testing and exploit packs, sniffers, proxy servers, fuzzing tools and static source code analyzers.

Both the introduction of vulnerabilities and the configuration practices are supported by a number of hands-on exercises demonstrating the consequences of successful attacks, showing how to apply mitigation techniques and introducing the use of various extensions and tools.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Have a practical understanding of cryptography
• Learn to use various security features of PHP
• Learn about typical coding mistakes and how to avoid them
• Be informed about recent vulnerabilities of the PHP framework
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers

This comprehensive core training offers a deep dive into secure software design, development, and testing, guided by the Microsoft Secure Development Lifecycle (SDL). It provides a foundational overview of the SDL's essential building blocks, followed by design techniques aimed at detecting and rectifying flaws during the early stages of the development process.

Focusing on the development phase, the course outlines common security-related programming bugs found in both managed and native code. It presents attack methods for the discussed vulnerabilities alongside their corresponding mitigation techniques. Through numerous hands-on exercises, participants engage in live hacking scenarios, making the learning process interactive and practical. The training introduces various security testing methods and demonstrates the effectiveness of different testing tools. Participants will gain a clear understanding of how these tools operate by applying them to vulnerable code examples discussed throughout the course.

By the end of this course, participants will be able to

Understand the fundamental concepts of security, IT security, and secure coding

Familiarize themselves with the essential steps of the Microsoft Secure Development Lifecycle

Adopt secure design and development practices

Comprehend the principles of secure implementation

Understand security testing methodologies

• Access resources and further reading materials on secure coding practices

Target Audience

Developers, Managers

In this instructor-led, live course in Botswana, participants will learn how to formulate an appropriate security strategy to address the DevOps security challenge.

This premier, state-of-the-art, practical workshop immerses participants in the pressing realities of contemporary CI/CD pipeline security. Tailored for security specialists, DevOps engineers, and developers keen to master advanced pipeline breach defense, the training combines live attack simulations with industry-leading tools and actionable defense strategies.

The EC-Council Certified DevSecOps Engineer (ECDE) is a practical course crafted to empower professionals with the capabilities to embed security throughout the DevOps lifecycle, facilitating secure software development from the planning phase through to deployment.

This instructor-led, live training (available online or onsite) is tailored for intermediate-level software and DevOps professionals who aim to integrate security practices into CI/CD pipelines, ensuring the delivery of secure and compliant code.

Upon completion of this training, participants will be able to:

• Grasp the principles and practices of DevSecOps.
• Secure every stage of the CI/CD pipeline using automated tools.
• Implement secure coding practices and vulnerability scanning.
• Prepare for the ECDE certification through practical labs and review.

Format of the Course

• Interactive lecture and discussion.
• Hands-on use of DevSecOps tools in simulated pipelines.
• Guided exercises focused on secure development and deployment.

Course Customization Options

• To request a customized training for this course based on your team’s workflows or toolchain, please contact us to arrange.

Based on the latest OWASP GenAI Security Project guidance, participants will learn to identify, assess, and mitigate AI-specific threats through hands-on exercises and real-world scenarios.

This instructor-led live training in Botswana (online or onsite) is aimed at web developers and leaders who wish to explore and implement the OWASP Top 10 reference standard to secure their web applications.

By the end of this training, participants will be able to strategize, implement, secure, and monitor their web applications and services using the OWASP Top 10 document.

This instructor-led live training in Botswana (online or on-site) is aimed at developers, engineers, and architects who wish to apply the WSTG testing framework, principles, and techniques to secure their web applications and services.

By the end of this training, participants will be able to:

• Use the WSTG to implement testing processes and techniques in the web development lifecycle.
• Explore different testing techniques to customize the WSTG framework based on business needs.
• Perform various security testing methods to protect web applications from risks and attacks.
• Create an assessment report to document security testing findings and results.

This course explores secure coding principles and practices in Java, utilizing the testing methodologies of the Open Web Application Security Project (OWASP). The Open Web Application Security Project is a global online community dedicated to producing freely accessible articles, methodologies, documentation, tools, and technologies aimed at enhancing web application security.

This course delves into secure coding concepts and principles using ASP.NET, guided by the testing methodology of the Open Web Application Security Project (OWASP). OWASP is an online community that provides freely available articles, methodologies, documentation, tools, and technologies in the realm of web application security.

This course examines the .NET Framework's security features and demonstrates how to safeguard web applications.