Securing Coding Fundamentals (WSKF601)
Empower yourself to write and verify secure software by design.
Description
Empower yourself to write and verify secure software by design. Learn and practice with hands-on labs that build behavior-changing skills fundamental to security implementation, boosting your professional IT security maturity.
Summary
Empower yourself to write and verify secure software by design.
What You'll Learn
- Participants will learn to independently test for web application vulnerabilities, perform threat modeling sessions, and prevent business logic vulnerabilities.
- Hands-on labs will increase your understanding of how to fix vulnerabilities and which design patterns to apply.
- Participants will also learn to practice security by design using the Security Knowledge Framework and use security automation to add value to the CI/CD pipeline.
Prerequisites
- Participants should have a basic understanding of web development principles and familiarity with the chosen development language.
- They will need a computing system with adequate performance specifications and access to the provided demo environments.
Outline
3 modules
•
3 Days total
- Introduction to vulnerabilities
- Playing with identifying real threats and security requirement
- Common server-side vulnerabilities and their defense
- Injections: SQLi, XML injections, JSON, XPath, XSS, cookie injection, open redirection, http header injection
- Path traversal, XXE, Buffer overflow, Zip bomb, Million laugh, RFI, Insecure file upload, Code execution
- Insecure direct object reference
- Security by design
- Threat modelling
- Separation of duties, trust boundaries, security boundaries, defense in depth, principle of least privilege, minimizing the attack surface, risk driven mitigation
- Business logic vulnerabilities
