Systems Security Certified Practitioner Training Course

This course addresses the essential secure coding practices pertinent to a broad spectrum of web application developers. Participants will learn the principles of secure programming by examining specific code snippets, identifying security vulnerabilities, and implementing effective remediation strategies.

Throughout this training, you will observe demonstrations of real-world attack scenarios and learn how to counter them, thereby building confidence in enhancing the security posture of your applications.

Duration: 3 days
Target Audience: Developers seeking to deepen their expertise in secure coding.

Learning Outcomes
• Upon completion, participants will gain knowledge in:
• Web Application Security.
• Common Web Application Risks.
• Penetration Testing on Demo Web Applications.
• Data Validation.
• Authentication.
• Session Management.
• Secure SDLC.

Android serves as an open platform for mobile devices, including smartphones and tablets. While it offers a wide array of security features to facilitate the development of secure software, it also lacks certain security measures found in other handheld platforms. This course provides a comprehensive overview of these features, highlighting critical shortcomings related to the underlying Linux system, the file system, and the general environment. It also addresses issues concerning the use of permissions and other Android software development components.

The course describes common security pitfalls and vulnerabilities for both native code and Java applications, offering recommendations and best practices to avoid and mitigate them. Many discussed issues are supported by real-life examples and case studies. Finally, we provide a brief overview on using security testing tools to uncover security-related programming bugs.

Participants attending this course will

• Understand the fundamental concepts of security, IT security, and secure coding
• Learn about Android's security solutions
• Learn to utilize various security features of the Android platform
• Gain information on recent Java vulnerabilities on Android
• Learn about typical coding mistakes and how to avoid them
• Gain an understanding of native code vulnerabilities on Android
• Realize the severe consequences of insecure buffer handling in native code
• Understand architectural protection techniques and their weaknesses
• Access sources and further reading on secure coding practices

Audience

Professionals

Building secure networked applications can be challenging, even for developers who have previously worked with cryptographic building blocks like encryption and digital signatures. To help participants grasp the role and application of these cryptographic primitives, this course first establishes a strong foundation on the core requirements of secure communication—such as secure acknowledgement, integrity, confidentiality, remote identification, and anonymity. It also highlights common issues that can compromise these requirements and presents practical real-world solutions.

Since cryptography is a critical component of network security, the course covers essential cryptographic algorithms, including symmetric cryptography, hashing, asymmetric cryptography, and key agreement protocols. Rather than focusing on complex mathematical theories, these concepts are explored from a developer's perspective, featuring typical use-case examples and practical considerations related to cryptographic implementation, such as Public Key Infrastructures (PKI). The course also introduces security protocols used in various areas of secure communication, providing an in-depth look at widely adopted protocol families like IPSEC and SSL/TLS.

Common cryptographic vulnerabilities are discussed, covering both specific algorithms and protocols. This includes attacks such as BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding Oracle, Lucky Thirteen, POODLE, and RSA timing attacks. For each vulnerability, the practical implications and potential consequences are explained, avoiding deep mathematical details to maintain focus on practical understanding.

Finally, given that XML technology is central to data exchange in networked applications, the course addresses XML security. This includes the use of XML within web services and SOAP messages, along with protective measures like XML Signature and XML Encryption. Additionally, it covers weaknesses in these protection mechanisms and XML-specific security issues, such as XML injection, XML External Entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Gain an understanding of fundamental security concepts, IT security, and secure coding practices
• Comprehend the requirements for secure communication
• Learn about network attacks and defenses across different OSI layers
• Develop a practical understanding of cryptography
• Understand essential security protocols
• Recognize recent attacks targeting cryptosystems
• Gain insights into recent related vulnerabilities
• Understand security concepts within Web services
• Access resources and further readings on secure coding practices

Audience

Developers, Professionals

Spanning three days, this course introduces the fundamentals of safeguarding C/C++ code against malicious exploitation. It focuses on addressing vulnerabilities related to memory management and input handling, while exploring the core principles essential for writing secure code.

Even seasoned Java developers often do not fully master the security services provided by Java, nor are they always aware of the vulnerabilities pertinent to web applications developed in Java.

Beyond introducing the security components of Standard Java Edition, the course delves into the security challenges of Java Enterprise Edition (JEE) and web services. Discussions on specific services are grounded in the fundamentals of cryptography and secure communication. A variety of exercises address both declarative and programmatic security techniques in JEE, while the course explores transport-layer and end-to-end security for web services. Through several practical exercises, participants get hands-on experience with the discussed APIs and tools.

The course also examines and explains the most common and severe programming flaws in the Java language and platform, as well as web-related vulnerabilities. Alongside typical bugs made by Java programmers, the covered security vulnerabilities include both language-specific issues and problems arising from the runtime environment. All vulnerabilities and their corresponding attacks are demonstrated through straightforward exercises, followed by recommended coding guidelines and potential mitigation strategies.

Participants attending this course will

• Grasp the basic concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and understand how to prevent them
• Understand the security concepts underlying web services
• Learn to utilize various security features of the Java development environment
• Gain a practical understanding of cryptography
• Understand the security solutions offered by Java EE
• Learn about typical coding mistakes and how to avoid them
• Receive information on recent vulnerabilities in the Java framework
• Acquire practical knowledge in using security testing tools
• Obtain sources and further reading materials on secure coding practices

Audience

Developers

Description

Although the Java language and the Runtime Environment (JRE) were designed to be free from the most problematic common security vulnerabilities experienced in other languages, like C/C++, software developers and architects must do more than just use the various security features of the Java environment (positive security). They must also be aware of the numerous vulnerabilities that are still relevant for Java development (negative security).

The introduction of security services is preceded by a brief overview of the foundations of cryptography, providing a common baseline for understanding the purpose and the operation of the applicable components. The use of these components is presented through several practical exercises, where participants can try out the discussed APIs for themselves.

The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform, covering both the typical bugs committed by Java programmers and the language- and environment-specific issues. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn to use various security features of the Java development environment
• Have a practical understanding of cryptography
• Learn about typical coding mistakes and how to avoid them
• Get information about some recent vulnerabilities in the Java framework
• Get sources and further readings on secure coding practices

Audience

Developers

Today, numerous programming languages enable code compilation for the .NET and ASP.NET frameworks. While this environment offers robust security development capabilities, developers must master architecture-level and coding-level techniques to implement desired security features, avoid vulnerabilities, and limit their potential exploitation.

This course aims to equip developers with practical skills through extensive hands-on exercises. Participants will learn to prevent untrusted code from executing privileged actions, safeguard resources using strong authentication and authorization mechanisms, manage remote procedure calls and sessions, and explore various implementation strategies for enhanced security.

The course begins by introducing various vulnerabilities, starting with common programming pitfalls in .NET. It then examines ASP.NET-specific vulnerabilities, including the impact of different environment settings. Furthermore, the discussion covers general web application security challenges alongside specialized issues and attack vectors, such as ViewState manipulation and string termination attacks.

Participants attending this course will

• Grasp the fundamental concepts of security, IT security, and secure coding principles
• Identify web vulnerabilities beyond the OWASP Top Ten and understand prevention strategies
• Utilize the security features available in the .NET development environment
• Acquire practical expertise in employing security testing tools
• Recognize typical coding errors and learn how to sidestep them
• Gain insights into recent vulnerabilities affecting .NET and ASP.NET
• Access resources and further reading materials on secure coding practices

Audience

Developers

This course introduces fundamental security concepts and provides an overview of vulnerabilities that persist across different programming languages and platforms. It explains how to manage software security risks throughout the various phases of the software development lifecycle. Stepping back from deep technical intricacies, the course highlights some of the most critical and prevalent vulnerabilities across diverse software technologies. It also addresses the challenges of security testing, offering techniques and tools that developers can use to identify and resolve existing issues in their code.

Participants attending this course will

• Understand the core concepts of security, IT security, and secure coding practices
• Gain insight into web vulnerabilities affecting both server and client sides
• Recognize the serious implications of insecure buffer handling
• Stay informed about recent vulnerabilities within development environments and frameworks
• Learn about common coding errors and strategies to avoid them
• Understand various approaches and methodologies for security testing

Audience

Managers

This course equips PHP developers with the vital skills needed to build applications that are resilient against modern internet-based threats. It explores web vulnerabilities through practical PHP examples, going beyond the OWASP Top Ten to cover a wide range of injection attacks, script injections, session handling weaknesses, insecure direct object references, file upload flaws, and more. PHP-specific vulnerabilities are categorized into common vulnerability types such as inadequate input validation, improper error and exception handling, misuse of security features, and time- and state-related issues. For the latter, we examine attacks such as open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. Throughout, participants will learn the key techniques and functions required to mitigate these risks.

A significant emphasis is placed on client-side security, addressing issues related to JavaScript, Ajax, and HTML5. The course introduces essential PHP security extensions like Hash, Mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for robust input validation. Comprehensive hardening best practices are provided for PHP configuration (including php.ini settings), Apache, and the server environment at large. Additionally, an overview of various security testing tools and methodologies is offered for developers and testers, including security scanners, penetration testing tools, exploit kits, sniffers, proxy servers, fuzzing tools, and static source code analyzers.

Both the theoretical introduction of vulnerabilities and the configuration best practices are reinforced with numerous hands-on exercises. These demonstrate the real-world impact of successful attacks, illustrate how to apply mitigation strategies, and provide practical experience with various extensions and tools.

Participants attending this course will

• Gain a solid understanding of fundamental security concepts, IT security, and secure coding principles
• Learn about web vulnerabilities beyond the OWASP Top Ten and understand how to prevent them
• Explore client-side vulnerabilities and adopt secure coding practices
• Develop a practical understanding of cryptography
• Learn how to leverage various built-in security features of PHP
• Identify common coding mistakes and learn how to avoid them
• Stay informed about the latest vulnerabilities affecting the PHP framework
• Acquire practical skills in using security testing tools
• Receive curated resources and further reading materials on secure coding practices

Audience

Developers

This comprehensive SDL core training provides an in-depth look at secure software design, development, and testing methodologies through the Microsoft Secure Development Lifecycle (SDL). It begins with a level 100 overview of the fundamental building blocks of SDL, followed by design techniques aimed at detecting and resolving flaws during the early stages of the development process.

Focusing on the development phase, the course outlines typical security-related programming bugs found in both managed and native code. It presents attack vectors for the discussed vulnerabilities alongside associated mitigation techniques, all explained through a series of hands-on exercises that offer participants engaging, live hacking experiences. The introduction to various security testing methods is followed by a demonstration of the effectiveness of different testing tools. Participants gain a practical understanding of these tools by applying them to previously discussed vulnerable code in numerous practical exercises.

Participants attending this course will

Understand the fundamental concepts of security, IT security, and secure coding

Become familiar with the essential steps of the Microsoft Secure Development Lifecycle

Learn secure design and development practices

Learn about secure implementation principles

Understand security testing methodologies

• Access sources and further readings on secure coding practices

Audience

Developers, Managers

Once participants have gained a solid understanding of vulnerabilities and attack vectors, they will explore the overarching methodology and approach for security testing, along with the techniques used to uncover specific weaknesses. Effective security testing begins with comprehensive information gathering about the system under evaluation (ToC). This is followed by thorough threat modeling to identify, assess, and prioritize risks, ultimately leading to a risk-driven test plan.

Security evaluations are integral to various stages of the Software Development Life Cycle (SDLC). This module covers design and code reviews, reconnaissance, and information gathering. It also examines testing implementations and the process of hardening environments for secure deployment. Detailed attention is given to key security testing techniques such as taint analysis, heuristics-based code review, static code analysis, dynamic web vulnerability testing, and fuzzing. The course introduces a variety of tools designed to automate the security assessment of software, supported by hands-on exercises where participants execute these tools on previously discussed vulnerable code. Real-world case studies are utilized to deepen the understanding of diverse vulnerability scenarios.

This course equips testers and QA professionals with the ability to effectively plan and execute security tests, select appropriate tools and techniques to uncover even subtle security flaws, and acquire practical skills that can be immediately applied in their daily work.

Participants attending this course will

• Grasp fundamental concepts of security, IT security, and secure coding
• Gain insights into web vulnerabilities beyond the OWASP Top Ten and learn how to mitigate them
• Understand client-side vulnerabilities and best practices for secure coding
• Familiarize themselves with security testing approaches and methodologies
• Acquire hands-on knowledge of security testing techniques and tools
• Access resources and further readings on secure coding practices

Audience

Developers, Testers

Protecting web-accessible applications demands security professionals who are constantly updated on the latest attack vectors and trends. While a wide array of technologies and environments facilitate the comfortable development of web applications, professionals must remain vigilant not only about platform-specific security issues but also about general vulnerabilities that persist regardless of the development tools used.

This course provides an overview of essential security solutions for web applications, with a specific emphasis on understanding the most critical cryptographic mechanisms. It examines web application vulnerabilities on both the server side (aligned with the OWASP Top Ten) and the client side, illustrating them through relevant attack scenarios. Following these demonstrations, the course outlines recommended coding techniques and mitigation strategies to prevent associated issues. The session on secure coding concludes by addressing common security-related programming errors, particularly those concerning input validation, misuse of security features, and code quality.

Testing is a pivotal component in ensuring the security and robustness of web applications. A variety of approaches, ranging from high-level auditing and penetration testing to ethical hacking, can be employed to identify vulnerabilities. However, to look beyond obvious, easy-to-find issues, security testing must be carefully planned and executed. It is important to remember that security testers must ideally uncover all bugs to safeguard a system, whereas an adversary needs to find just one exploitable vulnerability to gain access.

Practical exercises are designed to enhance the understanding of web application vulnerabilities, programming mistakes, and, most importantly, mitigation techniques. Through hands-on trials with various testing tools—including security scanners, sniffers, proxy servers, fuzzing tools, and static source code analyzers—this course equips participants with essential practical skills that can be immediately applied in their workplace the following day.

Participants attending this course will

• Grasp the fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and understand how to avoid them
• Gain insights into client-side vulnerabilities and secure coding practices
• Develop a practical understanding of cryptography
• Comprehend security testing approaches and methodologies
• Acquire hands-on knowledge of security testing techniques and tools
• Stay informed about recent vulnerabilities across various platforms, frameworks, and libraries
• Access resources and further reading materials on secure coding practices

Audience

Developers, Testers

In this instructor-led live course in India, participants will learn how to formulate a robust security strategy to address DevOps security challenges.

The EC-Council Certified DevSecOps Engineer (ECDE) is a practical course tailored to empower professionals with the expertise to embed security throughout the DevOps lifecycle, thereby facilitating secure software development from the initial planning stages to final deployment.

This instructor-led, live training session (available online or onsite) targets intermediate-level software engineers and DevOps specialists aiming to integrate security protocols into CI/CD pipelines, ensuring the delivery of secure and compliant code.

Upon completing this training, participants will be capable of:

• Comprehending the core principles and practices of DevSecOps.
• Securing each phase of the CI/CD pipeline through the use of automated tools.
• Applying secure coding standards and performing vulnerability scanning.
• Preparing for the ECDE certification via practical labs and review sessions.

Course Format

• Interactive lectures and discussions.
• Hands-on engagement with DevSecOps tools within simulated pipelines.
• Guided exercises emphasizing secure development and deployment strategies.

Customization Options

• For teams wishing to customize this training based on specific workflows or toolchains, please contact us to make arrangements.

This course aims to assist with the following:

1. Helping developers master the techniques for writing secure code.
2. Assisting software testers in evaluating application security before deployment to production environments.
3. Helping software architects comprehend the risks associated with their applications.
4. Supporting team leaders in establishing security baselines for developers.
5. Guiding webmasters in configuring servers to prevent misconfigurations.