Application Security Training in Sacramento

This instructor-led, live training in Sacramento (online or onsite) is designed for intermediate to advanced developers who seek to understand and apply secure coding practices, identify security risks in software, and implement defenses against cyber threats for government applications.

By the end of this training, participants will be able to:

• Comprehend common security vulnerabilities in web and software applications.
• Analyze security threats and exploit techniques used by attackers.
• Implement secure coding practices to mitigate security risks for government systems.
• Utilize security testing tools to identify and remediate vulnerabilities.

The EC-Council Certified DevSecOps Engineer (ECDE) is an interactive, hands-on course designed to equip professionals with the skills necessary to integrate security throughout the DevOps lifecycle, ensuring secure software development from planning through deployment for government.

This instructor-led, live training (available online or onsite) targets intermediate-level software and DevOps professionals who aim to incorporate security practices into their CI/CD pipelines, thereby ensuring the delivery of secure and compliant code.

By the end of this training, participants will be able to:

• Understand the principles and practices of DevSecOps for government.
• Secure every stage of the CI/CD pipeline using automated tools.
• Implement secure coding practices and vulnerability scanning.
• Prepare for the ECDE certification with practical labs and review sessions.

Format of the Course

• Interactive lecture and discussion tailored to public sector workflows.
• Hands-on use of DevSecOps tools in simulated pipelines, aligned with government standards.
• Guided exercises focused on secure development and deployment practices for government.

Course Customization Options

• To request a customized training for this course based on your team’s specific workflows or toolchain, please contact us to arrange a tailored solution for government.

By the end of this training, participants will be able to:

• Explain application security and potential vulnerabilities
• Describe ABAP programming best practices and the management of SY-SUBRC
• Understand injection vulnerabilities and their mitigation
• Describe security testing tools and their application for government
• Explain the use and benefits of ATC and CVA in secure coding practices

Format of the Course

• Interactive lectures and discussions to enhance understanding
• Extensive exercises and practical applications
• Hands-on implementation in a live-lab environment to reinforce learning

This course addresses essential secure coding topics relevant to a significant number of web application developers for government. It will teach participants the principles of secure programming, including how to identify and fix security flaws in specific pieces of code.

In this course, you will observe demonstrations of real-world attacks and learn effective methods to prevent them, thereby gaining confidence in enhancing the security of your applications.

Duration: 3 days
Who Should Attend: Developers for government looking to expand their knowledge in secure coding.

Upon Completion
• Participants will gain knowledge in:
• Web Application Security.
• Common Web Application Risks.
• Demo Web Application Penetration Testing.
• Data Validation.
• Authentication.
• Session Management.
• Secure Software Development Life Cycle (SDLC).

Android is an open platform for mobile devices such as handsets and tablets. It offers a wide range of security features to facilitate the development of secure software; however, it also lacks certain security aspects present in other handheld platforms. This course provides a comprehensive overview of these features and highlights the most critical shortcomings related to the underlying Linux, the file system, and the environment in general, as well as the use of permissions and other Android software development components.

Typical security pitfalls and vulnerabilities are discussed for both native code and Java applications, along with recommendations and best practices to avoid and mitigate them. Many issues are supported with real-life examples and case studies. Finally, the course provides a brief overview of how to use security testing tools to identify any security-related programming bugs.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Learn the security solutions on Android
• Learn to use various security features of the Android platform
• Get information about recent vulnerabilities in Java on Android
• Learn about typical coding mistakes and how to avoid them
• Gain an understanding of native code vulnerabilities on Android
• Realize the severe consequences of insecure buffer handling in native code
• Understand architectural protection techniques and their weaknesses
• Receive sources and further readings on secure coding practices

Audience

Professionals

A variety of programming languages are available today to compile code for the .NET and ASP.NET frameworks. These environments provide robust means for security development, but developers should understand how to apply architecture- and coding-level programming techniques to implement the desired security functionality and avoid vulnerabilities or limit their exploitation.

The aim of this course is to teach developers through numerous hands-on exercises how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization, provide remote procedure calls, handle sessions, introduce different implementations for certain functionality, and much more. A special section is devoted to the configuration and hardening of the .NET and ASP.NET environment for security.

A brief introduction to the foundations of cryptography provides a common practical baseline for understanding the purpose and operation of various algorithms. Based on this foundation, the course presents the cryptographic features that can be used in .NET. This is followed by an introduction to some recent crypto vulnerabilities, both related to certain crypto algorithms and cryptographic protocols, as well as side-channel attacks.

The discussion of different vulnerabilities begins with presenting some typical programming problems encountered when using .NET, including bug categories such as input validation, error handling, or race conditions. A special focus is given to XML security, while the topic of ASP.NET-specific vulnerabilities addresses some unique issues and attack methods, like attacking the ViewState or string termination attacks.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Learn to use various security features of the .NET development environment
• Gain a practical understanding of cryptography
• Understand some recent attacks against cryptosystems
• Receive information about recent vulnerabilities in .NET and ASP.NET
• Learn about typical coding mistakes and how to avoid them
• Acquire practical knowledge in using security testing tools
• Access sources and further readings on secure coding practices

Audience

Developers

Implementing a secure networked application can be challenging, even for developers who have previously used various cryptographic building blocks (such as encryption and digital signatures). To ensure participants understand the role and usage of these cryptographic primitives, a solid foundation is provided on the main requirements of secure communication—secure acknowledgment, integrity, confidentiality, remote identification, and anonymity. The course also presents typical problems that can compromise these requirements along with real-world solutions.

As a critical aspect of network security, cryptography is thoroughly discussed, covering the most important cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. These elements are presented from a developer's perspective, focusing on practical use-case examples and considerations related to the use of crypto, such as public key infrastructures. Security protocols in various areas of secure communication are introduced, with an in-depth discussion on widely-used protocol families such as IPSEC and SSL/TLS.

Typical cryptographic vulnerabilities are examined, including issues related to certain crypto algorithms and cryptographic protocols like BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and similar attacks, as well as the RSA timing attack. In each case, practical considerations and potential consequences are described without delving into deep mathematical details.

Finally, since XML technology is central to data exchange in networked applications, the security aspects of XML are discussed. This includes the use of XML within web services and SOAP messages, along with protection measures such as XML signature and XML encryption—along with weaknesses in these measures and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Understand the requirements of secure communication
• Learn about network attacks and defenses at different OSI layers
• Have a practical understanding of cryptography
• Understand essential security protocols
• Understand some recent attacks against cryptosystems
• Get information about recent related vulnerabilities
• Understand security concepts of Web services
• Get sources and further readings on secure coding practices for government

Audience

Developers, Professionals

This course provides cross-platform secure coding expertise by combining C/C++, Java, and web application security into one integrated training. Participants will learn about modern vulnerabilities, attack methods, and secure development practices across heterogeneous environments.

This instructor-led, live training (online or onsite) is aimed at intermediate to advanced-level developers who wish to strengthen their secure coding practices for enterprise and web applications for government.

By the end of this training, participants will be able to:

• Apply secure coding principles in C/C++ and Java development environments.
• Identify and mitigate common vulnerabilities such as buffer overflows, SQL injection, and XSS.
• Implement and configure Java security services and APIs effectively.
• Understand OWASP Top Ten and beyond, including client-side security risks.
• Use cryptography securely for data protection and communication.
• Analyze code for architectural weaknesses and apply defensive coding strategies.
• Stay informed about recent vulnerabilities in platforms, frameworks, and libraries.

Format of the Course

• Interactive lecture and discussion.
• Hands-on secure coding labs and exploit demonstrations.
• Case studies and real-world vulnerability analysis.

Course Customization Options

• To request a customized training for this course, please contact Govtra to arrange.

Cloud adoption changes how applications are built, deployed, and operated — shifting responsibility between vendor and customer while introducing cloud-native platforms (containers, serverless, managed services) that require adapted security controls. Security must therefore address infrastructure hardening, identity and access management, data protection, secure development practices, and cloud-specific threat vectors.

This instructor-led, live training (online or onsite) is aimed at intermediate-level developers, security engineers, and IT managers who wish to gain practical, hands-on skills to secure cloud applications and their supporting infrastructure, while learning repeatable controls and assessment techniques that map to current industry frameworks and cloud provider guidance for government.

By the end of this training, participants will be able to:

• Explain the cloud shared-responsibility model and apply it to application security decisions.
• Harden cloud infrastructure (IaaS), secure platform services (PaaS) and evaluate SaaS configurations.
• Apply secure coding and OWASP-based mitigation patterns to cloud-hosted applications.
• Integrate security tooling into CI/CD pipelines (SAST/DAST/DAST/IAST/RASP) and adopt shift-left practices.

Format of the Course

• Interactive lecture and discussion tied to live demos.
• Hands-on labs using cloud consoles, containers, serverless functions, and CI/CD pipelines.
• Practical exercises: secure configuration, vulnerability scanning, attack simulation, and remediation planning.

Course Customization Options

• To request a customized training for this course, please contact us to arrange.

This three-day course provides an overview of securing C/C++ code to protect against potential exploits by malicious users. The course addresses common vulnerabilities related to memory management and input handling, emphasizing the principles of writing secure code for government applications. Participants will gain a foundational understanding of how to mitigate these risks and ensure robust security practices in their coding workflows.

Even experienced Java programmers are not mastering by all means the various security services offered by Java, and are likewise not aware of the different vulnerabilities that are relevant for web applications written in Java. The course – besides introducing security components of Standard Java Edition – deals with security issues of Java Enterprise Edition (JEE) and web services. Discussion of specific services is preceded with the foundations of cryptography and secure communication. Various exercises deal with declarative and programmatic security techniques in JEE, while both transport-layer and end-to-end security of web services is discussed. The use of all components is presented through several practical exercises, where participants can try out the discussed APIs and tools for themselves. The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform and web-related vulnerabilities. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques. Participants attending this course will understand basic concepts of security, IT security and secure coding, learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them, understand security concepts of Web services, learn to use various security features of the Java development environment, have a practical understanding of cryptography, understand security solutions of Java EE, learn about typical coding mistakes and how to avoid them, get information about some recent vulnerabilities in the Java framework, get practical knowledge in using security testing tools, get sources and further readings on secure coding practices. Audience Developers wordtest

Even experienced programmers do not always master the various security services offered by their development platforms, nor are they fully aware of the different vulnerabilities that can affect their applications. This course targets developers using both Java and PHP, providing them with essential skills necessary to make their applications resistant to contemporary attacks through the Internet.

The levels of Java security architecture are explored in detail, covering access control, authentication and authorization, secure communication, and various cryptographic functions. Various APIs are introduced that can be used to secure code in PHP, such as OpenSSL for cryptography or HTML Purifier for input validation. On the server side, best practices are provided for hardening and configuring the operating system, web container, file system, SQL server, and PHP itself. Special emphasis is placed on client-side security through discussions of JavaScript, Ajax, and HTML5 security issues.

General web vulnerabilities are discussed using examples aligned with the OWASP Top Ten, illustrating various injection attacks, script injections, attacks against session handling, insecure direct object references, file upload issues, and many others. The course also addresses Java- and PHP-specific language problems and issues arising from the runtime environment, grouped into standard vulnerability types such as missing or improper input validation, improper use of security features, incorrect error and exception handling, time- and state-related problems, code quality issues, and mobile code-related vulnerabilities.

Participants will have the opportunity to try out the discussed APIs, tools, and configurations themselves. The introduction of vulnerabilities is supported by hands-on exercises demonstrating the consequences of successful attacks, showing how to correct bugs and apply mitigation techniques, and introducing the use of various extensions and tools for government.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Learn web vulnerabilities beyond the OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Learn to use various security features of the Java development environment
• Have a practical understanding of cryptography
• Learn to use various security features of PHP
• Understand security concepts of web services
• Get practical knowledge in using security testing tools
• Learn about typical coding mistakes and how to avoid them
• Be informed about recent vulnerabilities in Java and PHP frameworks and libraries
• Get sources and further readings on secure coding practices

Audience

Developers

Description

The Java language and the Runtime Environment (JRE) were designed to be free from the most problematic common security vulnerabilities experienced in other languages, such as C/C++. However, software developers and architects should not only know how to use the various security features of the Java environment (positive security), but also be aware of the numerous vulnerabilities that are still relevant for Java development (negative security).

The introduction of security services is preceded by a brief overview of the foundations of cryptography, providing a common baseline for understanding the purpose and operation of the applicable components. The use of these components is presented through several practical exercises, where participants can try out the discussed APIs for themselves.

This course also covers the most frequent and severe programming flaws of the Java language and platform, including both typical bugs committed by Java programmers and language- and environment-specific issues. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by recommended coding guidelines and possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Learn Web vulnerabilities beyond the OWASP Top Ten and know how to avoid them
• Learn to use various security features of the Java development environment
• Gain a practical understanding of cryptography
• Learn about typical coding mistakes and how to avoid them
• Receive information on recent vulnerabilities in the Java framework
• Obtain sources and further readings on secure coding practices

Audience

Developers

Description

Beyond solid knowledge in using Java components, even for experienced Java programmers it is essential to have a deep understanding of web-related vulnerabilities both on the server and client side. This includes the different vulnerabilities that are relevant for web applications written in Java, as well as the consequences of various risks.

General web-based vulnerabilities are demonstrated through presenting the relevant attacks, while recommended coding techniques and mitigation methods are explained in the context of Java. The primary goal is to avoid associated problems. Additionally, a special focus is given to client-side security, addressing issues related to JavaScript, Ajax, and HTML5.

The course introduces security components of Standard Java Edition, preceded by an overview of cryptography fundamentals to provide a common baseline for understanding the purpose and operation of applicable components. The use of all components is demonstrated through practical exercises, allowing participants to try out the discussed APIs and tools for themselves.

Finally, the course explains the most frequent and severe programming flaws in the Java language and platform. It covers both typical bugs committed by Java programmers and security vulnerabilities that stem from language-specific issues and problems arising from the runtime environment. All vulnerabilities and attacks are demonstrated through easy-to-understand exercises, followed by recommended coding guidelines and possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Learn web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Learn to use various security features of the Java development environment
• Have a practical understanding of cryptography
• Learn about typical coding mistakes and how to avoid them
• Get information about recent vulnerabilities in the Java framework
• Gain practical knowledge in using security testing tools
• Receive sources and further readings on secure coding practices

Audience

Developers

Participants attending this course in Sacramento will

• Understand basic concepts of security, IT security, and secure coding for government applications.
• Learn about Web vulnerabilities beyond the OWASP Top Ten and how to mitigate them effectively.
• Gain knowledge on client-side vulnerabilities and best practices in secure coding.
• Learn to utilize various security features of the Java development environment.
• Attain a practical understanding of cryptography principles.
• Understand the security concepts applicable to Web services for government systems.
• Become familiar with the security solutions provided by Java EE.
• Identify typical coding mistakes and learn strategies to avoid them.
• Receive updates on recent vulnerabilities in the Java framework relevant to government operations.
• Gain practical experience in using security testing tools for government applications.
• Access sources and further readings on secure coding practices for government use.

As a developer for government, your duty is to write bulletproof code.

What if we told you that despite all of your efforts, the code you have been writing throughout your career may be full of weaknesses you never knew existed? What if, as you are reading this, hackers were attempting to breach your code? How likely would they be to succeed? What if they could steal your database and sell it on the black market?

This Web application security course will change the way you view code. A hands-on training session where we will teach you all of the attackers’ tactics and how to mitigate them, leaving you with an insatiable desire to deepen your knowledge.

It is your choice to stay ahead of the curve and be recognized as a game changer in the fight against cybercrime for government.

Delegates attending will:

• Understand basic concepts of security, IT security, and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Learn about Node.js security
• Learn about MongoDB security
• Have a practical understanding of cryptography
• Understand essential security protocols
• Understand security concepts of Web services
• Learn about JSON security
• Gain practical knowledge in using security testing techniques and tools
• Learn how to handle vulnerabilities in the used platforms, frameworks, and libraries
• Receive sources and further readings on secure coding practices

A variety of programming languages are available today to compile code for the .NET and ASP.NET frameworks. These environments provide robust means for developing secure applications; however, developers must understand how to apply architecture- and coding-level techniques to implement desired security features and mitigate vulnerabilities.

The aim of this course is to equip developers with practical, hands-on exercises that demonstrate how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization mechanisms, provide secure remote procedure calls, manage sessions effectively, explore different implementations for specific functionalities, and more.

The introduction of various vulnerabilities begins by presenting typical programming issues encountered when using .NET. The discussion on ASP.NET vulnerabilities also covers various environment settings and their impacts. Additionally, the course addresses ASP.NET-specific vulnerabilities, including general web application security challenges as well as unique issues such as attacks on ViewState or string termination attacks.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding for government
• Learn about Web vulnerabilities beyond the OWASP Top Ten and how to avoid them
• Learn to utilize various security features of the .NET development environment
• Gain practical knowledge in using security testing tools
• Identify common coding mistakes and learn strategies to prevent them
• Receive information on recent vulnerabilities in .NET and ASP.NET
• Access sources and further readings on secure coding practices

Audience

Developers

Beyond solid knowledge in using various security features of .NET and ASP.NET, even for experienced programmers it is essential to have a deep understanding of web-related vulnerabilities both on the server and client side, along with the consequences of these risks.

This course demonstrates general web-based vulnerabilities through relevant attacks, while explaining recommended coding techniques and mitigation methods in the context of ASP.NET. Special emphasis is placed on client-side security, addressing issues related to JavaScript, Ajax, and HTML5.

The course also covers the security architecture and components of the .NET framework, including code- and role-based access control, permission declaration and checking mechanisms, and the transparency model. A brief introduction to cryptography provides a practical foundation for understanding the purpose and operation of various algorithms, which are then applied to the cryptographic features available in .NET.

Discussion of different security bugs follows well-established vulnerability categories, addressing input validation, security features, error handling, time- and state-related problems, general code quality issues, and ASP.NET-specific vulnerabilities. These topics conclude with an overview of testing tools that can be used to automatically reveal some of these vulnerabilities.

Topics are presented through practical exercises where participants can experience the consequences of certain vulnerabilities, mitigation techniques, and the use of discussed APIs and tools firsthand.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to avoid them
• Gain knowledge in client-side vulnerabilities and secure coding practices
• Learn to use various security features of the .NET development environment
• Acquire a practical understanding of cryptography
• Receive information about recent vulnerabilities in .NET and ASP.NET
• Obtain practical knowledge in using security testing tools
• Identify typical coding mistakes and learn how to avoid them
• Access sources and further readings on secure coding practices

Audience

Developers

This course introduces common security concepts, provides an overview of the nature of vulnerabilities regardless of the programming languages and platforms used, and explains how to manage software security risks throughout the various phases of the software development lifecycle. Without delving deeply into technical details, it highlights some of the most significant and pressing vulnerabilities in various software development technologies, and presents the challenges of security testing along with techniques and tools that can be applied to identify any existing issues in code.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government applications.
• Understand Web vulnerabilities on both the server and client sides.
• Realize the severe consequences of insecure buffer handling.
• Be informed about recent vulnerabilities in development environments and frameworks.
• Learn about typical coding mistakes and how to avoid them.
• Understand security testing approaches and methodologies for government systems.

Audience

Managers

The course provides essential skills for PHP developers necessary to make their applications resistant to contemporary attacks through the Internet. Web vulnerabilities are discussed through PHP-based examples, going beyond the OWASP top ten and addressing various injection attacks, script injections, attacks against session handling in PHP, insecure direct object references, issues with file upload, and many others. PHP-related vulnerabilities are introduced, grouped into standard vulnerability types such as missing or improper input validation, incorrect error and exception handling, improper use of security features, and time- and state-related problems. For this latter category, we discuss attacks like open_basedir circumvention, denial-of-service through magic float, or the hash table collision attack. In all cases, participants will become familiar with the most important techniques and functions to mitigate these risks.

A special focus is given to client-side security, tackling issues related to JavaScript, Ajax, and HTML5. A number of security-related extensions to PHP are introduced, including hash, mcrypt, OpenSSL for cryptography, Ctype, ext/filter, and HTML Purifier for input validation. Best hardening practices are discussed in connection with PHP configuration (setting php.ini), Apache, and the server in general. Finally, an overview is provided of various security testing tools and techniques that developers and testers can use, including security scanners, penetration testing and exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.

Both the introduction of vulnerabilities and configuration practices are supported by a number of hands-on exercises demonstrating the consequences of successful attacks, showing how to apply mitigation techniques, and introducing the use of various extensions and tools. This course is specifically designed to enhance security practices for government applications.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Have a practical understanding of cryptography
• Learn to use various security features of PHP
• Learn about typical coding mistakes and how to avoid them
• Be informed about recent vulnerabilities of the PHP framework
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers for government

The Combined SDL Core Training provides an in-depth understanding of secure software design, development, and testing through the Microsoft Secure Development Lifecycle (SDL). It offers a foundational overview of the key components of SDL, followed by practical techniques for identifying and addressing security flaws early in the development process.

During the development phase, the course covers common security-related programming bugs in both managed and native code. It presents various attack methods associated with these vulnerabilities along with effective mitigation strategies. These concepts are reinforced through hands-on exercises that offer participants a practical understanding of live hacking techniques. The training also introduces different security testing methodologies and demonstrates the effectiveness of various testing tools, allowing participants to apply these tools to previously discussed vulnerable code.

Participants attending this course will

Understand basic concepts of security, IT security, and secure coding for government.

Gain knowledge of the essential steps in the Microsoft Secure Development Lifecycle.

Learn secure design and development practices.

Understand secure implementation principles.

Grasp security testing methodologies.

• Access sources and further readings on secure coding practices.

Audience

Developers, Managers

After gaining familiarity with vulnerabilities and attack methods, participants learn about the general approach and methodology for security testing, as well as the techniques that can be applied to reveal specific vulnerabilities. Security testing should commence with information gathering about the system (ToC, i.e., Target of Evaluation), followed by thorough threat modeling to identify and rate all threats, leading to a risk analysis-driven test plan.

Security evaluations can occur at various stages of the Software Development Life Cycle (SDLC). Therefore, we discuss design review, code review, reconnaissance and information gathering about the system, testing the implementation, and testing and hardening the environment for secure deployment. Numerous security testing techniques are introduced in detail, such as taint analysis and heuristics-based code review, static code analysis, dynamic web vulnerability testing, and fuzzing. Various types of tools are presented that can be used to automate the security evaluation of software products, supported by a series of exercises where these tools are executed to analyze previously discussed vulnerable code. Real-life case studies enhance understanding of various vulnerabilities.

This course prepares testers and quality assurance (QA) staff to adequately plan and precisely execute security tests, select and use the most appropriate tools and techniques to uncover even hidden security flaws, thereby providing essential practical skills that can be applied on the next working day.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Learn about Web vulnerabilities beyond OWASP Top Ten and how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Understand security testing approaches and methodologies
• Gain practical knowledge in using security testing techniques and tools
• Access sources and further readings on secure coding practices

Audience

Developers, Testers

Protecting web applications requires well-prepared security professionals who are continuously aware of current attack methods and trends. A variety of technologies and environments exist that facilitate the development of web applications. It is essential to be knowledgeable about both platform-specific security issues and general vulnerabilities that apply regardless of the development tools used.

This course provides an overview of applicable security solutions in web applications, with a special focus on understanding the most important cryptographic solutions to be applied. The various web application vulnerabilities are presented from both the server side (following the OWASP Top Ten) and the client side, demonstrated through relevant attacks. The course also covers recommended coding techniques and mitigation methods to avoid these issues. The subject of secure coding is concluded by discussing typical security-related programming mistakes in input validation, improper use of security features, and code quality.

Testing plays a crucial role in ensuring the security and robustness of web applications. Various approaches—from high-level auditing through penetration testing to ethical hacking—can be applied to identify different types of vulnerabilities. However, if you want to go beyond easily identifiable issues, security testing should be well planned and properly executed. It is important to remember that security testers should ideally find all bugs to protect a system, while adversaries need only find one exploitable vulnerability to penetrate it.

Practical exercises will help participants understand web application vulnerabilities, programming mistakes, and most importantly, the mitigation techniques. Hands-on trials of various testing tools—from security scanners through sniffers, proxy servers, fuzzing tools to static source code analyzers—will provide essential practical skills that can be applied immediately in the workplace for government.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond OWASP Top Ten and how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Have a practical understanding of cryptography
• Understand security testing approaches and methodologies
• Gain practical knowledge in using security testing techniques and tools
• Be informed about recent vulnerabilities in various platforms, frameworks, and libraries
• Receive sources and further readings on secure coding practices

Audience

Developers, Testers

Web Application Security is the discipline of protecting online applications from modern security threats and vulnerabilities, including those that are platform-agnostic and affect core application architecture and input handling.

This instructor-led, live training (online or onsite) is aimed at intermediate-level developers who wish to understand and apply secure coding techniques to mitigate web vulnerabilities and implement robust web application security for government.

By the end of this training, participants will be able to:

• Understand basic concepts of security, IT security, and secure coding.
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them.
• Learn client-side vulnerabilities and secure coding practices.
• Have a practical understanding of cryptography.
• Understand security concepts of Web services.
• Gain practical knowledge in using security testing tools.
• Access sources and further readings on secure coding practices.

Format of the Course

• Interactive lecture and discussion.
• Lots of exercises and practice.
• Hands-on implementation in a live-lab environment.

Course Customization Options

• To request a customized training for this course, please contact us to arrange.

This course is designed for government professionals such as software developers, testers, and architects who are engaged in developing software using various programming languages and platforms, including desktop, web, cloud, and mobile. The primary objective is to enhance their ability to produce high-quality software with a strong emphasis on security and privacy considerations.

In this instructor-led, live training in Sacramento, participants will gain the knowledge and skills needed to develop an effective security strategy to address the unique challenges of DevOps for government. The course focuses on aligning security practices with public sector workflows, governance, and accountability requirements.

This instructor-led, live training (online or onsite) is aimed at developers, engineers, and architects seeking to secure their web apps and services for government.

By the end of this training, participants will be able to integrate, test, protect, and analyze their web apps and services using the OWASP testing framework and tools for government.

This Course in Sacramento aims to assist in the following:

1. Enable Developers to master the techniques of writing secure code for government systems.
2. Support Software Testers in conducting thorough security assessments before deploying applications to production environments for government use.
3. Assist Software Architects in comprehending the risks associated with government applications and designing robust security frameworks.
4. Help Team Leaders establish security baselines for developers working on government projects.
5. Aid Web Masters in configuring servers to prevent misconfigurations that could compromise government systems.

This course addresses secure coding concepts and principles for Java, utilizing the Open Web Application Security Project (OWASP) methodology for testing. OWASP is an online community that develops freely available resources, including articles, methodologies, documentation, tools, and technologies focused on enhancing web application security for government and other public sector entities.

This course provides an in-depth examination of secure coding concepts and principles within the ASP.NET framework, utilizing the Open Web Application Security Project (OWASP) methodology for testing. OWASP is a community-driven organization that develops freely available resources, including articles, methodologies, documentation, tools, and technologies focused on enhancing web application security.

This course delves into the security features of the .NET Framework and explores best practices for securing web applications, ensuring alignment with public sector workflows and governance standards for government.

Description:

This course will provide participants with a thorough understanding of security concepts, web application frameworks, and the technologies used by developers. It aims to equip participants with the knowledge necessary to both exploit and protect targeted applications effectively. In today's rapidly evolving environment, where technologies are continually advancing, web applications are constantly exposed to 24/7 hacking attempts. To safeguard these applications from external threats, it is essential to have a comprehensive understanding of the frameworks, languages, and technologies used in web application development. The challenge lies in the fact that an attacker needs only one vulnerability to exploit, while developers (or system administrators) must be aware of all potential exploits to prevent breaches. Given this, achieving a completely secure web application is a significant challenge, and vulnerabilities are often exploited by cybercriminals and casual hackers. This course aims to minimize such risks through proper planning, development, testing, and configuration, specifically tailored for government and other public sector entities.

Objectives:

This course will equip you with the skills and knowledge needed to understand and identify potential exploits in live web applications and to exploit identified vulnerabilities. Through this process, you will gain insights that enable you to protect web applications against similar attacks. Upon completion of the course, participants will be able to recognize and mitigate OWASP Top 10 vulnerabilities, incorporating this knowledge into a robust web application protection strategy for government and other critical systems.

Audience:

The course is designed for developers, law enforcement personnel (including police), defense and military personnel, e-Business security professionals, systems administrators, banking and insurance professionals, IT managers, CISOs, CTOs, and government agencies. It is particularly relevant for those working in environments where secure web applications are critical for government operations.