Advanced Java Security Training Course

Implementing a secure networked application can be challenging, even for developers who have previously used various cryptographic building blocks (such as encryption and digital signatures). To ensure participants understand the role and usage of these cryptographic primitives, a solid foundation is provided on the main requirements of secure communication—secure acknowledgment, integrity, confidentiality, remote identification, and anonymity. The course also presents typical problems that can compromise these requirements along with real-world solutions.

As a critical aspect of network security, cryptography is thoroughly discussed, covering the most important cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. These elements are presented from a developer's perspective, focusing on practical use-case examples and considerations related to the use of crypto, such as public key infrastructures. Security protocols in various areas of secure communication are introduced, with an in-depth discussion on widely-used protocol families such as IPSEC and SSL/TLS.

Typical cryptographic vulnerabilities are examined, including issues related to certain crypto algorithms and cryptographic protocols like BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and similar attacks, as well as the RSA timing attack. In each case, practical considerations and potential consequences are described without delving into deep mathematical details.

Finally, since XML technology is central to data exchange in networked applications, the security aspects of XML are discussed. This includes the use of XML within web services and SOAP messages, along with protection measures such as XML signature and XML encryption—along with weaknesses in these measures and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Understand the requirements of secure communication
• Learn about network attacks and defenses at different OSI layers
• Have a practical understanding of cryptography
• Understand essential security protocols
• Understand some recent attacks against cryptosystems
• Get information about recent related vulnerabilities
• Understand security concepts of Web services
• Get sources and further readings on secure coding practices for government

Audience

Developers, Professionals

This three-day course provides an overview of securing C/C++ code to protect against malicious users who may exploit vulnerabilities related to memory management and input handling. The course covers the fundamental principles of writing secure code for government applications, ensuring that participants understand best practices in safeguarding software integrity and functionality.

Several programming languages are currently available to compile code for the .NET and ASP.NET frameworks. These environments provide robust tools for security development; however, developers must understand how to apply architectural and coding-level techniques to implement effective security measures and mitigate vulnerabilities. This course is designed to equip developers with practical skills through numerous hands-on exercises. Participants will learn how to prevent untrusted code from executing privileged actions, secure resources using strong authentication and authorization methods, facilitate remote procedure calls, manage sessions, explore different implementations for specific functionalities, and more. The course begins by introducing common programming issues that can arise when using .NET. It then delves into the vulnerabilities of ASP.NET, covering various environment settings and their implications. The discussion on ASP.NET-specific vulnerabilities addresses general web application security challenges as well as unique issues such as attacks on ViewState and string termination attacks. Participants attending this course will: - Understand fundamental concepts of security, IT security, and secure coding for government. - Learn about Web vulnerabilities beyond the OWASP Top Ten and how to prevent them. - Gain proficiency in using various security features of the .NET development environment. - Acquire practical knowledge in utilizing security testing tools. - Identify typical coding mistakes and learn strategies to avoid them. - Stay informed about recent vulnerabilities in .NET and ASP.NET. - Receive resources and further readings on secure coding practices. Audience: - Developers for government and private sector projects.

Apache Groovy is a dynamic programming language designed for use on the Java Virtual Machine (JVM). Key features include robust scripting capabilities, support for creating Domain-Specific Languages (DSLs), runtime and compile-time meta-programming, and functional programming constructs. Groovy is frequently used in conjunction with Java to enhance application development. In this instructor-led, live training, participants will gain proficiency in programming with Groovy as they work through the creation of a sample application. **Target Audience:** - Developers **Course Format:** - A combination of lectures, discussions, practical exercises, and extensive hands-on practice This training is tailored to meet the needs of developers looking to leverage Groovy for government projects, ensuring alignment with public sector workflows, governance, and accountability.

This instructor-led, live training (available online or onsite) is designed for beginner-level developers who wish to learn the fundamentals of Groovy Programming. By the end of this training, participants will be able to: - Comprehend basic programming concepts. - Write simple Groovy scripts and utilize core features of Groovy. - Understand and apply fundamental principles of object-oriented programming using Groovy. - Learn essential error-handling techniques to manage common programming errors and exceptions in Groovy. This training is tailored to support the professional development needs of individuals working for government agencies, ensuring they have the necessary skills to enhance their technical capabilities.

This instructor-led, live training (online or onsite) is designed for intermediate-level Java developers who wish to design, develop, deploy, and maintain microservices-based applications using Java frameworks such as Spring Boot and Spring Cloud. By the end of this training, participants will be able to: - Understand the principles and benefits of a microservices architecture. - Build and deploy microservices using Java and Spring Boot. - Implement service discovery, configuration management, and API gateways. - Secure, monitor, and scale microservices effectively. - Deploy microservices using Docker and Kubernetes. This training is tailored to enhance the skills of government IT professionals in leveraging modern technologies for government projects.

This instructor-led, live training (available online or onsite) is designed for intermediate to advanced developers aiming to excel in the development of microservices using Spring Boot, Docker, and Kubernetes for government applications.

Upon completion of this training, participants will be able to:

• Understand the fundamental principles of microservices architecture.
• Create production-ready microservices utilizing Spring Boot.
• Grasp the essential role of Docker in containerizing microservices.
• Set up Kubernetes clusters for deploying and orchestrating microservices effectively.

This instructor-led, live training (online or onsite) is designed for developers who wish to use Quarkus to build, test, and deploy applications that are fully powered by Java but require minimal resource utilization. By the end of this training, participants will be able to: - Set up the necessary development environment to start developing applications with Quarkus. - Build, compile, and run applications in native mode using GraalVM. - Utilize Quarkus tooling and extensions for building native applications with Maven. - Containerize, execute, and deploy applications with Docker, ensuring they are optimized for government use.

This instructor-led, live training in US (online or onsite) is aimed at intermediate to advanced developers and architects who wish to develop Java native applications and microservices using Quarkus with optimized memory usage and startup time. By the end of this training, participants will be able to: - Develop high-performance, lightweight Java native applications using Quarkus. - Build and deploy RESTful services and microservices architectures. - Utilize GraalVM for native compilation to enhance startup and memory efficiency. - Package and containerize applications for deployment in Kubernetes and OpenShift environments, ensuring alignment with public sector workflows and governance for government use.

This instructor-led, live training in US (online or onsite) is aimed at software architects and web developers who wish to utilize RabbitMQ as a messaging middleware and program in Java using Spring to develop applications for government. By the end of this training, participants will be able to: - Utilize Java and Spring with RabbitMQ to build robust applications. - Design asynchronous message-driven systems using RabbitMQ. - Create and apply queues, topics, exchanges, and bindings within RabbitMQ.

This instructor-led, live training in US (online or onsite) is aimed at web developers who wish to build functional front-end and back-end web applications with Spring Boot, React, and Redux for government use. By the end of this training, participants will be able to: - Construct a front-end application using React and Redux. - Develop RESTful APIs with Spring Boot. - Implement secure web services with Spring Security and JWT web tokens.

This instructor-led, live training in US (online or onsite) is designed for government Java developers who wish to use the Spring 5 framework to develop and deploy enterprise web applications for government. By the end of this training, participants will be able to: - Install and configure Spring 5. - Understand and implement the latest features of Spring 5. - Access databases using Spring Application. - Utilize the new reactive web framework, WebFlow, to make an application reactive. - Integrate a Spring application with legacy Java EE applications for government. - Test and deploy an enterprise-grade Spring application for government.

The Spring framework is a comprehensive Java platform that simplifies enterprise application development by offering robust dependency injection, modular architecture, and streamlined configuration options.

This instructor-led, live training (online or onsite) is designed for beginner-level Java developers who wish to build modern, production-ready web applications using the latest version of Spring Framework and Spring Boot 3.5.5 with Java 21.

By the end of this training, participants will be able to:

• Understand Spring’s core principles, including Inversion of Control (IoC), Dependency Injection (DI), and Aspect-Oriented Programming (AOP).
• Configure Spring applications using XML, annotations, and JavaConfig.
• Develop RESTful services using Spring Boot and JPA.
• Implement CRUD operations, manage transactions, and handle data persistence.
• Leverage advanced Spring features such as profiles, exception handling, and data serialization.

Format of the Course

• Brief theoretical introduction followed by extensive practical exercises.
• Hands-on implementation using real-world examples.
• Interactive discussion and guided troubleshooting sessions.

Course Customization Options

• To request a customized training for government or other specific needs, please contact us to arrange.

Spring WebFlux is a reactive programming module within the Spring Framework designed for building non-blocking, event-driven web applications. This instructor-led, live training (online or onsite) is aimed at beginner-level to intermediate-level Java developers who wish to build scalable and responsive applications using Spring WebFlux. By the end of this training, participants will be able to: - Understand the fundamentals of reactive programming with Project Reactor. - Build and test non-blocking RESTful APIs using Spring WebFlux. - Integrate WebFlux with databases and external services. - Apply reactive patterns to real-world application scenarios. **Format of the Course** - Interactive lecture and discussion. - Extensive exercises and practice sessions. - Hands-on implementation in a live-lab environment. **Course Customization Options for Government** To request a customized training for this course, tailored specifically to meet the needs of government agencies, please contact us to arrange.

This instructor-led, live training in US (online or onsite) is designed for developers who wish to utilize WebFlux to develop and deploy reactive applications for government use.

By the end of this training, participants will be able to:

• Install and configure Spring 5 and the WebFlux framework.
• Develop reactive applications and services to enhance public sector workflows and governance.