CYBERSECURE CODER (CSC) Training Course

Advances in computing and engineering are propelling technological progress, encompassing areas such as blockchain, artificial intelligence, gene editing, and the Internet of Things (IoT). These innovations present significant opportunities for enhancing productivity and human well-being. However, they also introduce new risks, as recent scandals have demonstrated. Technology professionals are under growing pressure to address ethical concerns, ensuring a balance between privacy, accuracy, fairness, and safety. This course offers practical tools to manage ethical risks in emerging data-driven technologies, drawing from theoretical frameworks, regulatory guidelines, and industry best practices. Participants will acquire the skills necessary to navigate ethical dilemmas within their roles and organizations, fostering responsible technology development for government and the broader public sector.

This course covers network defense and incident response methods, tactics, and procedures, aligning with industry frameworks such as NIST 800-61 r.2 (Computer Security Incident Handling), US-CERT’s NCISP (National Cyber Incident Response Plan), and Presidential Policy Directive (PPD) 41 on Cyber Incident Coordination Policy. It is designed for individuals tasked with monitoring and detecting security incidents in information systems and networks, as well as executing standardized responses to such incidents. The course introduces tools, tactics, and procedures to manage cybersecurity risks, identify various types of common threats, evaluate the organization's security posture, collect and analyze cybersecurity intelligence, and remediate and report incidents as they occur. This course provides a comprehensive methodology for individuals responsible for defending the cybersecurity of their organization.

This course is designed to assist students in preparing for the CertNexus CyberSec First Responder (Exam CFR-310) certification examination. The knowledge and skills gained and practiced in this course can significantly contribute to your preparation. Additionally, this course and subsequent certification (CFR-310) meet all requirements for personnel requiring DoD directive 8570.01-M position certification baselines:

• CSSP Analyst

• CSSP Infrastructure Support

• CSSP Incident Responder

• CSSP Auditor

Course Objectives: In this course, you will understand, assess, and respond to security threats while operating a system and network security analysis platform. You will:

• Compare and contrast various threats and classify threat profiles

• Explain the purpose and use of attack tools and techniques

• Explain the purpose and use of post-exploitation tools and tactics

• Explain the purpose and use of social engineering tactics

• Given a scenario, perform ongoing threat landscape research and use data to prepare for incidents

• Explain the purpose and characteristics of various data sources

• Given a scenario, use appropriate tools to analyze logs

• Given a scenario, use regular expressions to parse log files and locate meaningful data

• Given a scenario, use Windows tools to analyze incidents

• Given a scenario, use Linux-based tools to analyze incidents

• Summarize methods and tools used for malware analysis

• Given a scenario, analyze common indicators of potential compromise

• Explain the importance of best practices in preparation for incident response

• Given a scenario, execute the incident response process

• Explain the importance of concepts unique to forensic analysis

• Explain general mitigation methods and devices

Target Student: This course is designed primarily for cybersecurity practitioners preparing for or who currently perform job functions related to protecting information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. It is ideal for roles within federal contracting companies and private sector firms whose mission or strategic objectives require the execution of Defensive Cyber Operations (DCO) or DoD Information Network (DODIN) operations and incident handling. This course focuses on the knowledge, ability, and skills necessary to provide defense for information systems in a cybersecurity context, including protection, detection, analysis, investigation, and response processes.

In addition, the course ensures that all members of an IT team—regardless of size, rank, or budget—understand their role in cyber defense, incident response, and incident handling. This training is essential for government agencies and organizations aiming to enhance their cybersecurity capabilities and ensure compliance with regulatory requirements for government.

Android is an open platform for mobile devices such as handsets and tablets. It offers a wide range of security features to facilitate the development of secure software; however, it also lacks certain security aspects present in other handheld platforms. This course provides a comprehensive overview of these features and highlights the most critical shortcomings related to the underlying Linux, the file system, and the environment in general, as well as the use of permissions and other Android software development components.

Typical security pitfalls and vulnerabilities are discussed for both native code and Java applications, along with recommendations and best practices to avoid and mitigate them. Many issues are supported with real-life examples and case studies. Finally, the course provides a brief overview of how to use security testing tools to identify any security-related programming bugs.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Learn the security solutions on Android
• Learn to use various security features of the Android platform
• Get information about recent vulnerabilities in Java on Android
• Learn about typical coding mistakes and how to avoid them
• Gain an understanding of native code vulnerabilities on Android
• Realize the severe consequences of insecure buffer handling in native code
• Understand architectural protection techniques and their weaknesses
• Receive sources and further readings on secure coding practices

Audience

Professionals

This three-day course provides an overview of securing C/C++ code to protect against potential exploits by malicious users. The course addresses common vulnerabilities related to memory management and input handling, emphasizing the principles of writing secure code for government applications. Participants will gain a foundational understanding of how to mitigate these risks and ensure robust security practices in their coding workflows.

Even experienced Java programmers are not mastering by all means the various security services offered by Java, and are likewise not aware of the different vulnerabilities that are relevant for web applications written in Java. The course – besides introducing security components of Standard Java Edition – deals with security issues of Java Enterprise Edition (JEE) and web services. Discussion of specific services is preceded with the foundations of cryptography and secure communication. Various exercises deal with declarative and programmatic security techniques in JEE, while both transport-layer and end-to-end security of web services is discussed. The use of all components is presented through several practical exercises, where participants can try out the discussed APIs and tools for themselves. The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform and web-related vulnerabilities. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques. Participants attending this course will understand basic concepts of security, IT security and secure coding, learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them, understand security concepts of Web services, learn to use various security features of the Java development environment, have a practical understanding of cryptography, understand security solutions of Java EE, learn about typical coding mistakes and how to avoid them, get information about some recent vulnerabilities in the Java framework, get practical knowledge in using security testing tools, get sources and further readings on secure coding practices. Audience Developers wordtest

Description

The Java language and the Runtime Environment (JRE) were designed to be free from the most problematic common security vulnerabilities experienced in other languages, such as C/C++. However, software developers and architects should not only know how to use the various security features of the Java environment (positive security), but also be aware of the numerous vulnerabilities that are still relevant for Java development (negative security).

The introduction of security services is preceded by a brief overview of the foundations of cryptography, providing a common baseline for understanding the purpose and operation of the applicable components. The use of these components is presented through several practical exercises, where participants can try out the discussed APIs for themselves.

This course also covers the most frequent and severe programming flaws of the Java language and platform, including both typical bugs committed by Java programmers and language- and environment-specific issues. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by recommended coding guidelines and possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Learn Web vulnerabilities beyond the OWASP Top Ten and know how to avoid them
• Learn to use various security features of the Java development environment
• Gain a practical understanding of cryptography
• Learn about typical coding mistakes and how to avoid them
• Receive information on recent vulnerabilities in the Java framework
• Obtain sources and further readings on secure coding practices

Audience

Developers

A variety of programming languages are available today to compile code for the .NET and ASP.NET frameworks. These environments provide robust means for developing secure applications; however, developers must understand how to apply architecture- and coding-level techniques to implement desired security features and mitigate vulnerabilities.

The aim of this course is to equip developers with practical, hands-on exercises that demonstrate how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization mechanisms, provide secure remote procedure calls, manage sessions effectively, explore different implementations for specific functionalities, and more.

The introduction of various vulnerabilities begins by presenting typical programming issues encountered when using .NET. The discussion on ASP.NET vulnerabilities also covers various environment settings and their impacts. Additionally, the course addresses ASP.NET-specific vulnerabilities, including general web application security challenges as well as unique issues such as attacks on ViewState or string termination attacks.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding for government
• Learn about Web vulnerabilities beyond the OWASP Top Ten and how to avoid them
• Learn to utilize various security features of the .NET development environment
• Gain practical knowledge in using security testing tools
• Identify common coding mistakes and learn strategies to prevent them
• Receive information on recent vulnerabilities in .NET and ASP.NET
• Access sources and further readings on secure coding practices

Audience

Developers

The course provides essential skills for PHP developers necessary to make their applications resistant to contemporary attacks through the Internet. Web vulnerabilities are discussed through PHP-based examples, going beyond the OWASP top ten and addressing various injection attacks, script injections, attacks against session handling in PHP, insecure direct object references, issues with file upload, and many others. PHP-related vulnerabilities are introduced, grouped into standard vulnerability types such as missing or improper input validation, incorrect error and exception handling, improper use of security features, and time- and state-related problems. For this latter category, we discuss attacks like open_basedir circumvention, denial-of-service through magic float, or the hash table collision attack. In all cases, participants will become familiar with the most important techniques and functions to mitigate these risks.

A special focus is given to client-side security, tackling issues related to JavaScript, Ajax, and HTML5. A number of security-related extensions to PHP are introduced, including hash, mcrypt, OpenSSL for cryptography, Ctype, ext/filter, and HTML Purifier for input validation. Best hardening practices are discussed in connection with PHP configuration (setting php.ini), Apache, and the server in general. Finally, an overview is provided of various security testing tools and techniques that developers and testers can use, including security scanners, penetration testing and exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.

Both the introduction of vulnerabilities and configuration practices are supported by a number of hands-on exercises demonstrating the consequences of successful attacks, showing how to apply mitigation techniques, and introducing the use of various extensions and tools. This course is specifically designed to enhance security practices for government applications.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Have a practical understanding of cryptography
• Learn to use various security features of PHP
• Learn about typical coding mistakes and how to avoid them
• Be informed about recent vulnerabilities of the PHP framework
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers for government

The Combined SDL Core Training provides an in-depth understanding of secure software design, development, and testing through the Microsoft Secure Development Lifecycle (SDL). It offers a foundational overview of the key components of SDL, followed by practical techniques for identifying and addressing security flaws early in the development process.

During the development phase, the course covers common security-related programming bugs in both managed and native code. It presents various attack methods associated with these vulnerabilities along with effective mitigation strategies. These concepts are reinforced through hands-on exercises that offer participants a practical understanding of live hacking techniques. The training also introduces different security testing methodologies and demonstrates the effectiveness of various testing tools, allowing participants to apply these tools to previously discussed vulnerable code.

Participants attending this course will

Understand basic concepts of security, IT security, and secure coding for government.

Gain knowledge of the essential steps in the Microsoft Secure Development Lifecycle.

Learn secure design and development practices.

Understand secure implementation principles.

Grasp security testing methodologies.

• Access sources and further readings on secure coding practices.

Audience

Developers, Managers

After gaining familiarity with vulnerabilities and attack methods, participants learn about the general approach and methodology for security testing, as well as the techniques that can be applied to reveal specific vulnerabilities. Security testing should commence with information gathering about the system (ToC, i.e., Target of Evaluation), followed by thorough threat modeling to identify and rate all threats, leading to a risk analysis-driven test plan.

Security evaluations can occur at various stages of the Software Development Life Cycle (SDLC). Therefore, we discuss design review, code review, reconnaissance and information gathering about the system, testing the implementation, and testing and hardening the environment for secure deployment. Numerous security testing techniques are introduced in detail, such as taint analysis and heuristics-based code review, static code analysis, dynamic web vulnerability testing, and fuzzing. Various types of tools are presented that can be used to automate the security evaluation of software products, supported by a series of exercises where these tools are executed to analyze previously discussed vulnerable code. Real-life case studies enhance understanding of various vulnerabilities.

This course prepares testers and quality assurance (QA) staff to adequately plan and precisely execute security tests, select and use the most appropriate tools and techniques to uncover even hidden security flaws, thereby providing essential practical skills that can be applied on the next working day.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Learn about Web vulnerabilities beyond OWASP Top Ten and how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Understand security testing approaches and methodologies
• Gain practical knowledge in using security testing techniques and tools
• Access sources and further readings on secure coding practices

Audience

Developers, Testers

Protecting web applications requires well-prepared security professionals who are continuously aware of current attack methods and trends. A variety of technologies and environments exist that facilitate the development of web applications. It is essential to be knowledgeable about both platform-specific security issues and general vulnerabilities that apply regardless of the development tools used.

This course provides an overview of applicable security solutions in web applications, with a special focus on understanding the most important cryptographic solutions to be applied. The various web application vulnerabilities are presented from both the server side (following the OWASP Top Ten) and the client side, demonstrated through relevant attacks. The course also covers recommended coding techniques and mitigation methods to avoid these issues. The subject of secure coding is concluded by discussing typical security-related programming mistakes in input validation, improper use of security features, and code quality.

Testing plays a crucial role in ensuring the security and robustness of web applications. Various approaches—from high-level auditing through penetration testing to ethical hacking—can be applied to identify different types of vulnerabilities. However, if you want to go beyond easily identifiable issues, security testing should be well planned and properly executed. It is important to remember that security testers should ideally find all bugs to protect a system, while adversaries need only find one exploitable vulnerability to penetrate it.

Practical exercises will help participants understand web application vulnerabilities, programming mistakes, and most importantly, the mitigation techniques. Hands-on trials of various testing tools—from security scanners through sniffers, proxy servers, fuzzing tools to static source code analyzers—will provide essential practical skills that can be applied immediately in the workplace for government.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond OWASP Top Ten and how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Have a practical understanding of cryptography
• Understand security testing approaches and methodologies
• Gain practical knowledge in using security testing techniques and tools
• Be informed about recent vulnerabilities in various platforms, frameworks, and libraries
• Receive sources and further readings on secure coding practices

Audience

Developers, Testers

The Internet of Things (IoT) offers significant benefits across various sectors, including industry, energy and utility companies, municipalities, healthcare, and consumer environments. It enables the collection of vast amounts of detailed data on a wide range of subjects, such as public health and safety, environmental conditions, industrial and agricultural production, and energy and utilities. Advanced data analysis tools have been developed to handle the massive volumes of data generated by IoT, facilitating timely and well-informed decision-making.

However, implementing IoT systems can be complex and challenging. These solutions often involve integrating devices and technologies from multiple vendors, requiring a thorough understanding of both software and hardware, as well as effective integration strategies. Additionally, there are significant risks associated with security, privacy, and the safety of individuals whose environments are managed by these systems.

IT professionals frequently lack experience with embedded systems, sensor networks, actuators, real-time systems, and other components common to IoT. This course provides a foundational understanding of how these components integrate with more familiar IT systems such as networks, cloud computing, and applications running on servers, desktop computers, and mobile devices, specifically for government use.

In this course, students will learn general strategies for planning, designing, developing, implementing, and maintaining an IoT system through various case studies and hands-on activities. They will assemble and configure an IoT device to function within a sensor network. The project involves creating an IoT device based on an ESP8266 microcontroller, incorporating common IoT features such as analog and digital sensors, a web-based interface, MQTT messaging, and data encryption.

Course Objectives: In this course, you will learn how to apply Internet of Things technologies to solve real-world problems. You will:

• Plan an IoT implementation.
• Construct and program an IoT device.
• Communicate with an IoT device using wired and wireless connections.
• Process sensor input and control an actuator on an IoT device.
• Manage security, privacy, and safety risks in IoT projects.
• Manage an IoT prototyping and development project throughout the development lifecycle.

Target Student: This course is designed for IT professionals with baseline skills in computer hardware, software support, and development who are interested in learning how to design, develop, implement, operate, and manage Internet of Things devices and related systems. The student is particularly interested in gaining knowledge about embedded systems, microcontroller programming, IoT security, and the development lifecycle for IoT projects.

While students will gain hands-on experience assembling a prototype IoT device and using software development tools, these activities are closely guided, so prior experience in electronics assembly and programming is not required. This course prepares students to take the CertNexus Certified Internet of Things (IoT) Practitioner (Exam ITP-110).

Artificial intelligence (AI) and machine learning (ML) have become integral components of the toolset for many organizations. When utilized effectively, these technologies provide actionable insights that drive critical decisions and enable the creation of innovative products and services. This course is designed to demonstrate how to apply various approaches and algorithms to solve business problems through AI and ML, follow a systematic workflow to develop robust solutions, use open-source tools to develop, test, and deploy those solutions, and ensure the protection of user privacy. The course includes hands-on activities for each topic area.

Course Objectives: In this course, you will implement AI techniques to address business problems. You will:

• Specify a general approach to solve a given business problem using applied AI and ML.
• Collect and refine a dataset to prepare it for training and testing.
• Train and tune a machine learning model.
• Finalize a machine learning model and present the results to the appropriate audience.
• Build linear regression models.
• Build classification models.
• Build clustering models.
• Build decision trees and random forests.
• Build support-vector machines (SVMs).
• Build artificial neural networks (ANNs).
• Promote data privacy and ethical practices within AI and ML projects.

Target Student: The skills covered in this course intersect three areas—software development, applied mathematics and statistics, and business analysis. This course is designed for students who may be strong in one or two of these areas and are looking to enhance their skills in the others, so they can apply artificial intelligence (AI) systems, particularly machine learning models, to business problems.

The target student may be a programmer seeking to develop additional skills to apply machine learning algorithms to business challenges, or a data analyst with strong skills in applying mathematics and statistics to business problems who is looking to enhance their technology skills related to machine learning. A typical student should have several years of experience with computing technology, including proficiency in computer programming. This course is also designed to assist students in preparing for the CertNexus® Certified Artificial Intelligence (AI) Practitioner (Exam AIP-110) certification.

Govtra's courses are tailored to meet the unique needs and standards required for government agencies, ensuring alignment with public sector workflows, governance, and accountability.

This course is tailored for practitioners aiming to develop a vendor-neutral, cross-industry skill set that will enable them to design, implement, operate, and manage a secure IoT ecosystem for government and other public sector applications.

Target Student: This course is designed for IoT professionals who are looking to enhance their skills and knowledge of IoT security and privacy. It is also suitable for students preparing for the CertNexus Certified Internet of Things Security Practitioner (CIoTSP) certification and seeking to prepare for Exam ITS-110.

Objectives:

In this course, you will identify many of the common risks associated with using conventional end-user technology and learn methods to use it safely, thereby protecting yourself from these risks.

You will:

• Identify security compliance measures for government.
• Address social engineering attempts effectively.
• Secure various devices such as desktops, laptops, tablets, smartphones, and more.
• Navigate the Internet securely to minimize potential threats.

Target Audience:

This course is designed for non-technical end users of computers, mobile devices, networks, and the Internet, enabling you to use technology more securely to reduce digital risks. This course is also tailored to prepare you for the Certified CyberSAFE credential. You can obtain your Certified CyberSAFE certificate by completing the certification process on the CHOICE platform following the course presentation.