Victoria - The Atrium

Suite 301, 1321 Blanshard Street/800 Yates Street, Victoria, Canada, V8W 0B6
The Atrium Center occupies a prominent and distinctive corner property in the main business district of downtown Victoria.

Découvrez nos formations

Application Security for Developers

21 heures
This course will help professionals understand the value and limits of Application Security. While the Application Security Principals provides valuable awareness around some of the major risks in applications today, this course will highlight both the good and not so good. This course is crucial because of the increasing need for developers to code in a secure manner. It is critical to introduce security as a quality component into the development cycle. This course aims at educating developers about various security vulnerabilities through hands-on practice using our purposely developed insecure web application.
En savoir plus...

Android Security

14 heures
Android is an open platform for mobile devices such as handsets and tablets. It has a large variety of security features to make developing secure software easier; however, it is also missing certain security aspects that are present in other hand-held platforms. The course gives a comprehensive overview of these features, and points out the most critical shortcomings to be aware of related to the underlying Linux, the file system and the environment in general, as well as regarding using permissions and other Android software development components. Typical security pitfalls and vulnerabilities are described both for native code and Java applications, along with recommendations and best practices to avoid and mitigate them. In many cases discussed issues are supported with real-life examples and case studies. Finally, we give a brief overview on how to use security testing tools to reveal any security relevant programming bugs. Participants attending this course will 
  • Understand basic concepts of security, IT security and secure coding
  • Learn the security solutions on Android
  • Learn to use various security features of the Android platform
  • Get information about some recent vulnerabilities in Java on Android
  • Learn about typical coding mistakes and how to avoid them
  • Get understanding on native code vulnerabilities on Android
  • Realize the severe consequences of unsecure buffer handling in native code
  • Understand the architectural protection techniques and their weaknesses
  • Get sources and further readings on secure coding practices
Audience Professionals
En savoir plus...

Comprehensive C# and .NET Application Security

21 heures
A number of programming languages are available today to compile code to .NET and ASP.NET frameworks. The environment provides powerful means for security development, but developers should know how to apply the architecture- and coding-level programming techniques in order to implement the desired security functionality and avoid vulnerabilities or limit their exploitation. The aim of this course is to teach developers through numerous hands-on exercises how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization, provide remote procedure calls, handle sessions, introduce different implementations for certain functionality, and many more. A special section is devoted to configuration and hardening of the .NET and ASP.NET environment for security. A brief introduction to the foundations of cryptography provides a common practical baseline for understanding the purpose and the operation of various algorithms, based on which the course presents the cryptographic features that can be used in .NET. This is followed by the introduction of some recent crypto vulnerabilities both related to certain crypto algorithms and cryptographic protocols, as well as side-channel attacks. Introduction of different vulnerabilities starts with presenting some typical programming problems committed when using .NET, including bug categories of input validation, error handling or race conditions. A special focus is given to XML security, while the topic of ASP.NET-specific vulnerabilities tackles some special issues and attack methods: like attacking the ViewState, or the string termination attacks. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn to use various security features of the .NET development environment
  • Have a practical understanding of cryptography
  • Understand some recent attacks against cryptosystems
  • Get information about some recent vulnerabilities in .NET and ASP.NET
  • Learn about typical coding mistakes and how to avoid them
  • Get practical knowledge in using security testing tools
  • Get sources and further readings on secure coding practices
Audience Developers
En savoir plus...

Network Security and Secure Communication

21 heures
La mise en œuvre d'une application sécurisée en réseau peut être difficile, même pour les développeurs qui peuvent avoir utilisé différents blocs de construction cryptographiques (tels que le cryptage et les signatures numériques) à l'avance. Afin que les participants comprennent le rôle et l’utilisation de ces primitives cryptographiques, un fondement solide sur les principales exigences de la communication sécurisée – la reconnaissance sécurisée, l’intégrité, la confidentialité, l’identification à distance et l’anonymat – est donné, tout en présentant les problèmes typiques qui peuvent endommager ces exigences ainsi que les solutions du monde réel. Comme un aspect critique de la sécurité réseau est la cryptographie, les algorithmes cryptographiques les plus importants dans la cryptographie symétrique, le hashing, la cryptographie asymétrique, et l'accord clé sont également discutés. Au lieu de présenter un fond mathématique en profondeur, ces éléments sont discutés du point de vue d'un développeur, montrant des exemples typiques de cas d'utilisation et des considérations pratiques liées à l'utilisation de crypto, telles que les infrastructures clés publiques. Des protocoles de sécurité sont introduits dans de nombreux domaines de la communication sécurisée, avec une discussion approfondie sur les familles de protocoles les plus largement utilisées telles que IPSEC et SSL/TLS. Les vulnérabilités cryptographiques typiques sont discutées à la fois liées à certains algorithmes cryptographiques et protocoles cryptographiques, tels que BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE et similaires, ainsi que l'attaque de timing RSA. Dans chaque cas, les considérations pratiques et les conséquences potentielles sont décrites pour chaque problème, à nouveau, sans aller dans les détails mathématiques profonds. Enfin, comme la technologie XML est centrale pour l'échange de données par des applications réseau, les aspects de sécurité de XML sont décrits. Cela inclut l'utilisation de XML dans les services Web et des messages SOAP avec des mesures de protection telles que XML signature et XML chiffrement – ainsi que des faiblesses dans ces mesures de protection et XML problèmes de sécurité spécifiques telles que XML injection, XML attaques d'entité extérieure (XXE), XML bombes, et XPath injection. Les participants à ce cours seront
  • Comprendre les concepts de base de la sécurité, de la sécurité informatique et du codage sécurisé
  • Comprendre les exigences de la communication sécurisée
  • Apprenez à propos des attaques réseau et des défenses dans les différentes couches OSI
  • Avoir une compréhension pratique de la cryptographie
  • Comprendre les protocoles de sécurité essentiels
  • Comprendre quelques attaques récentes contre les cryptosystèmes
  • Obtenez des informations sur certaines vulnérabilités récentes
  • Comprendre les concepts de sécurité des services Web
  • Obtenez des sources et des lectures supplémentaires sur les pratiques de codage sécurisé
Audience Développeurs, Professionnels
En savoir plus...

Combined C/C++, JAVA and Web Application Security

28 heures
To serve in the best way heterogeneous development groups that are using various platforms simultaneously during their everyday work, we have merged various topics into a combined course that presents diverse secure coding subjects in didactic manner on a single training event. This course combines C/C++ and Java platform security to provide an extensive, cross-platform secure coding expertise. Concerning C/C++, common security vulnerabilities are discussed, backed by practical exercises about the attacking methods that exploit these vulnerabilities, with the focus on the mitigation techniques that can be applied to prevent the occurrences of these dangerous bugs, detect them before market launch or prevent their exploitation. Security components and service of Java are discussed by presenting the different APIs and tools through a number of practical exercises where participants can gain hands-on experience in using them. The course also covers security issues of web services and the related Java services that can be applied to prevent the most aching threats of the Internet based services. Finally, web- and Java-related security vulnerabilities are demonstrated by easy-to-understand exercises, which not only show the root cause of the problems, but also demonstrate the attack methods along with the recommended mitigation and coding techniques in order to avoid the associated security problems. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Learn to use various security features of the Java development environment
  • Have a practical understanding of cryptography
  • Realize the severe consequences of unsecure buffer handling
  • Understand the architectural protection techniques and their weaknesses
  • Learn about typical coding mistakes and how to avoid them
  • Be informed about recent vulnerabilities in various platforms, frameworks and libraries
  • Get sources and further readings on secure coding practices
Audience Developers
En savoir plus...

Application Security in the Cloud

21 heures
La migration vers le cloud apporte des avantages immense pour les entreprises et les individus en termes d’efficacité et de coûts. En ce qui concerne la sécurité, les effets sont assez divers, mais c'est une perception commune que l'utilisation des services cloud affecte la sécurité d'une manière positive. Les opinions, cependant, diffèrent de nombreuses fois même sur la définition de qui est responsable de garantir la sécurité des ressources cloud. En couvrant IaaS, PaaS et SaaS, on discute d’abord la sécurité de l’infrastructure : les problèmes de rigueur et de configuration ainsi que diverses solutions pour l’authentification et l’autorisation, ainsi que la gestion de l’identité qui devrait être au cœur de toute architecture de sécurité. Ceci est suivi par certaines bases concernant les questions juridiques et contractuelles, à savoir comment la confiance est établie et gérée dans le cloud. Le voyage à travers la sécurité dans le cloud se poursuit avec la compréhension des menaces spécifiques au cloud et des objectifs et des motivations des attaquants ainsi que des mesures d’attaque typiques prises contre les solutions dans le cloud. Une attention particulière est également accordée à l’audit du cloud et à la fourniture d’une évaluation de la sécurité des solutions cloud à tous les niveaux, y compris les tests de pénétration et l’analyse des vulnérabilités. Le cours se concentre sur les questions de sécurité des applications, traitant la sécurité des données et la sécurité des applications elles-mêmes. Du point de vue de la sécurité des applications, la sécurité cloud computing n’est pas substantiellement différente de la sécurité logicielle générale, et par conséquent, essentiellement toutes les vulnérabilités enregistrées OWASP sont pertinentes dans ce domaine aussi. C'est le ensemble de menaces et de risques qui font la différence, et donc la formation est terminée par l'enregistrement de différents vecteurs d'attaque spécifiques au cloud liés aux faiblesses discutées à l'avance. Les participants à ce cours seront
  • Comprendre les concepts de base de la sécurité, de la sécurité informatique et du codage sécurisé
  • Comprendre les menaces et risques majeurs dans le domaine cloud
  • Découvrez les solutions de sécurité cloud élémentaires
  • Obtenez des informations sur la confiance et la gouvernance sur le cloud
  • Avoir une compréhension pratique de la cryptographie
  • Obtenez une connaissance approfondie de la sécurité des applications dans le cloud
  • Apprenez les vulnérabilités Web au-delà OWASP Top 10 et sachez comment les éviter
  • Comprendre les défis de l'audit et de l'évaluation des systèmes cloud pour la sécurité
  • Apprenez à sécuriser l'environnement et l'infrastructure cloud
  • Obtenez des sources et des lectures supplémentaires sur les pratiques de codage sécurisé
Audience Développeurs, gestionnaires, professionnels
En savoir plus...

C/C++ Secure Coding

21 heures
This three day course covers the basics of securing the C/C++ code against the malicious users who may exploit many vulnerabilities in the code with memory management and input handling, the course cover the principals of writing secure code.
En savoir plus...

Advanced Java Security

21 heures
Even experienced Java programmers are not mastering by all means the various security services offered by Java, and are likewise not aware of the different vulnerabilities that are relevant for web applications written in Java. The course – besides introducing security components of Standard Java Edition – deals with security issues of Java Enterprise Edition (JEE) and web services. Discussion of specific services is preceded with the foundations of cryptography and secure communication. Various exercises deal with declarative and programmatic security techniques in JEE, while both transport-layer and end-to-end security of web services is discussed. The use of all components is presented through several practical exercises, where participants can try out the discussed APIs and tools for themselves. The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform and web-related vulnerabilities. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Understand security concepts of Web services
  • Learn to use various security features of the Java development environment
  • Have a practical understanding of cryptography
  • Understand security solutions of Java EE
  • Learn about typical coding mistakes and how to avoid them
  • Get information about some recent vulnerabilities in the Java framework
  • Get practical knowledge in using security testing tools
  • Get sources and further readings on secure coding practices
Audience Developers
En savoir plus...

Combined JAVA, PHP and Web Application Security

28 heures
Même les programmateurs expérimentés ne maîtrisent pas par tous les moyens les différents services de sécurité proposés par leurs plateformes de développement, et ne sont pas également conscients des différentes vulnérabilités qui sont pertinentes pour leur développement. Ce cours vise les développeurs à utiliser les deux Java et PHP, leur fournissant les compétences essentielles nécessaires pour rendre leurs applications résistantes aux attaques contemporaines via Internet. Les niveaux de l'architecture de la sécurité Java sont traversés en traitant le contrôle d'accès, l'authentification et l'autorisation, la communication sécurisée et diverses fonctions cryptographiques. Divers APIs sont également introduits qui peuvent être utilisés pour sécuriser votre code dans PHP, comme OpenSSL pour la cryptographie ou HTML Purifier pour la validation d'entrée. Sur le côté du serveur, les meilleures pratiques sont données pour l'affaiblissement et la configuration du système d'exploitation, du conteneur web, du système de fichiers, du SQL serveur et le PHP lui-même, tandis qu'une attention particulière est accordée à la sécurité client-side à travers les problèmes de sécurité de JavaScript, Ajax et HTML5. Les vulnérabilités Web générales sont discutées par des exemples alignés à OWASP Top Ten, montrant diverses attaques d'injection, injections de scripts, attaques contre la gestion de session, références d'objets directs non sécurisées, problèmes avec les téléchargements de fichiers, et bien d'autres. Les différents problèmes linguistiques Java et PHP spécifiques et problèmes résultant de l'environnement de travail sont introduits groupés dans les types de vulnérabilité standard de validation d'entrée manquante ou inappropriée, utilisation inappropriée des fonctionnalités de sécurité, traitement incorrect d'erreurs et d'exceptions, problèmes liés au temps et à l'état, problèmes de qualité du code et vulnérabilités liées au code mobile. Les participants peuvent essayer les API discutés, les outils et les effets des configurations pour eux-mêmes, tandis que l'introduction des vulnérabilités sont tous soutenus par un certain nombre d'exercices pratiques démontrant les conséquences d'attaques réussies, montrant comment corriger les erreurs et appliquer les techniques d'atténuation, et introduire l'utilisation de diverses extensions et outils. Les participants à ce cours seront
  • Comprendre les concepts de base de la sécurité, de la sécurité informatique et du codage sécurisé
  • Apprenez les vulnérabilités Web au-delà OWASP Top 10 et sachez comment les éviter
  • Apprendre les vulnérabilités du côté client et les pratiques de codage sécurisées
  • Apprenez à utiliser différentes fonctionnalités de sécurité de l'environnement de développement Java
  • Avoir une compréhension pratique de la cryptographie
  • Apprenez à utiliser différentes fonctionnalités de sécurité PHP
  • Comprendre les concepts de sécurité des services Web
  • Obtenez des connaissances pratiques en utilisant les outils de test de sécurité
  • Apprenez sur les erreurs de codage typiques et comment les éviter
  • Soyez informé des vulnérabilités récentes dans les cadres et les bibliothèques Java et PHP
  • Obtenez des sources et des lectures supplémentaires sur les pratiques de codage sécurisé
Audience Développeurs
En savoir plus...

Standard Java Security

14 heures
Description The Java language and the Runtime Environment (JRE) was designed to be free from the most problematic common security vulnerabilities experienced in other languages, like C/C++. Yet, software developers and architects should not only know how to use the various security features of the Java environment (positive security), but should also be aware of the numerous vulnerabilities that are still relevant for Java development (negative security). The introduction of security services is preceded with a brief overview of the foundations of cryptography, providing a common baseline for understanding the purpose and the operation of the applicable components. The use of these components is presented through several practical exercises, where participants can try out the discussed APIs for themselves. The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform, covering both the typical bugs committed by Java programmers and the language- and environment-specific issues. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn to use various security features of the Java development environment
  • Have a practical understanding of cryptography
  • Learn about typical coding mistakes and how to avoid them
  • Get information about some recent vulnerabilities in the Java framework
  • Get sources and further readings on secure coding practices
Audience Developers
En savoir plus...

Java and Web Application Security

21 heures
Description Beyond solid knowledge in using Java components, even for experienced Java programmers it is essential to have a deep knowledge in web-related vulnerabilities both on server and client side, the different vulnerabilities that are relevant for web applications written in Java, and the consequences of the various risks. General web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained in the context of Java with the most important aim to avoid the associated problems. In addition, a special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5. The course introduces security components of Standard Java Edition, which is preceded with the foundations of cryptography, providing a common baseline for understanding the purpose and the operation of the applicable components. The use of all components is presented through practical exercises, where participants can try out the discussed APIs and tools for themselves. Finally, the course explains the most frequent and severe programming flaws of the Java language and platform. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Learn to use various security features of the Java development environment
  • Have a practical understanding of cryptography
  • Learn about typical coding mistakes and how to avoid them
  • Get information about some recent vulnerabilities in the Java framework
  • Get practical knowledge in using security testing tools
  • Get sources and further readings on secure coding practices
Audience Developers
En savoir plus...

Advanced Java, JEE and Web Application Security

28 heures
Beyond solid knowledge in using Java components, even for experienced Java programmers it is essential to have a deep knowledge in web-related vulnerabilities both on server and client side, the different vulnerabilities that are relevant for web applications written in Java, and the consequences of the various risks. General web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained in the context of Java with the most important aim to avoid the associated problems. In addition, a special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5. The course introduces security components of Standard Java Edition, which is preceded with the foundations of cryptography, providing a common baseline for understanding the purpose and the operation of the applicable components. Security issues of Java Enterprise Edition are presented through various exercises explaining both declarative and programmatic security techniques in JEE. Finally, the course explains the most frequent and severe programming flaws of the Java language and platform. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Learn to use various security features of the Java development environment
  • Have a practical understanding of cryptography
  • Understand security concepts of Web services
  • Understand security solutions of Java EE
  • Learn about typical coding mistakes and how to avoid them
  • Get information about some recent vulnerabilities in the Java framework
  • Get practical knowledge in using security testing tools
  • Get sources and further readings on secure coding practices
Audience Developers
En savoir plus...

Node.JS and Web Application Security

21 heures
As a developer, your duty is to write bulletproof code. What if we told you that despite all of your efforts, the code you have been writing your entire career is full of weaknesses you never knew existed? What if, as you are reading this, hackers were trying to break into your code? How likely would they be to succeed? What if they could steal away your database and sell it on the black market? This Web application security course will change the way you look at code. A hands-on training during which we will teach you all the attackers’ tricks and how to mitigate them, leaving you with no other feeling than the desire to know more. It is your choice to be ahead of the pack, and be seen as a game changer in the fight against cybercrime. Delegates attending will:
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Learn about Node.js security
  • Learn about MongoDB security
  • Have a practical understanding of cryptography
  • Understand essential security protocols
  • Understand security concepts of Web services
  • Learn about JSON security
  • Get practical knowledge in using security testing techniques and tools
  • Learn how to handle vulnerabilities in the used platforms, frameworks and libraries
  • Get sources and further readings on secure coding practices
En savoir plus...

.NET, C# and ASP.NET Security Development

14 heures
A number of programming languages are available today to compile code to .NET and ASP.NET frameworks. The environment provides powerful means for security development, but developers should know how to apply the architecture- and coding-level programming techniques in order to implement the desired security functionality and avoid vulnerabilities or limit their exploitation. The aim of this course is to teach developers through numerous hands-on exercises how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization, provide remote procedure calls, handle sessions, introduce different implementations for certain functionality, and many more. Introduction of different vulnerabilities starts with presenting some typical programming problems committed when using .NET, while the discussion of vulnerabilities of the ASP.NET also deals with various environment settings and their effects. Finally, the topic of ASP.NET-specific vulnerabilities not only deals with some general web application security challenges, but also with special issues and attack methods like attacking the ViewState, or the string termination attacks. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn to use various security features of the .NET development environment
  • Get practical knowledge in using security testing tools
  • Learn about typical coding mistakes and how to avoid them
  • Get information about some recent vulnerabilities in .NET and ASP.NET
  • Get sources and further readings on secure coding practices
Audience Developers
En savoir plus...

Advanced C#, ASP.NET and Web Application Security

21 heures
Beyond solid knowledge in using various security features of .NET and ASP.NET, even for experienced programmers it is essential to have a deep knowledge in web-related vulnerabilities both on server and client side along with the consequences of the various risks. In this course the general web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained in the context of ASP.NET. A special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5. The course also deals with the security architecture and components of the .NET framework, including code- and role based access control, permission declaration and checking mechanisms and the transparency model. A brief introduction to the foundations of cryptography provides a common practical baseline for understanding the purpose and the operation of various algorithms, based on which the course presents the cryptographic features that can be used in .NET. Introduction of different security bugs follows the well-established vulnerability categories, tackling input validation, security features, error handling, time- and state-related problems, the group of general code quality issues, and a special section on ASP.NET-specific vulnerabilities. These topics are concluded with an overview on testing tools that can be used to automatically reveal some of the learnt bugs. Topics are presented through practical exercises where participants can try out the consequences of certain vulnerabilities, the mitigations, as well as the discussed APIs and tools for themselves. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Learn to use various security features of the .NET development environment
  • Have a practical understanding of cryptography
  • Get information about some recent vulnerabilities in .NET and ASP.NET
  • Get practical knowledge in using security testing tools
  • Learn about typical coding mistakes and how to avoid them
  • Get sources and further readings on secure coding practices
Audience Developers
En savoir plus...

The Secure Coding Landscape

14 heures
Le cours introduit certains concepts de sécurité communs, donne une vue d'ensemble de la nature des vulnérabilités indépendamment des langues et des plateformes de programmation utilisées, et explique comment gérer les risques qui s'appliquent en ce qui concerne la sécurité logicielle dans les différentes phases du cycle de vie du développement logiciel. Sans aller profondément dans les détails techniques, il souligne certaines des vulnérabilités les plus intéressantes et les plus remarquables dans les différentes technologies de développement de logiciels, et présente les défis des tests de sécurité, ainsi que certaines techniques et outils que l'on peut appliquer pour trouver des problèmes existants dans leur code. Les participants qui participent à ce cours 
  • Comprendre les concepts de base de la sécurité, de la sécurité informatique et du codage sécurisé
  • Comprendre les vulnérabilités Web sur le côté du serveur et du client
  • Réalisez les conséquences graves de l’insécurité de la manipulation de buffer
  • Soyez informé de certaines vulnérabilités récentes dans les environnements et les cadres de développement
  • Apprenez sur les erreurs de codage typiques et comment les éviter
  • Comprendre les approches et les méthodologies de test de sécurité
Audience gestionnaires
En savoir plus...

Secure coding in PHP

21 heures
The course provides essential skills for PHP developers necessary to make their applications resistant to contemporary attacks through the Internet. Web vulnerabilities are discussed through PHP-based examples going beyond the OWASP top ten, tackling various injection attacks, script injections, attacks against session handling of PHP, insecure direct object references, issues with file upload, and many others. PHP-related vulnerabilities are introduced grouped into the standard vulnerability types of missing or improper input validation, incorrect error and exception handling, improper use of security features and time- and state-related problems. For this latter we discuss attacks like the open_basedir circumvention, denial-of-service through magic float or the hash table collision attack. In all cases participants will get familiar with the most important techniques and functions to be used to mitigate the enlisted risks. A special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5. A number of security-related extensions to PHP are introduced like hash, mcrypt and OpenSSL for cryptography, or Ctype, ext/filter and HTML Purifier for input validation. The best hardening practices are given in connection with PHP configuration (setting php.ini), Apache and the server in general. Finally, an overview is given to various security testing tools and techniques which developers and testers can use, including security scanners, penetration testing and exploit packs, sniffers, proxy servers, fuzzing tools and static source code analyzers. Both the introduction of vulnerabilities and the configuration practices are supported by a number of hands-on exercises demonstrating the consequences of successful attacks, showing how to apply mitigation techniques and introducing the use of various extensions and tools. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Have a practical understanding of cryptography
  • Learn to use various security features of PHP
  • Learn about typical coding mistakes and how to avoid them
  • Be informed about recent vulnerabilities of the PHP framework
  • Get practical knowledge in using security testing tools
  • Get sources and further readings on secure coding practices
Audience Developers
En savoir plus...

Microsoft SDL Core

14 heures
The Combined SDL core training gives an insight into secure software design, development and testing through Microsoft Secure Development Lifecycle (SDL). It provides a level 100 overview of the fundamental building blocks of SDL, followed by design techniques to apply to detect and fix flaws in early stages of the development process. Dealing with the development phase, the course gives an overview of the typical security relevant programming bugs of both managed and native code. Attack methods are presented for the discussed vulnerabilities along with the associated mitigation techniques, all explained through a number of hands-on exercises providing live hacking fun for the participants. Introduction of different security testing methods is followed by demonstrating the effectiveness of various testing tools. Participants can understand the operation of these tools through a number of practical exercises by applying the tools to the already discussed vulnerable code. Participants attending this course will 
  • Understand basic concepts of security, IT security and secure coding
  • Get known to the essential steps of Microsoft Secure Development Lifecycle
  • Learn secure design and development practices
  • Learn about secure implementation principles
  • Understand security testing methodology
  • Get sources and further readings on secure coding practices
Audience Developers, Managers
En savoir plus...

Security Testing

14 heures
After getting familiar with the vulnerabilities and the attack methods, participants learn about the general approach and the methodology for security testing, and the techniques that can be applied to reveal specific vulnerabilities. Security testing should start with information gathering about the system (ToC, i.e. Target of Evaluation), then a thorough threat modeling should reveal and rate all threats, arriving to the most appropriate risk analysis-driven test plan. Security evaluations can happen at various steps of the SDLC, and so we discuss design review, code review, reconnaissance and information gathering about the system, testing the implementation and the testing and hardening the environment for secure deployment. Many security testing techniques are introduced in details, like taint analysis and heuristics-based code review, static code analysis, dynamic web vulnerability testing or fuzzing. Various types of tools are introduced that can be applied in order to automate security evaluation of software products, which is also supported by a number of exercises, where we execute these tools to analyze the already discussed vulnerable code. Many real life case studies support better understanding of various vulnerabilities. This course prepares testers and QA staff to adequately plan and precisely execute security tests, select and use the most appropriate tools and techniques to find even hidden security flaws, and thus gives essential practical skills that can be applied on the next day working day. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Understand security testing approaches and methodologies
  • Get practical knowledge in using security testing techniques and tools
  • Get sources and further readings on secure coding practices
Audience Developers, Testers
En savoir plus...

Secure Web Application Development and Testing

21 heures
Protecting applications that are accessible via the web requires well-prepared security professional who are at all time aware of current attack methods and trends. Plethora of technologies and environments exist that allow comfortable development of web applications. One should not only be aware of the security issues relevant to these platforms, but also of all general vulnerabilities that apply regardless of the used development tools. The course gives an overview of the applicable security solutions in web applications, with a special focus on understanding the most important cryptographic solutions to be applied. The various web application vulnerabilities are presented both on the server side (following the OWASP Top Ten) and the client side, demonstrated through the relevant attacks, and followed by the recommended coding techniques and mitigation methods to avoid the associated problems. The subject of secure coding is wrapped up by discussing some typical security-relevant programming mistakes in the domain of input validation, improper use of security features and code quality. Testing plays a very important role in ensuring security and robustness of web applications. Various approaches – from high level auditing through penetration testing to ethical hacking – can be applied to find vulnerabilities of different types. However, if you want to go beyond the easy-to-find low-hanging fruits, security testing should be well planned and properly executed. Remember: security testers should ideally find all bugs to protect a system, while for adversaries it is enough to find one exploitable vulnerability to penetrate into it. Practical exercises will help understanding web application vulnerabilities, programming mistakes and most importantly the mitigation techniques, together with hands-on trials of various testing tools from security scanners, through sniffers, proxy servers, fuzzing tools to static source code analyzers, this course gives the essential practical skills that can be applied on the next day at the workplace. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Have a practical understanding of cryptography
  • Understand security testing approaches and methodologies
  • Get practical knowledge in using security testing techniques and tools
  • Be informed about recent vulnerabilities in various platforms, frameworks and libraries
  • Get sources and further readings on secure coding practices
Audience Developers, Testers
En savoir plus...

Web Application Security

14 heures
Protecting applications that are accessible via the web requires well-prepared security professional who are at all time aware of current attack methods and trends. Plethora of technologies and environments exist that allow comfortable development of web applications (like Java, ASP.NET or PHP, as well as Javascript or Ajax on the client side). One should not only be aware of the security issues relevant to these platforms, but also of all general vulnerabilities that apply regardless of the used development tools. The course gives an overview of the applicable security solutions in web applications, focusing on the most important technologies like secure communication and web services, tackling both transport-layer security and end-to-end security solutions and standards like Web Services Security and XML. It also gives a brief overview of the typical programming mistakes, above all connected to missing or improper input validation. The web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained to avoid the associated problems. Exercises can be easily followed by programmers using different programming languages, thus the web application-related topics can be easily combined with other secure coding subjects, and can thus effectively satisfy the needs of corporate development groups, who typically deal with various languages and development platforms to develop web applications. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Have a practical understanding of cryptography
  • Understand security concepts of Web services
  • Get practical knowledge in using security testing tools
  • Get sources and further readings on secure coding practices
Audience Developers
En savoir plus...

DevOps Security: Creating a DevOps Security Strategy

7 heures
Dans ce cours en direct, dirigé par un instructeur, les participants apprendront à formuler la stratégie de sécurité appropriée pour relever le défi de la sécurité DevOps.
En savoir plus...

Sécurité des Systèmes Embarqués

21 heures
Cette formation en direct, dirigée par un instructeur, présente les architectures de systèmes, les systèmes d'exploitation, les réseaux, le stockage et les questions cryptographiques qui doivent être pris en compte lors de la conception de systèmes embarqués sécurisés. À la fin de ce cours, les participants auront une solide compréhension des principes, des préoccupations et des technologies en matière de sécurité. Plus important encore, les participants seront équipés des techniques nécessaires pour développer des logiciels embarqués sûrs et sécurisés.
En savoir plus...

Interactive Application Security Testing (IAST)

14 heures
Interactive Application Security Testing (IAST) est une forme de test de sécurité d'application qui combine les techniques de test de sécurité d'application statique (SAST) et de test de sécurité d'application dynamique (DAST) ou de auto-protection d'application à temps plein (RASP). IAST est en mesure de signaler les lignes spécifiques de code responsables d'une exploitation de sécurité et de reproduire les comportements qui conduisent et suivent une telle exploitation. Dans cette formation guidée par l'instructeur, les participants apprendront comment sécuriser une application en instrumentant des agents d'exercice et des inducteurs d'attaque pour simuler le comportement de l'application pendant une attaque.   ; À la fin de cette formation, les participants seront en mesure de :
  • Simuler les attaques contre les applications et valider leurs capacités de détection et de protection
  • Utilisez RASP et DAST pour obtenir la visibilité au niveau du code dans la voie de données prise par une application dans différents scénarios de fonctionnement
  • Correction rapide et précise du code d'application responsable des vulnérabilités détectées
  • Prioriser les résultats de vulnérabilité à partir de scans dynamiques
  • Utilisez les alertes RASP en temps réel pour protéger les applications dans la production contre les attaques.
  • Réduire les risques de vulnérabilité des applications tout en respectant les objectifs du calendrier de production
  • Développer une stratégie intégrée pour la détection et la protection globale des vulnérabilités
Audience
  • [ 0 ] Ingénieurs
  • Ingénieurs de sécurité
  • Développeurs
Format du cours
  • Lecture partielle, discussion partielle, exercices et pratiques lourdes
En savoir plus...

Comment écrire un Code Sécurisé

35 heures
After the major attacks against national infrastructures, Security Professionals found that the majority of the vulnerabilities that caused the attacks came from poor and vulnerable code that the developers write.  Developers now need to master the techniques of how to write Secure Code, because we are in a situation where anyone can use availble tools to write a script that can effectivly disable a large organization's systems because the developers have written poor code. This Course aims to help in the following:
  1. Help Developers to master the techniques of writing Secure Code
  2. Help Software Testers to test the security of the application before publishing to the production environment
  3. Help Software Architects to understand the risks surrounding the applications
  4. Help Team Leaders to set the security base lines for the developers
  5. Help Web Masters to configure the Servers to avoid miss-configurations
In this course you will also see details of the latest cyber attacks that have been used and the countermeasures used to stop and prevent these attacks. You will see for yourself how developers mistakes led to catastrophic attacks, and by participatig in the labs during the course you will be able to put into practise the security controls and gain the experience and knowledge to produce secure coding. Who should Attend this Course?  This Secure Code Training is ideal for those working in positions such as, but not limited to:
  • Web Developers
  • Mobile Developers
  • Java Developers
  • Dot Net Developers
  • Software Architects
  • Software Tester
  • Security Professionals
  • Web Masters
En savoir plus...

Secure Developer Java (Inc OWASP)

21 heures
This course covers the secure coding concepts and principals with Java through Open Web Application Security Project (OWASP) methodology of testing. The Open Web Application Security Project is an online community which creates freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security.
En savoir plus...

Secure Developer .NET (Inc OWASP)

21 heures
This course covers the secure coding concepts and principals with ASP.net through the Open Web Application Security Project (OWASP) methodology of testing , OWASP is an online community which creates freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security.  This Course explores the Dot Net Framework Security features and how to secure web applications.   
    
    
    
    
    
En savoir plus...

Last Updated:

Nos Clients témoignent (34)

Beaucoup d'informations très bien expliquées, des exemples, des exercices intéressants. Le formateur nous a montré son expérience du monde réel.

Gergely Bathó - GE Medical Systems Polska Sp. Z O.O.
Formation - Application Security for Developers

Traduction automatique

The Burpe suite i need more training in this

Gontse Ntshegi - Vodacom
Formation - Android Security

Nothing it was perfect.

Zola Madolo - Vodacom
Formation - Android Security

Azure web security, c'était plus que ce à quoi je m'attendais, les tests de pénétration que je ne ferais jamais dans mon travail.

Toby
Formation - Application Security in the Cloud

Traduction automatique

l'équilibre entre les cours et la pratique, le rythme, les connaissances et les compétences pédagogiques du formateur

Armando Pinto - EID
Formation - C/C++ Secure Coding

Traduction automatique

Le formateur a fourni des informations actualisées ainsi que des références et des outils précieux.

Jose Vicente - EID
Formation - C/C++ Secure Coding

Traduction automatique

d'obtenir beaucoup de bonnes informations sur le sujet du cours

Paulo Pereira - EID
Formation - C/C++ Secure Coding

Traduction automatique

L'entraîneur possède de solides connaissances et de l'expérience, de belles diapositives, de bons exemples.

Celso Almeida - EID
Formation - C/C++ Secure Coding

Traduction automatique

Les changements sont apportés à la volée, car le troisième jour, je commençais déjà à être plus perdue qu'avant et il était plus difficile de rattraper rapidement une erreur.

Paulina
Formation - Advanced Java Security

Traduction automatique

It opens up a lot and gives lots of insight what security

Nolbabalo Tshotsho - Vodacom SA
Formation - Advanced Java Security

Very good knowledge and character.

Constantinos Michael
Formation - Java and Web Application Security

The organization

Panagiotis Foutros
Formation - Java and Web Application Security

Il est très utile de comprendre comment un pirate informatique pourrait analyser les sites pour en déceler les faiblesses et les outils qu'il pourrait utiliser.

Roger - OTT Mobile
Formation - .NET, C# and ASP.NET Security Development

Traduction automatique

the corny jokes. Love the first 2 day session because of the labs.

Kevin Galacgac - Human Edge Software Philippines, Inc.
Formation - .NET, C# and ASP.NET Security Development

The trainer is really connecting with us and making sure that nobody left out of the current topic. Explains well to each topic and provides an example that is easy to understand.

Edgarico Llaneta - Human Edge Software Philippines, Inc.
Formation - .NET, C# and ASP.NET Security Development

The hands-on training and the examples.

Lord-Sam Lamparero - Human Edge Software Philippines, Inc.
Formation - .NET, C# and ASP.NET Security Development

The exercises (SQL injection, XSS, CRSF...)

David Lemoine - Statistical Solutions
Formation - .NET, C# and ASP.NET Security Development

Beginning by how to hack to better understand how to secure was very interesting and appreciated.

Raphaël Capocasale - Mikron SA Boudry
Formation - Advanced C#, ASP.NET and Web Application Security

The explanations of how the most common attacks happen against web applications.

Jacob Fisher - Mikron SA Boudry
Formation - Advanced C#, ASP.NET and Web Application Security

The learning material

morena xaba - Vodacom
Formation - The Secure Coding Landscape

The real life examples.

Marios Prokopiou
Formation - Secure coding in PHP

All topics were well covered and presented with a lot of examples. Ahmed was very efficient and managed to keep us focused and attracted at all times.

Kostas Bastas
Formation - Secure coding in PHP

Trainer willing to answer questions and give bunch of examples for us to learn.

Eldrick Ricamara - Human Edge Software Philippines, Inc. (part of Tribal Group)
Formation - Security Testing

Apprendre à utiliser de nouveaux outils. Voir surtout comment les tests de sécurité peuvent être effectués

Jason - Kropman
Formation - Secure Web Application Development and Testing

Traduction automatique

El profesor explica muy bien, tiene un buen conocimiento, ayuda a que siempre de ejemplos de lo que esta explicando para entender mas facil, va a un ritmo bien.

Yamir Aguilar - ATEB Servicios
Formation - Secure Web Application Development and Testing

I liked he was passionate about the subject and very convincing too.

Diana Vladulescu
Formation - Secure Web Application Development and Testing

Web 的同源策略和跨域的内容，以及XSS 的危害，這個很貼切我們的工作。

Princess Ou - 广东溢达纺织有限公司
Formation - Web Application Security

Overview of most among important topics related to software architecture. This training inspired me to learn some of them in depth ;)

Konrad Fuchsig - EY GDS
Formation - Web Application Security

Explanation of the concepts I had no knowledge about. Tutors calm and kind attitude and also his very vast knowledge.

Michał Kowalczyk - EY GDS
Formation - Web Application Security

Practical examples and possibility to try how web injections are functioning from the other side - not user but attacker side.

Jessica Wierzbicka - EY GDS
Formation - Web Application Security

The hands-on labs were excellent.

Dr. Farhan Hassan Khan - TDM GROUP
Formation - Web Application Security

Les laboratoires pratiquent

Angel - Vodacom
Formation - How to Write Secure Code

Traduction automatique

voir les menaces à la sécurité en action

kesh - Vodacom
Formation - How to Write Secure Code

Traduction automatique

Le fait d'avoir une session individuelle avec Raymond a été extraordinaire. Il était vraiment génial et attentif à tous mes besoins en matière de formation.

Joshua
Formation - Secure Developer .NET (Inc OWASP)

Traduction automatique

Upcoming Courses

Autres régions en Canada

Autres pays

Ces formations sont également disponibles dans d'autres pays

Conseil

Secure Code Conseil
Secure Code formation à Victoria, Weekend Secure Code cours à Victoria, Soir Secure Code formation à Victoria, Secure Code formateur en ligne à Victoria, Secure Code formation à Victoria, Secure Code cours du soir à Victoria, Secure Code formation Intra à Victoria, Secure Code formation Intra Entreprise à Victoria, Secure Code formation Inter à Victoria, Secure Code formation Inter Entreprise à Victoria, Secure Code préparation à Victoria, Soir Secure Code cours à Victoria, Secure Code instructeur à Victoria, Weekend Secure Code formation à Victoria, Secure Code préparation aux examens à Victoria, Secure Code sur place à Victoria, Secure Code formateur à Victoria, Secure Code coaching à Victoria, Secure Code cours particuliers à Victoria, Secure Code entraînement à Victoria, Secure Code stage de préparation à Victoria, Secure Code professeur à Victoria,Secure Code cours à Victoria, Secure Code cours privé à Victoria, Secure Code coach à Victoria
1