SERVICES
APPLICATION SECURITY TRAINING
In order to produce secure software, Individuals in technical roles (developers, testers, and program managers) who are directly involved with the development of software programs must understand the risks involved with software development and have the proper training on how to prevent them, or mitigate them – if they arise.
Understanding software security threats is the foundation for building better software. By allowing individuals involved with the development of software programs to stay informed about security basics and latest trends in security and privacy, you’ll increase their commitment to writing more secure software.
Komodo’s application security training program covers topics such as:
-
Threat Modeling: Defining business objectives, user roles, data and use cases – identify threats that can compromise Confidentiality, Integrity and availability of the data.
-
Secure design principles, including: attack surface reduction, defense in depth, principle of least privilege, secure defaults etc.
-
Secure coding, including: buffer overruns mitigation, error handling, input validation, proper encoding techniques, cryptography etc.
-
Common attacks, including: introduction to OWASP top 10, SQL injections, cross site scripting, clickjacking etc.
-
Application Security Basics: a broad intro into the application security domain covering all of the above.
Custom training plans are also developed by our experts according to the relevant audience and your organizations need.
Syllabus
please fine below optional syllabuses of some of the courses we offer:
1. Introduction to Application Security (.NET/Java)
a. Terminology and Basics
i. CIA
ii. Threat agent/Vulnerability
iii. Layers of attacks
b. OWASP Top 10 Web Application Security Vulnerabilities (+ Demo)
i. A1-Injection
ii. A2-Cross Site Scripting (XSS)
iii. A3-Broken Authentication and Session Management
iv. A4-Insecure Direct Object References
v. A5-Cross Site Request Forgery (CSRF)
vi. A6-Security Misconfiguration
vii. A7-Insecure Cryptographic Storage
viii. A8-Failure to Restrict URL Access
ix. A9-Insufficient Transport Layer Protection
x. A10-Unvalidated Redirects and Forwards
c. How to Take Counter Measures?
i. Secure Coding Guidelines
ii. Examples
2. Introduction to Secure Cobol Development in zOS
a. Terminology and Basics
i. CIA
ii. Threat agent/Vulnerability
iii. Layers of attacks
b. Security Risks
i. Information Exposure
ii. System Corruption
c. General Mitigation
i. Input Validation
ii. Error Handling
iii. Reduction of Complexity
iv. Secure Coding Standards
d. COBOL Batch Security Risks
i. Log Forging
ii. Path Manipulation
iii. Information Leak
iv. Privacy Violations
v. Ignored Errors
vi. Insufficient Input Validation
vii. Inappropriate or Harmful Comments
viii. Obfuscated Code
ix. Weak Encryption
3. Introduction to Secured Mobile Development (iOS/Android)
a. Mobile Security Basics
b. Mobile Threat Modeling
c. Top 10 Mobile Security Risks
i. Insecure Data Storage
ii. Weak Server Side Controls
iii. Insufficient Transport Layer Protection
iv. Client Side Injection
v. Poor Authentication and Authorization
vi. Improper Session Handling
vii. Security Decisions Via Untrusted Inputs
viii. Side Channel Data Leakage
ix. Broken Cryptography
x. Sensitive Information Disclosure
d. Mobile Security Best Practices