What Does A Typical Secure Development Course Look Like?

EDGENETIC will generally spend two days delivering a hands-on course that clearly demonstrates common pitfalls that result in insecure code. The course is typically modified to suit the specific requirements of the organisation receiving the training. For example, the programming languages used as examples and the vulnerabilities focused on will vary. The following is an example where web application development and impact demonstrations were the primary concerns. Contact us to receive a syllabus unique to your requirements.

2.1 Introduction

a. Trainer introduction
b. Course introduction
c. Objectives
d. Current threat landscape
e. Recent breaches and their implications (GDPR)

2.2 Information Security Fundamentals

a. Confidentiality
b. Integrity
c. Availability
d. Why use the CIA model?

2.3 Information Security Data States

a. Data at rest
b. Data in use
c. Data in transit
d. Secure communications
e. Access controls
f. Secure storage
g. Hashing and password storage

2.4 Understanding Risk

a. Asset value
b. Threat consideration
c. Vulnerability assessment
d. Risk calculation
e. Risk mitigation

2.5 Trust Relationships

a. Principle of least privilege
b. Data sharing between components
c. Secure handling of data and user input

2.6 OWASP Top 10 Vulnerabilities

Analysis of each of the following type of vulnerability with
hands on exploitation and discussion around remediation:
a. A1 : Injection
b. A2 : Broken Authentication
c. A3 : Sensitive Data Exposure
d. A4 : XML External Entities (XXE)
e. A5 : Broken Access Control
f. A6 : Security Misconfiguration
g. A7 : Cross-Site Scripting (XSS)
h. A8 : Insecure Deserialisation
i. A9 : Using Components with Known Vulnerabilities
j. A10 : Insufficient Logging & Monitoring

2.7 Being Proactive About Security

a. How to research about security issues
b. Threat modelling techniques
c. Test plans
d. OWASP Application Security Verification Standard
and how this can be used during development
and Quality Assurance.

2.8 OWASP Top 10 Proactive Controls

a. Define Security Requirements
b. Leverage Security Frameworks and Libraries
c. Secure Database Access
d. Encode and Escape Data
e. Validate All Inputs
f. Implement Digital Identity
g. Enforce Access Controls
h. Protect Data Everywhere
i. Implement Security Logging and Monitoring
j. Handle All Errors and Exceptions

2.9 Resources for Developers

a. OWASP Code Review Guide
b. S-SDLC

Get a free quote

EDGENETIC uses only those security consultants who have experience as both developers and as security professionals to deliver secure development training.

How Will The Training Be Delivered?

EDGENETIC understands that ‘death by PowerPoint‘ is neither an engaging or useful means of knowledge transfer. There is real power in allowing students to arrive at their own “aha!” moment and so that is how the training is designed to be delivered.
The training is very practical in nature; developers will be taught the art of offense as well as defense in order to help cement the impact of insecure coding practices in their minds. Often, the training takes on a competitive nature too – indeed, the course ends with a friendly competition that pits the developers against each other.
Although each course is tailored to suit the requirements of the organisation, EDGENETIC’s trainers are well equipped to ‘go off road’ and take the delivery in whatever direction is of most benefit to the delegates, as their strengths and weaknesses emerge. This may mean spending more or less time on a given topic than originally anticipated or it might even mean the delivery of content not originally planned for.
With all of that said, the objectives of the course are laid out at the very beginning of the process and LRQA Nettitude will always ensure that those objectives are met. 
In order to adapt to a new way of working, EDGENETIC have developed an efficient system for delivering remote training courses. This training will be delivered by webinar and will include all standard training courses material which will be available to download. Whilst this is delivered on screen, we aim to keep it highly interactive and just as engaging to again ensure there are no deaths by PowerPoint.

Frequently Asked Questions about Data Privacy Security

What is an incident response policy?

An Incident response plan or policy is a process you create before you experience a cyberattack. This is so that your team has a procedure to follow when you do experience a data breach. EDGENETIC follows the CREST Cybersecurity Incident Response process which is broken down into 3 phases: preparation, response, and follow up. Having a breach plan gives you the confidence to quickly nullify any threat to your data privacy security.

Why is data privacy security important?

Although it has always been important, the implications and need for higher security are coming into play now that technology is indispensable to everyday life. Using apps, browsing websites, and shopping online are all examples of how your data will be stored and managed online. For organisations today, the threat of cyber theft is a pertinent one. Having comprehensive data privacy plans in place can reduce and mitigate the risks of such events.

Does EDGENETIC practice sustainability?

As a company with a global footprint, sustainability is an area of importance to us. We are a registered ‘Investor in People’ organisation. Taking a cue from ISO 14001, we have strong sustainability practices put in place. Our organisation also hires fairly and equally, across gender and race. By working with us, you can rest assured that we implement data privacy security measures with ethics at the core of our mission.

Get in touch via the form below and get a free quote from us for our Red Team Security Testing services.