CYBERSECURE CODER (CSC) Training Course

By the end of this training, participants will be able to:

• Explain application security and vulnerabilities
• Describe ABAP programming best practices and handling of SY-SUBRC
• Understand injection vulnerabilities
• Describe security testing tools
• Explain ATC and CVA

Format of the Course

• Interactive lecture and discussion.
• Lots of exercises and practice.
• Hands-on implementation in a live-lab environment.

This course covers the secure coding essential topics that are relevant to a large number of web application developers. It will teach students concepts of secure programming and involves looking at a specific piece of code, identifying a security flaw, and implementing a fix for that flaw.

In this course you will watch demos of real word attacks and how to prevent them, and gain confidence in the journey to improving the security of your applications.

Duration: 3 days
Who Should Attend: Developers looking to extend their knowledge in secure coding.

Upon Completion
• Students will get knowledge in:
• Web Application Security.
• Common Web Application Risks.
• Demo Web Application Penetration
• Data Validation
• Authentication.
• Session Management.
• Secure SDLC.

Advances in computing and engineering are driving technological progress, from blockchain and AI to gene editing and IoT, offering opportunities for productivity and human well-being. Yet, these innovations also bring new risks, as recent scandals highlight. Technology professionals face increasing pressure to address ethical concerns, balancing privacy, accuracy, fairness, and safety. This course provides practical tools to manage ethical risks in emerging data-driven technologies, drawing from theory, regulations, and industry practices. Learners will gain skills to navigate ethical dilemmas in their roles and organizations.

This course covers network defense and incident response methods, tactics, and procedures are taught in alignment with industry frameworks such as NIST 800-61 r.2 (Computer Security Incident Handling), US-CERT’s NCISP (National Cyber Incident Response Plan), and Presidential Policy Directive (PPD) 41 on Cyber Incident Coordination Policy. It is ideal for candidates who have been tasked with the responsibility of monitoring and detecting security incidents in information systems and networks, and for executing standardized responses to such incidents. The course introduces tools, tactics, and procedures to manage cybersecurity risks, identify various types of common threats, evaluate the organization's security, collect and analyze cybersecurity intelligence and remediate and report incidents as they occur. This course provides a comprehensive methodology for individuals responsible for defending the cybersecurity of their organization.

This course is designed to assist students in preparing for the CertNexus CyberSec First Responder (Exam CFR-310) certification examination. What you learn and practice in this course can be a significant part of your preparation. In addition, this course and subsequent certification (CFR-310) meets all requirements for personnel requiring DoD directive 8570.01-M position certification baselines:

• CSSP Analyst

• CSSP Infrastructure Support

• CSSP Incident Responder

• CSSP Auditor

Course Objectives: In this course, you will understand, assess and respond to security threats and operate a system and network security analysis platform. You will:

• Compare and contrast various threats and classify threat profile

• Explain the purpose and use of attack tools and technique

• Explain the purpose and use of post exploitation tools and tactic

• Explain the purpose and use of social engineering tactic

• Given a scenario, perform ongoing threat landscape research and use data to prepare for incident

• Explain the purpose and characteristics of various data source

• Given a scenario, use appropriate tools to analyze log

• Given a scenario, use regular expressions to parse log files and locate meaningful data

• Given a scenario, use Windows tools to analyze incidents

• Given a scenario, use Linux-based tools to analyze incidents

• Summarize methods and tools used for malware analysis

• Given a scenario, analyze common indicators of potential compromise

• Explain the importance of best practices in preparation for incident response

• Given a scenario, execute incident response process

• Explain the importance of concepts that are unique to forensic analysis

• Explain general mitigation methods and devices

Target Student: This course is designed primarily for cybersecurity practitioners preparing for or who currently perform job functions related to protecting information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. It is ideal for those roles within federal contracting companies, and private sector firms who whose mission or strategic objectives require the execution of Defensive Cyber Operations (DCO) or DoD Information Network (DODIN) operation and incident handling. This course focuses on the knowledge, ability, and skills necessary to provide for the defense of those information systems in a cybersecurity context, including protection, detection, analysis, investigation, and response processes.

In addition, the course ensures that all members of an IT team—regardless of size, rank or budget— understand their role in the cyber defense, incident response, and incident handling process.

Android is an open platform for mobile devices such as handsets and tablets. It has a large variety of security features to make developing secure software easier; however, it is also missing certain security aspects that are present in other hand-held platforms. The course gives a comprehensive overview of these features, and points out the most critical shortcomings to be aware of related to the underlying Linux, the file system and the environment in general, as well as regarding using permissions and other Android software development components.

Typical security pitfalls and vulnerabilities are described both for native code and Java applications, along with recommendations and best practices to avoid and mitigate them. In many cases discussed issues are supported with real-life examples and case studies. Finally, we give a brief overview on how to use security testing tools to reveal any security relevant programming bugs.

Participants attending this course will 

• Understand basic concepts of security, IT security and secure coding
• Learn the security solutions on Android
• Learn to use various security features of the Android platform
• Get information about some recent vulnerabilities in Java on Android
• Learn about typical coding mistakes and how to avoid them
• Get understanding on native code vulnerabilities on Android
• Realize the severe consequences of unsecure buffer handling in native code
• Understand the architectural protection techniques and their weaknesses
• Get sources and further readings on secure coding practices

Audience

Professionals

Implementing a secure networked application can be difficult, even for developers who may have used various cryptographic building blocks (such as encryption and digital signatures) beforehand. In order to make the participants understand the role and usage of these cryptographic primitives, first a solid foundation on the main requirements of secure communication – secure acknowledgement, integrity, confidentiality, remote identification and anonymity – is given, while also presenting the typical problems that may damage these requirements along with real-world solutions.

As a critical aspect of network security is cryptography, the most important cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement are also discussed. Instead of presenting an in-depth mathematical background, these elements are discussed from a developer's perspective, showing typical use-case examples and practical considerations related to the use of crypto, such as public key infrastructures. Security protocols in many areas of secure communication are introduced, with an in-depth discussion on the most widely-used protocol families such as IPSEC and SSL/TLS.

Typical crypto vulnerabilities are discussed both related to certain crypto algorithms and cryptographic protocols, such as BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE and similar, as well as the RSA timing attack. In each case, the practical considerations and potential consequences are described for each problem, again, without going into deep mathematical details.

Finally, as XML technology is central for data exchange by networked applications, the security aspects of XML are described. This includes the usage of XML within web services and SOAP messages alongside protection measures such as XML signature and XML encryption – as well as weaknesses in those protection measures and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Understand the requirements of secure communication
• Learn about network attacks and defenses at different OSI layers
• Have a practical understanding of cryptography
• Understand essential security protocols
• Understand some recent attacks against cryptosystems
• Get information about some recent related vulnerabilities
• Understand security concepts of Web services
• Get sources and further readings on secure coding practices

Audience

Developers, Professionals

This three day course covers the basics of securing the C/C++ code against the malicious users who may exploit many vulnerabilities in the code with memory management and input handling, the course cover the principals of writing secure code.

Even experienced Java programmers are not mastering by all means the various security services offered by Java, and are likewise not aware of the different vulnerabilities that are relevant for web applications written in Java.

The course – besides introducing security components of Standard Java Edition – deals with security issues of Java Enterprise Edition (JEE) and web services. Discussion of specific services is preceded with the foundations of cryptography and secure communication. Various exercises deal with declarative and programmatic security techniques in JEE, while both transport-layer and end-to-end security of web services is discussed. The use of all components is presented through several practical exercises, where participants can try out the discussed APIs and tools for themselves.

The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform and web-related vulnerabilities. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Understand security concepts of Web services
• Learn to use various security features of the Java development environment
• Have a practical understanding of cryptography
• Understand security solutions of Java EE
• Learn about typical coding mistakes and how to avoid them
• Get information about some recent vulnerabilities in the Java framework
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers

Description

The Java language and the Runtime Environment (JRE) was designed to be free from the most problematic common security vulnerabilities experienced in other languages, like C/C++. Yet, software developers and architects should not only know how to use the various security features of the Java environment (positive security), but should also be aware of the numerous vulnerabilities that are still relevant for Java development (negative security).

The introduction of security services is preceded with a brief overview of the foundations of cryptography, providing a common baseline for understanding the purpose and the operation of the applicable components. The use of these components is presented through several practical exercises, where participants can try out the discussed APIs for themselves.

The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform, covering both the typical bugs committed by Java programmers and the language- and environment-specific issues. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn to use various security features of the Java development environment
• Have a practical understanding of cryptography
• Learn about typical coding mistakes and how to avoid them
• Get information about some recent vulnerabilities in the Java framework
• Get sources and further readings on secure coding practices

Audience

Developers

A number of programming languages are available today to compile code to .NET and ASP.NET frameworks. The environment provides powerful means for security development, but developers should know how to apply the architecture- and coding-level programming techniques in order to implement the desired security functionality and avoid vulnerabilities or limit their exploitation.

The aim of this course is to teach developers through numerous hands-on exercises how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization, provide remote procedure calls, handle sessions, introduce different implementations for certain functionality, and many more.

Introduction of different vulnerabilities starts with presenting some typical programming problems committed when using .NET, while the discussion of vulnerabilities of the ASP.NET also deals with various environment settings and their effects. Finally, the topic of ASP.NET-specific vulnerabilities not only deals with some general web application security challenges, but also with special issues and attack methods like attacking the ViewState, or the string termination attacks.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn to use various security features of the .NET development environment
• Get practical knowledge in using security testing tools
• Learn about typical coding mistakes and how to avoid them
• Get information about some recent vulnerabilities in .NET and ASP.NET
• Get sources and further readings on secure coding practices

Audience

Developers

The course introduces some common security concepts, gives an overview about the nature of the vulnerabilities regardless of the used programming languages and platforms, and explains how to handle the risks that apply regarding software security in the various phases of the software development lifecycle. Without going deeply into technical details, it highlights some of the most interesting and most aching vulnerabilities in various software development technologies, and presents the challenges of security testing, along with some techniques and tools that one can apply to find any existing problems in their code.

Participants attending this course will 

• Understand basic concepts of security, IT security and secure coding
• Understand Web vulnerabilities both on server and client side
• Realize the severe consequences of unsecure buffer handling
• Be informated about some recent vulnerabilities in development environments and frameworks
• Learn about typical coding mistakes and how to avoid them
• Understand security testing approaches and methodologies

Audience

Managers

The Internet of Things (IoT) promises a wide range of benefits for industry, energy and utility companies, municipalities, healthcare, and consumers. Data can be collected in extraordinary volume and detail regarding almost anything worth measuring, such as public health and safety, the environment, industrial and agricultural production, energy, and utilities. New data analysis tools have been optimized for the massive amounts of data that IoT produces, enabling well-informed decisions to be made quickly.

But putting IoT systems into place can be a complicated proposition, and fraught with hazards. Solutions may involve devices and technologies from many different vendors, requiring a good understanding of software and hardware and strategies to integrate them, as well as the risks associated with security, privacy, and the safety of those whose working and living environments are managed by these systems.

IT professionals often have little or no experience working with embedded systems, sensor networks, actuators, real-time systems, and other components that are common to IoT, so this course provides a foundation for understanding how these components work with other systems that IT professionals typically have more experience working with—such as networks, cloud computing, and applications running on servers, desktop computers, and mobile devices.

In this course, students will learn general strategies for planning, designing, developing, implementing, and maintaining an IoT system through various case studies and by assembling and configuring an IoT device to work in a sensor network. Students will create an IoT device based on an ESP8266 microcontroller, implementing various common IoT features, such as analog and digital sensors, a web-based interface, MQTT messaging, and data encryption.

Course Objectives: In this course, you will learn how to apply Internet of Things technologies to solve real-world problems. You will:

• Plan an IoT implementation.

• Construct and program an IoT device.

• Communicate with an IoT device using wired and wireless connections.

• Process sensor input and control an actuator on an IoT device.

• Manage security, privacy, and safety risks on IoT projects.

• Manage an IoT prototyping and development project throughout the development lifecycle.

Target Student: This course is designed for IT professionals with baseline skills in computer hardware, software support, and development who want to learn how to design, develop, implement, operate, and manage Internet of Things devices and related systems. The student is interested in learning more about embedded systems, microcontroller programming, IoT security, and the development life cycle for IoT projects.

While students will gain hands-on experience assembling a prototype IoT device and using software development tools, these activities are closely guided, so previous experience in electronics assembly and programming are not required. This course prepares students for taking the CertNexus Certified Internet of Things (IoT) Practitioner (Exam ITP-110).

Artificial intelligence (AI) and machine learning (ML) have become an essential part of the toolset for many organizations. When used effectively, these tools provide actionable insights that drive critical decisions and enable organizations to create exciting, new, and innovative products and services. This course shows you how to apply various approaches and algorithms to solve business problems through AI and ML, follow a methodical workflow to develop sound solutions, use open source, off-the-shelf tools to develop, test, and deploy those solutions, and ensure that they protect the privacy of users. This course includes hands on activities for each topic area.

Course Objectives: In this course, you will implement AI techniques in order to solve business problems. You will:

• Specify a general approach to solve a given business problem that uses applied AI and ML.
• Collect and refine a dataset to prepare it for training and testing.
• Train and tune a machine learning model.
• Finalize a machine learning model and present the results to the appropriate audience.
• Build linear regression models.
• Build classification models.
• Build clustering models.
• Build decision trees and random forests.
• Build support-vector machines (SVMs).
• Build artificial neural networks (ANNs).
• Promote data privacy and ethical practices within AI and ML projects.

Target Student: The skills covered in this course converge on three areas—software development, applied math and statistics, and business analysis. Target students for this course may be strong in one or two or these of these areas and looking to round out their skills in the other areas, so they can apply artificial intelligence (AI) systems, particularly machine learning models, to business problems.

So the target student may be a programmer looking to develop additional skills to apply machine learning algorithms to business problems, or a data analyst who already has strong skills in applying math and statistics to business problems, but is looking to develop technology skills related to machine learning. A typical student in this course should have several years of experience with computing technology, including some aptitude in computer programming. This course is also designed to assist students in preparing for the CertNexus® Certified Artificial Intelligence (AI) Practitioner (Exam AIP-110) certification.

This course is designed for practitioners who are seeking to demonstrate a vendor-neutral, cross-industry skill set that will enable them to design, implement, operate, and/or manage a secure IoT ecosystem.

Target Student: This course is designed for IoT practitioners who are looking to improve their skills and knowledge of IoT security and privacy. This course is also designed for students who are seeking the CertNexus Certified Internet of Things Security Practitioner (CIoTSP) certification and who want to prepare for Exam ITS-110.

Objectives:

In this course, you will identify many of the common risks involved in using conventional end-user technology, as well as ways to use it safely, to protect yourself from those risks.

You will:

• Identify security compliance measures.
• Address social engineering attempts.
• Secure devices such as desktops, laptops, tablets, smartphones, and more.
• Use the Internet securely.

Target Student

This course is designed for you as a non-technical end user of computers, mobile devices, networks, and the Internet, to enable you to use technology more securely to minimize digital risks.

This course is also designed for you to prepare for the Certified CyberSAFE credential. You can obtain your Certified CyberSAFE certificate by completing the Certified CyberSAFE credential process on the CHOICE platform following the course presentation.