Course Objective & Scope
When application-layer vulnerabilities are left until penetration testing, remediation costs climb and release schedules slip. This training covers the Secure Software Development Lifecycle (SSDLC), threat modeling with STRIDE, OWASP Top 10 and ASVS standards, secure authentication/session management and automated security scanning in CI/CD pipelines.
In a controlled lab environment, participants analyse vulnerabilities in realistic code samples, implement source-level fixes and compile a secure code review and AppSec checklist for their teams.
Who Should Attend?
- Backend, frontend and full-stack software developers
- Application security (AppSec) and DevSecOps engineers
- Software architects and technical team leads
- Prerequisite: web application development experience in at least one programming language
Key Takeaways
- Identify architectural risks early by conducting STRIDE threat modeling during design
- Remediate OWASP Top 10 flaws such as Broken Access Control, Injection, SSRF and insecure deserialization in code
- Apply secure authentication, session management, input validation and output encoding standards
- Integrate SAST, DAST, SCA and secret scanning checks into CI/CD pipelines
- Create an internal secure code review checklist aligned with OWASP ASVS
Curriculum
Secure SDLC and Threat Modeling
- Secure development lifecycle with OWASP SAMM and ASVS
- Data flow diagrams and architectural threat analysis with STRIDE
Access Control and Authentication Security
- IDOR/BOLA, privilege escalation and secure session/token handling
- Password storage (Argon2/bcrypt), MFA and common OAuth/OIDC implementation flaws
Injection, XSS and Client/Server-Side Vulnerabilities
- SQL/NoSQL/Command Injection, XSS, CSRF and CORS configuration
- Fixing SSRF, insecure deserialization and file upload vulnerabilities
Automated Security Testing in CI/CD (DevSecOps)
- Using SAST, DAST, SCA and pre-commit secret scanning tools
- Managing false positives, security quality gates and vulnerability triage
Hands-On Secure Code Review
- Finding vulnerabilities and patching code on a sample application
- Building an AppSec checklist for pull requests
Other Courses in This Category
-
OWASP API Security Top 10, BOLA/BFLA, OAuth 2.1 and JWT security, GraphQL/gRPC attack surfaces and API gateway controls for engineering and security teams protecting enterprise APIs.
- Live Course
- 5 modules
-
Open-source dependency risks, SBOMs (CycloneDX/SPDX), the SLSA framework, artifact signing with Sigstore/Cosign and CI/CD hardening for DevSecOps and platform teams securing the software supply chain.
- Live Course
- 5 modules
-
MITRE ATT&CK-based adversary emulation, detection engineering and collaborative Purple Team exercises for offensive and defensive security teams closing visibility and detection gaps together.
- Live Course
- 5 modules
-
The NIST SP 800-61 lifecycle, incident triage, DFIR evidence collection, containment and root-cause analysis for security and IT teams managing cyber incidents under pressure.
- Live Course
- 5 modules
-
Log architecture, normalization, correlation rules, MITRE ATT&CK-based detection, alert triage and threat hunting for SOC analysts and security engineers reducing alert fatigue and catching real threats.
- Live Course
- 5 modules
-
SOAR playbooks, LLM and security agents for automated enrichment, alert triage, case summarization and human-in-the-loop response for SOC and security engineers scaling operations.
- Live Course
- 5 modules
Get in touch
