Course Objective & Scope
Running security checks only right before release causes vulnerabilities to surface late and at high cost. This course builds the practices needed to embed security into the software development lifecycle (SSDLC) from design and coding onwards.
It covers threat modeling with STRIDE, the OWASP Top 10 and API Security Top 10 (broken access control, injection, SSRF, BOLA), secure authentication and session management, cryptography and secret management, dependency security (SCA/SBOM), and SAST/DAST checks. Participants find and patch flaws on a deliberately vulnerable sample service and produce an internal secure code review checklist.
Who Should Attend?
- Backend and full-stack developers building web applications and APIs
- Tech leads responsible for code reviews and architectural design
- AppSec and DevSecOps engineers working alongside development teams
- Prerequisite: web/API development experience in any backend language
Key Takeaways
- Perform practical threat modeling for new features using STRIDE
- Prevent injection, SSRF, BOLA and authorisation flaws at the code level
- Configure password storage, JWT/OAuth2, token refresh and secret management securely
- Integrate SAST, SCA and secret scanning checks into the CI/CD pipeline
- Turn a security-focused code review checklist into a team standard
Curriculum
SSDLC and Threat Modeling
- The secure software development lifecycle and shift-left practices
- Data flow diagrams and threat analysis with STRIDE
- Adding security requirements to acceptance criteria
Input Validation and Injection Vulnerabilities
- SQL/NoSQL/command injection and parameterised queries
- XSS, CSRF, SSRF and safe deserialisation
- Boundary checks in file uploads and external integrations
Authentication, Authorisation and API Security
- OWASP API Security Top 10: BOLA, BFLA and mass assignment
- Password hashing with Argon2/bcrypt, OAuth2/OIDC and JWT pitfalls
- Rate limiting, security headers and CORS configuration
Data Protection, Cryptography and Secret Management
- Encryption in transit and at rest (TLS, AES-GCM)
- Key and secret management with Vault and cloud KMS solutions
- Masking PII in logs and returning safe error responses
Automated Security Testing and Secure Code Review
- SAST (Semgrep, SonarQube), DAST (OWASP ZAP) and SCA/SBOM tooling
- Pre-commit secret scanning and dependency update policies
- Vulnerability hunting, patching lab and review checklist on a sample service
Other Courses in This Category
-
Characterization tests, seam and dependency-breaking techniques, strangler fig, branch by abstraction, anti-corruption layers and incremental database decomposition — for teams modernising critical live legacy systems without downtime.
- Live Course
- 5 modules
-
Developing, maintaining and improving enterprise ASP.NET MVC 5 applications on .NET Framework: routing, controller/view architecture, Entity Framework 6, filters, OWIN authentication and preparation for modernisation.
- Live Course
- 5 modules
-
Modern server-rendered web applications with ASP.NET Core MVC: Razor views, Tag Helpers, ViewComponents, model binding, FluentValidation, EF Core, Identity authorisation and xUnit tests — for teams building enterprise portals and back-office apps.
- Live Course
- 5 modules
-
Enterprise portal development on SharePoint Server Subscription Edition and hybrid environments: SharePoint Framework (SPFx) web parts and extensions, REST/CSOM APIs, list and content modelling, permissions and workflow integrations.
- Live Course
- 5 modules
-
SOLID principles, GoF design patterns (creational, structural, behavioral), layered/hexagonal/clean architecture and architecture decision records (ADRs) — for developers turning complex business rules into flexible, testable code.
- Live Course
- 5 modules
-
Martin Fowler's PoEAA, Enterprise Integration Patterns (EIP), distributed consistency, CQRS, modular monoliths, high availability and multi-tenancy — for architects and senior engineers designing large-scale enterprise systems.
- Live Course
- 5 modules
Get in touch
