Secure development training · Security by Design
Build security in from the design stage and at every step of the software development lifecycle. Through workshops tailored to your tech stack, learn to identify, exploit and fix vulnerabilities to design more robust, safer applications.
OFD-310 · Advanced · 3 days · 10 participants max. · Hands-on workshops
Why train in secure development?
Fixing a vulnerability at the end of a project can be costly, complex and risky. This course helps developers build security in from the design stage and throughout the software lifecycle, preventing flaws rather than dealing with them once they appear.
Participants face scenarios drawn from real vulnerabilities. Each concept is put into practice straight away to understand how a flaw can be exploited, measure its impact and apply the right protection mechanisms.
The content, materials and exercises are adapted to your environment, your languages and your tech stack. The workshops follow a concrete progression: identify a vulnerability, exploit it, understand its root cause, then implement a lasting fix in a context close to your projects.
On the programme
- SSDLC - Secure development lifecycle
- OWASP Top 10
- Spring Security
- Burp Suite & Fuzzing
What you will be able to put into practice
By the end of the course, you will be able to:
- Integrate
security into the development lifecycle by applying SSDLC principles at every stage of the software project.
- Identify
the main application vulnerabilities using the OWASP Top 10 and assess their impact on your applications.
- Understand
how flaws are exploited through concrete cases of injection, XSS, CSRF and insecure deserialisation.
- Implement
the right protections from the design stage and throughout development to reduce the attack surface for the long term.
- Secure
applications with Spring Security by configuring the authentication, authorisation and protection mechanisms the project needs.
- Protect
passwords, sessions and secrets by applying secure management practices that limit the risk of compromise.
- Test
application robustness with fuzzing, dependency analysis and tools such as Burp Suite.
The format in practice
Duration
3 days
3 days · 24 hours
Group size
10 max.
10 participants max. per trainer
Format
- Focused input
- Progressive workshops
- Integration cases
Prerequisites
- Development experience
- Knowledge of the web and HTTP
- A Docker-ready workstation with Internet access and administrator rights
Certification
Certificate of attendance
Each participant receives this digital badge in their name, level 3 of 3 in the Offensive & defensive series.
Assessment
- Continuous assessment during the workshops
- Final practical scenario
Who it is for
- Back-end and full-stack developers
- Tech leads
- Software architects
- DevSecOps engineers
Methods
- Demonstrations
- Attacker and defender roles
- Progressive workshops
- Application to concrete cases
Materials
- Materials and exercises tailored to your stack
- Preconfigured Docker environments
Practice
- Secure development
- Application security
Other courses you may be interested in
Make security a development reflex
Let's design a course around your languages, your tech stack and your teams' challenges, to build security into your development practices for good.