Courses

Certifications

Instructors

Fundamentals of Secure Application Development

Application developers often aren’t trained in security, yet the vast majority of breaches are related to the application layer. Learn secure development best practices that keep software safe.

The vast majority of hacks are not due to insecure networks or misconfigured firewalls; they are a result of common software flaws that get coded into applications. Even with good information security policy and staff, the reality is that software developers are often underserved when it comes to security strategy. If their applications get built without attention to good software security practices, the risk gets passed downstream and by the time an incident occurs, it’s too late to be proactive.

From proactive requirements to coding and testing, this information security training course covers the best practices any software developer needs to avoid opening up their users, customers, and organization to attack at the application layer. We teach only constantly updated best practices, and our experts answer your questions live in class. Return to work ready to build higher quality, more robustly protected applications.

Duration

2 days/16 hours of instruction

Education Credits

14 PDUs

Public Classroom Pricing

Starting at: $1295(USD)

GSA Price: $1185

Group Rate: $1195

Private Group Pricing

Have a group of 5 or more students? Request special pricing for private group training today.

Download the Course Brochure

Part 1: Secure Software Development

Assets, Threats & Vulnerabilities
Security Risk Analysis (Bus & Tech)
Secure Dev Processes (MS, BSI…)
Defense in Depth
Approach for this course

Introductory Case Study

Part 2: The Context for Secure Development

Assets to be protected
Threats Expected
Security Imperatives (int&external)
Organization's Risk Appetite
Security Terminology
Organizational Security Policy
Security Roles and Responsibilities
Security Training for Roles
Generic Security Goals & Requirements

Exercise: Our Own Security Context

Part 3: Security Requirements

Project-Specific Security Terms
Project-Related Assets & Security Goals
Product Architecture Analysis
Use Cases & MisUse/Abuse Cases
Dataflows with Trust Boundaries
Product Security Risk Analysis
Elicit, Categorize, Prioritize SecRqts
Validate Security Requirements

Exercise: Managing Security Requirements

Part 4: Designing Secure Software

High-Level Design
1. Architectural Risk Analysis
2. Design Requirements
3. Analyze Attack Surface
4. Threat Modeling
5. Trust Boundaries
6. Eliminate Race Objects
Detail-Level Design
1. Secure Design Principles
2. Use of Security Wrappers
3. Input Validation
4. Design Pitfalls
5. Validating Design Security
6. Pairing Mem Mgmt Functions
7. Exclude User Input from format strings
8. Canonicalization
9. TOCTOU
10. Close Race Windows
11. Taint Analysis

Exercise: A Secure Software Design, Instructor Q and A

Part 5: Writing Secure Code

Coding
1. Developer guidelines & checklists
2. Compiler Security Settings (per)
3. Tools to use
4. Coding Standards (per language)
5. Common pitfalls (per language)
6. Secure/Safe functions/methods
  1. Stack Canaries
  2. Encrypted Pointers
  3. Memory Initialization
  4. Function Return Checking (e.e. malloc)
  5. Dereferencing Pointers
7. Integer type selection
  1. Range Checking
  2. Pre/post checking
8. Synchronization Primitives
Early Verification
1. Static Analysis (Code Review w/tools)
2. Unit & Dev Team Testing
3. Risk-Based Security Testing
4. Taint Analysis

Exercise: Secure Coding Q and A

Part 6: Testing for Software Security

Assets to be protected
Threats Expected
Security Imperatives (int&external)
Organization's Risk Appetite
Static Analysis
Dynamic Analysis
Risk-Based Security testing
Fuzz Testing (Whitebox vs Blackbox)
Penetration Testing (Whitebox vs Blackbox)
Attack Surface Review
Code audits
Independent Security Review

Exercise: Testing Software for Security

Part 7: Releasing & Operating Secure Software

Incident Response Planning
Final Security Review
Release Archive
OS Protections:
1. Address Space Layout Randomization
2. Non-Executable Stacks
3. W^X
4. Data Execution Prevention
Monitoring
Incident Response
Penetration Testing

Exercise: A Secure Software Release

Part 8: Making Software Development More Secure

Process Review
Getting Started
Priorities

Exercise: Your Secure Software Plan

Professionals who may benefit include:

Application Development Managers
Software Engineers and Developers
CISOs, CISAs and Security Professionals
Software Testers
QA Managers, Directors, and Staff
Test Management
Business Analysts
Project Managers
IT Specialists (Security, Capacity Management, Networking…)

Understand assets, threats, vulnerabilities, and risks
Gather and understand security requirements
Design secure software
Write secure code
Test your software for security
Release & operate secure software