Developer Training

Course​ Outline

"My entire development team has taken software security training from Sherif. The training provided very practical guidance on how to write secure software catered in the programming language we requested. We have already made some changes based on what we learned."

- Tongfeng Zhang, CIRA

This technical course covers a wide range of application security topics related to .NET applications. During this hands-on course, students will examine actual .NET code, tools, and other resources that help them understand how hackers think, the techniques they use to attack their applications and the best countermeasures they can use to mitigate the risk of those attacks.

• .NET Software Developers
• Technical Leads​
• Software Architects

• Intermediate to expert understanding of the web as well as HTTP protocol
• Intermediate to expert experience with web development technologies such as HTML, CSS, JavaScript, SQL, etc.
• Students are required to bring their own laptops with a minimum of 4 GB RAM installed
• VMware Workstation/ Fusion/ VirtualBox installed
• At least 60 GB HD free
• Wired network support
• USB 2.0/3.0 support

​

• Introduction
• Attacking & Securing Data Storages
  • SQL Injection
  • XML Injection
  • XPath Injection
  • Parameterization in .NET
  • Secure Storage Proc Usage
• Attacking & Securing OS Calls
  
  • Path manipulation
  • Secure file upload
  • Command injections
  • Secure OS system calls
• Attacking & Securing User Input
  • The 6 Contexts of Cross-Site Scripting (XSS)
  • Whitelisting vs. Blacklisting
  • Using Validators in .NET
• Attacking & Securing Authentication & Authorization
  • Designing secure authentication processes
  • Designing secure authorization processes
  • Using .NET Framework to Secure Authentication and Authorization
• Attacking & Securing the Software Security Supply Chain
• ​Exploiting & Preventing Cross-site Request Forgery (CSRF) Using the Synchronizer Pattern
• Attacking & Securing Direct Object Reference Using Indirect Reference Maps
• Implementing Secure Cryptography
• Securing the Transport Layer
• Exception Management and Error Handling
• Securing Redirects and Forwards
• Overview of a Secure Software Development Lifecycle (SDLC)
• Quick Overview of Effective Security Code Review Techniques
• Conclusion and Closeout Remarks

www.softwaresecured.com

​1-800-611-5741

info@softwaresecured.com

301 Moodie Dr. Unit 108, Ottawa, ON, K2H 9C4