Kraków

Archeion, Św. Filipa 23/6, Kraków, Polska, 30-636

Sale szkoleniowe znajdują się przy ul. Św. Filipa 23/6 w Krakowie, zaledwie 3 minuty od dworca PKP, w s...

Tarnów

Hotel Tarnovia, Kościuszki 10, Tarnów, Polska, 33-100

Sala szkoleniowa NobleProg jest usytuowana w hotelu Tarnovia przy ulicy Kościuszki 10 w Ta...

Zakopane

Dafne, Jagiellońska 30, Zakopane, Polska, 34-500

Sala szkoleniowa jest zlokalizowana zaledwie 350 metrów od dworców PKP i PKS oraz 700 metrów od Krupów...

Przeglądaj szkolenia

Application Security for Developers

21 godzin
This course will help professionals understand the value and limits of Application Security. While the Application Security Principals provides valuable awareness around some of the major risks in applications today, this course will highlight both the good and not so good. This course is crucial because of the increasing need for developers to code in a secure manner. It is critical to introduce security as a quality component into the development cycle. This course aims at educating developers about various security vulnerabilities through hands-on practice using our purposely developed insecure web application.
Więcej...

Android Security

14 godzin
Android is an open platform for mobile devices such as handsets and tablets. It has a large variety of security features to make developing secure software easier; however, it is also missing certain security aspects that are present in other hand-held platforms. The course gives a comprehensive overview of these features, and points out the most critical shortcomings to be aware of related to the underlying Linux, the file system and the environment in general, as well as regarding using permissions and other Android software development components. Typical security pitfalls and vulnerabilities are described both for native code and Java applications, along with recommendations and best practices to avoid and mitigate them. In many cases discussed issues are supported with real-life examples and case studies. Finally, we give a brief overview on how to use security testing tools to reveal any security relevant programming bugs. Participants attending this course will 
  • Understand basic concepts of security, IT security and secure coding
  • Learn the security solutions on Android
  • Learn to use various security features of the Android platform
  • Get information about some recent vulnerabilities in Java on Android
  • Learn about typical coding mistakes and how to avoid them
  • Get understanding on native code vulnerabilities on Android
  • Realize the severe consequences of unsecure buffer handling in native code
  • Understand the architectural protection techniques and their weaknesses
  • Get sources and further readings on secure coding practices
Audience Professionals
Więcej...

Comprehensive C# and .NET Application Security

21 godzin
A number of programming languages are available today to compile code to .NET and ASP.NET frameworks. The environment provides powerful means for security development, but developers should know how to apply the architecture- and coding-level programming techniques in order to implement the desired security functionality and avoid vulnerabilities or limit their exploitation. The aim of this course is to teach developers through numerous hands-on exercises how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization, provide remote procedure calls, handle sessions, introduce different implementations for certain functionality, and many more. A special section is devoted to configuration and hardening of the .NET and ASP.NET environment for security. A brief introduction to the foundations of cryptography provides a common practical baseline for understanding the purpose and the operation of various algorithms, based on which the course presents the cryptographic features that can be used in .NET. This is followed by the introduction of some recent crypto vulnerabilities both related to certain crypto algorithms and cryptographic protocols, as well as side-channel attacks. Introduction of different vulnerabilities starts with presenting some typical programming problems committed when using .NET, including bug categories of input validation, error handling or race conditions. A special focus is given to XML security, while the topic of ASP.NET-specific vulnerabilities tackles some special issues and attack methods: like attacking the ViewState, or the string termination attacks. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn to use various security features of the .NET development environment
  • Have a practical understanding of cryptography
  • Understand some recent attacks against cryptosystems
  • Get information about some recent vulnerabilities in .NET and ASP.NET
  • Learn about typical coding mistakes and how to avoid them
  • Get practical knowledge in using security testing tools
  • Get sources and further readings on secure coding practices
Audience Developers
Więcej...

Network Security and Secure Communication

21 godzin
Implementing a secure networked application can be difficult, even for developers who may have used various cryptographic building blocks (such as encryption and digital signatures) beforehand. In order to make the participants understand the role and usage of these cryptographic primitives, first a solid foundation on the main requirements of secure communication – secure acknowledgement, integrity, confidentiality, remote identification and anonymity – is given, while also presenting the typical problems that may damage these requirements along with real-world solutions. As a critical aspect of network security is cryptography, the most important cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement are also discussed. Instead of presenting an in-depth mathematical background, these elements are discussed from a developer's perspective, showing typical use-case examples and practical considerations related to the use of crypto, such as public key infrastructures. Security protocols in many areas of secure communication are introduced, with an in-depth discussion on the most widely-used protocol families such as IPSEC and SSL/TLS. Typical crypto vulnerabilities are discussed both related to certain crypto algorithms and cryptographic protocols, such as BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE and similar, as well as the RSA timing attack. In each case, the practical considerations and potential consequences are described for each problem, again, without going into deep mathematical details. Finally, as XML technology is central for data exchange by networked applications, the security aspects of XML are described. This includes the usage of XML within web services and SOAP messages alongside protection measures such as XML signature and XML encryption – as well as weaknesses in those protection measures and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Understand the requirements of secure communication
  • Learn about network attacks and defenses at different OSI layers
  • Have a practical understanding of cryptography
  • Understand essential security protocols
  • Understand some recent attacks against cryptosystems
  • Get information about some recent related vulnerabilities
  • Understand security concepts of Web services
  • Get sources and further readings on secure coding practices
Audience Developers, Professionals
Więcej...

Combined C/C++, JAVA and Web Application Security

28 godzin
To serve in the best way heterogeneous development groups that are using various platforms simultaneously during their everyday work, we have merged various topics into a combined course that presents diverse secure coding subjects in didactic manner on a single training event. This course combines C/C++ and Java platform security to provide an extensive, cross-platform secure coding expertise. Concerning C/C++, common security vulnerabilities are discussed, backed by practical exercises about the attacking methods that exploit these vulnerabilities, with the focus on the mitigation techniques that can be applied to prevent the occurrences of these dangerous bugs, detect them before market launch or prevent their exploitation. Security components and service of Java are discussed by presenting the different APIs and tools through a number of practical exercises where participants can gain hands-on experience in using them. The course also covers security issues of web services and the related Java services that can be applied to prevent the most aching threats of the Internet based services. Finally, web- and Java-related security vulnerabilities are demonstrated by easy-to-understand exercises, which not only show the root cause of the problems, but also demonstrate the attack methods along with the recommended mitigation and coding techniques in order to avoid the associated security problems. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Learn to use various security features of the Java development environment
  • Have a practical understanding of cryptography
  • Realize the severe consequences of unsecure buffer handling
  • Understand the architectural protection techniques and their weaknesses
  • Learn about typical coding mistakes and how to avoid them
  • Be informed about recent vulnerabilities in various platforms, frameworks and libraries
  • Get sources and further readings on secure coding practices
Audience Developers
Więcej...

Application Security in the Cloud

21 godzin
Migrating to the cloud introduces immense benefits for companies and individuals in terms of efficiency and costs. With respect to security, the effects are quite diverse, but it is a common perception that using cloud services impacts security in a positive manner. Opinions, however, diverge many times even on defining who is responsible for ensuring the security of cloud resources. Covering IaaS, PaaS and SaaS, first the security of the infrastructure is discussed: hardening and configuration issues as well as various solutions for authentication and authorization alongside identity management that should be at the core of all security architecture. This is followed by some basics regarding legal and contractual issues, namely how trust is established and governed in the cloud. The journey through cloud security continues with understanding cloud-specific threats and the attackers’ goals and motivations as well as typical attack steps taken against cloud solutions. Special focus is also given to auditing the cloud and providing security evaluation of cloud solutions on all levels, including penetration testing and vulnerability analysis. The focus of the course is on application security issues, dealing both with data security and the security of the applications themselves. From the standpoint of application security, cloud computing security is not substantially different from general software security, and therefore basically all OWASP-enlisted vulnerabilities are relevant in this domain as well. It is the set of threats and risks that makes the difference, and thus the training is concluded with the enumeration of various cloud-specific attack vectors connected to the weaknesses discussed beforehand. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Understand major threats and risks in the cloud domain
  • Learn about elementary cloud security solutions
  • Get information about the trust and the governance regarding the cloud
  • Have a practical understanding of cryptography
  • Get extensive knowledge in application security in the cloud
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Understand the challenges of auditing and evaluating cloud systems for security
  • Learn how to secure the cloud environment and infrastructure
  • Get sources and further readings on secure coding practices
Audience Developers, Managers, Professionals
Więcej...

C/C++ Secure Coding

21 godzin
This three day course covers the basics of securing the C/C++ code against the malicious users who may exploit many vulnerabilities in the code with memory management and input handling, the course cover the principals of writing secure code.
Więcej...

Advanced Java Security

21 godzin
Nawet doświadczeni programiści Java nie opanowują w pełni różnych usług zabezpieczeń oferowanych przez Javę, i równie często nie są świadomi różnych podatności, które są istotne dla aplikacji internetowych napisanych w Javie.Kurs, oprócz przedstawienia komponentów bezpieczeństwa Standardowej Edycji Javy, zajmuje się kwestiami bezpieczeństwa Java Enterprise Edition (JEE) oraz usług internetowych. Omówienie konkretnych usług poprzedza fundamenty kryptografii i bezpiecznej komunikacji. Różne zadania obejmują deklaratywne i programistyczne techniki zabezpieczeń w JEE, podczas gdy bezpieczeństwo warstwy transportowej i end-to-end usług internetowych jest omawiane. Wykorzystanie wszystkich komponentów jest prezentowane poprzez kilka praktycznych ćwiczeń, w których uczestnicy mogą samodzielnie wypróbować omawiane interfejsy API i narzędzia.Kurs przechodzi również przez najczęstsze i najpoważniejsze błędy programistyczne języka Java oraz platformy, a także związane z siecią problemy bezpieczeństwa. Oprócz typowych błędów popełnianych przez programistów Javy, przedstawiane podatności bezpieczeństwa obejmują zarówno kwestie specyficzne dla języka, jak i problemy wynikające z środowiska wykonawczego. Wszystkie podatności i związane z nimi ataki są demonstrowane poprzez łatwe do zrozumienia ćwiczenia, a następnie przedstawiane są zalecane wytyczne kodowania i możliwe techniki łagodzenia.Uczestnicy uczestniczący w tym kursie będą:
  • Rozumieć podstawowe koncepcje zabezpieczeń, bezpieczeństwa informatycznego i bezpiecznego kodowania
  • Poznać podatności internetowe poza pierwszą dziesiątką OWASP i wiedzieć, jak ich unikać
  • Zrozumieć koncepcje bezpieczeństwa usług internetowych
  • Nauczyć się korzystać z różnych funkcji zabezpieczeń środowiska programistycznego Javy
  • Posiadać praktyczne zrozumienie kryptografii
  • Zrozumieć rozwiązania bezpieczeństwa Java EE
  • Dowiedzieć się o typowych błędach kodowania i jak ich unikać
  • Uzyskać informacje na temat ostatnich podatności w frameworku Javy
  • Posiąść praktyczną wiedzę w użyciu narzędzi do testowania bezpieczeństwa
  • Otrzymać źródła i dalszą literaturę na temat praktyk bezpiecznego kodowania.
Grupa docelowa: Deweloperzy
Więcej...

Combined JAVA, PHP and Web Application Security

28 godzin
Even experienced programmers do not master by all means the various security services offered by their development platforms, and are likewise not aware of the different vulnerabilities that are relevant for their developments. This course targets developers using both Java and PHP, providing them essential skills necessary to make their applications resistant to contemporary attacks through the Internet. Levels of Java security architecture are walked through by tackling access control, authentication and authorization, secure communication and various cryptographic functions. Various APIs are also introduced that can be used to secure your code in PHP, like OpenSSL for cryptography or HTML Purifier for input validation. On server side, the best practices are given for hardening and configuring the operating system, the web container, the file system, the SQL server and the PHP itself, while a special focus is given to client-side security through security issues of JavaScript, Ajax and HTML5. General web vulnerabilities are discussed by examples aligned to the OWASP Top Ten, showing various injection attacks, script injections, attacks against session handling, insecure direct object references, issues with file uploads, and many others. The various Java- and PHP-specific language problems and issues stemming from the runtime environment are introduced grouped into the standard vulnerability types of missing or improper input validation, improper use of security features, incorrect error and exception handling, time- and state-related problems, code quality issues and mobile code-related vulnerabilities. Participants can try out the discussed APIs, tools and the effects of configurations for themselves, while the introduction of vulnerabilities are all supported by a number of hands-on exercises demonstrating the consequences of successful attacks, showing how to correct the bugs and apply mitigation techniques, and introducing the use of various extensions and tools. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Learn to use various security features of the Java development environment
  • Have a practical understanding of cryptography
  • Learn to use various security features of PHP
  • Understand security concepts of Web services
  • Get practical knowledge in using security testing tools
  • Learn about typical coding mistakes and how to avoid them
  • Be informed about recent vulnerabilities in Java and PHP frameworks and libraries
  • Get sources and further readings on secure coding practices
Audience Developers
Więcej...

Standard Java Security

14 godzin
Description The Java language and the Runtime Environment (JRE) was designed to be free from the most problematic common security vulnerabilities experienced in other languages, like C/C++. Yet, software developers and architects should not only know how to use the various security features of the Java environment (positive security), but should also be aware of the numerous vulnerabilities that are still relevant for Java development (negative security). The introduction of security services is preceded with a brief overview of the foundations of cryptography, providing a common baseline for understanding the purpose and the operation of the applicable components. The use of these components is presented through several practical exercises, where participants can try out the discussed APIs for themselves. The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform, covering both the typical bugs committed by Java programmers and the language- and environment-specific issues. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn to use various security features of the Java development environment
  • Have a practical understanding of cryptography
  • Learn about typical coding mistakes and how to avoid them
  • Get information about some recent vulnerabilities in the Java framework
  • Get sources and further readings on secure coding practices
Audience Developers
Więcej...

Java and Web Application Security

21 godzin
Description Beyond solid knowledge in using Java components, even for experienced Java programmers it is essential to have a deep knowledge in web-related vulnerabilities both on server and client side, the different vulnerabilities that are relevant for web applications written in Java, and the consequences of the various risks. General web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained in the context of Java with the most important aim to avoid the associated problems. In addition, a special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5. The course introduces security components of Standard Java Edition, which is preceded with the foundations of cryptography, providing a common baseline for understanding the purpose and the operation of the applicable components. The use of all components is presented through practical exercises, where participants can try out the discussed APIs and tools for themselves. Finally, the course explains the most frequent and severe programming flaws of the Java language and platform. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Learn to use various security features of the Java development environment
  • Have a practical understanding of cryptography
  • Learn about typical coding mistakes and how to avoid them
  • Get information about some recent vulnerabilities in the Java framework
  • Get practical knowledge in using security testing tools
  • Get sources and further readings on secure coding practices
Audience Developers
Więcej...

Advanced Java, JEE and Web Application Security

28 godzin
Beyond solid knowledge in using Java components, even for experienced Java programmers it is essential to have a deep knowledge in web-related vulnerabilities both on server and client side, the different vulnerabilities that are relevant for web applications written in Java, and the consequences of the various risks. General web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained in the context of Java with the most important aim to avoid the associated problems. In addition, a special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5. The course introduces security components of Standard Java Edition, which is preceded with the foundations of cryptography, providing a common baseline for understanding the purpose and the operation of the applicable components. Security issues of Java Enterprise Edition are presented through various exercises explaining both declarative and programmatic security techniques in JEE. Finally, the course explains the most frequent and severe programming flaws of the Java language and platform. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Learn to use various security features of the Java development environment
  • Have a practical understanding of cryptography
  • Understand security concepts of Web services
  • Understand security solutions of Java EE
  • Learn about typical coding mistakes and how to avoid them
  • Get information about some recent vulnerabilities in the Java framework
  • Get practical knowledge in using security testing tools
  • Get sources and further readings on secure coding practices
Audience Developers
Więcej...

Node.JS and Web Application Security

21 godzin
Pisanie bezpiecznego kodu jest obowiązkiem każdego programisty. Co by było, gdyby ktoś ci powiedział, że pomimo wszystkich twoich wysiłków, kod, który piszesz całą swoją karierę, jest pełen słabości, o których istnieniu nie wiedziałeś? Co jeśli, gdy to czytasz, hakerzy próbowali złamać twój kod? Jakie są szanse, że się im udało? Co jeśli mogliby ukraść twoją bazę danych i sprzedać ją na czarnym rynku? Ten kurs bezpieczeństwa aplikacji internetowych zmieni sposób w jaki patrzysz na kod. Ma on warsztatową formę, podczas której nauczymy cię sztuczek hakerów i sposobów ich złagodzenia, pozostawiając Cię jedynie z pragnieniem dowiedzenia się jeszcze więcej. Tylko od Ciebie zależy, czy chcesz być na czele grupy jako lider w walce z cyberprzestępczością. Uczestnicy szkolenia poznają:
  • Podstawowe pojęcia z zakresu bezpieczeństwa, bezpieczeństwa w IT i bezpiecznego kodowania
  • Luki w sieci i jak ich unikać (OWASP i więcej)
  • Luki w zabezpieczeniach klienta i dobre praktyki bezpiecznego kodowania
  • Jak zabezpieczyć Nodejs
  • Jak zabezpieczyć MongoDB
  • Praktyczne zrozumienie kryptografii
  • Podstawowe protokoły bezpieczeństwa
  • Koncepcje bezpieczeństwa usług internetowych (Web services)
  • Zabezpieczanie JSON
  • Praktyczną wiedzę z zakresu technik i narzędzi testowania bezpieczeństwa
  • Dowiedzą się, jak radzić sobie z lukami w używanych platformach, frameworkach i bibliotekach
  • Uzyskają dodatkowe źródła i materiały dotyczące bezpiecznych metod kodowania
Więcej...

.NET, C# and ASP.NET Security Development

14 godzin
A number of programming languages are available today to compile code to .NET and ASP.NET frameworks. The environment provides powerful means for security development, but developers should know how to apply the architecture- and coding-level programming techniques in order to implement the desired security functionality and avoid vulnerabilities or limit their exploitation. The aim of this course is to teach developers through numerous hands-on exercises how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization, provide remote procedure calls, handle sessions, introduce different implementations for certain functionality, and many more. Introduction of different vulnerabilities starts with presenting some typical programming problems committed when using .NET, while the discussion of vulnerabilities of the ASP.NET also deals with various environment settings and their effects. Finally, the topic of ASP.NET-specific vulnerabilities not only deals with some general web application security challenges, but also with special issues and attack methods like attacking the ViewState, or the string termination attacks. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn to use various security features of the .NET development environment
  • Get practical knowledge in using security testing tools
  • Learn about typical coding mistakes and how to avoid them
  • Get information about some recent vulnerabilities in .NET and ASP.NET
  • Get sources and further readings on secure coding practices
Audience Developers
Więcej...

Advanced C#, ASP.NET and Web Application Security

21 godzin
Beyond solid knowledge in using various security features of .NET and ASP.NET, even for experienced programmers it is essential to have a deep knowledge in web-related vulnerabilities both on server and client side along with the consequences of the various risks. In this course the general web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained in the context of ASP.NET. A special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5. The course also deals with the security architecture and components of the .NET framework, including code- and role based access control, permission declaration and checking mechanisms and the transparency model. A brief introduction to the foundations of cryptography provides a common practical baseline for understanding the purpose and the operation of various algorithms, based on which the course presents the cryptographic features that can be used in .NET. Introduction of different security bugs follows the well-established vulnerability categories, tackling input validation, security features, error handling, time- and state-related problems, the group of general code quality issues, and a special section on ASP.NET-specific vulnerabilities. These topics are concluded with an overview on testing tools that can be used to automatically reveal some of the learnt bugs. Topics are presented through practical exercises where participants can try out the consequences of certain vulnerabilities, the mitigations, as well as the discussed APIs and tools for themselves. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Learn to use various security features of the .NET development environment
  • Have a practical understanding of cryptography
  • Get information about some recent vulnerabilities in .NET and ASP.NET
  • Get practical knowledge in using security testing tools
  • Learn about typical coding mistakes and how to avoid them
  • Get sources and further readings on secure coding practices
Audience Developers
Więcej...

The Secure Coding Landscape

14 godzin
The course introduces some common security concepts, gives an overview about the nature of the vulnerabilities regardless of the used programming languages and platforms, and explains how to handle the risks that apply regarding software security in the various phases of the software development lifecycle. Without going deeply into technical details, it highlights some of the most interesting and most aching vulnerabilities in various software development technologies, and presents the challenges of security testing, along with some techniques and tools that one can apply to find any existing problems in their code. Participants attending this course will 
  • Understand basic concepts of security, IT security and secure coding
  • Understand Web vulnerabilities both on server and client side
  • Realize the severe consequences of unsecure buffer handling
  • Be informated about some recent vulnerabilities in development environments and frameworks
  • Learn about typical coding mistakes and how to avoid them
  • Understand security testing approaches and methodologies
Audience Managers
Więcej...

Secure coding in PHP

21 godzin
The course provides essential skills for PHP developers necessary to make their applications resistant to contemporary attacks through the Internet. Web vulnerabilities are discussed through PHP-based examples going beyond the OWASP top ten, tackling various injection attacks, script injections, attacks against session handling of PHP, insecure direct object references, issues with file upload, and many others. PHP-related vulnerabilities are introduced grouped into the standard vulnerability types of missing or improper input validation, incorrect error and exception handling, improper use of security features and time- and state-related problems. For this latter we discuss attacks like the open_basedir circumvention, denial-of-service through magic float or the hash table collision attack. In all cases participants will get familiar with the most important techniques and functions to be used to mitigate the enlisted risks. A special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5. A number of security-related extensions to PHP are introduced like hash, mcrypt and OpenSSL for cryptography, or Ctype, ext/filter and HTML Purifier for input validation. The best hardening practices are given in connection with PHP configuration (setting php.ini), Apache and the server in general. Finally, an overview is given to various security testing tools and techniques which developers and testers can use, including security scanners, penetration testing and exploit packs, sniffers, proxy servers, fuzzing tools and static source code analyzers. Both the introduction of vulnerabilities and the configuration practices are supported by a number of hands-on exercises demonstrating the consequences of successful attacks, showing how to apply mitigation techniques and introducing the use of various extensions and tools. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Have a practical understanding of cryptography
  • Learn to use various security features of PHP
  • Learn about typical coding mistakes and how to avoid them
  • Be informed about recent vulnerabilities of the PHP framework
  • Get practical knowledge in using security testing tools
  • Get sources and further readings on secure coding practices
Audience Developers
Więcej...

Microsoft SDL Core

14 godzin
The Combined SDL core training gives an insight into secure software design, development and testing through Microsoft Secure Development Lifecycle (SDL). It provides a level 100 overview of the fundamental building blocks of SDL, followed by design techniques to apply to detect and fix flaws in early stages of the development process. Dealing with the development phase, the course gives an overview of the typical security relevant programming bugs of both managed and native code. Attack methods are presented for the discussed vulnerabilities along with the associated mitigation techniques, all explained through a number of hands-on exercises providing live hacking fun for the participants. Introduction of different security testing methods is followed by demonstrating the effectiveness of various testing tools. Participants can understand the operation of these tools through a number of practical exercises by applying the tools to the already discussed vulnerable code. Participants attending this course will 
  • Understand basic concepts of security, IT security and secure coding
  • Get known to the essential steps of Microsoft Secure Development Lifecycle
  • Learn secure design and development practices
  • Learn about secure implementation principles
  • Understand security testing methodology
  • Get sources and further readings on secure coding practices
Audience Developers, Managers
Więcej...

Security Testing

14 godzin
After getting familiar with the vulnerabilities and the attack methods, participants learn about the general approach and the methodology for security testing, and the techniques that can be applied to reveal specific vulnerabilities. Security testing should start with information gathering about the system (ToC, i.e. Target of Evaluation), then a thorough threat modeling should reveal and rate all threats, arriving to the most appropriate risk analysis-driven test plan. Security evaluations can happen at various steps of the SDLC, and so we discuss design review, code review, reconnaissance and information gathering about the system, testing the implementation and the testing and hardening the environment for secure deployment. Many security testing techniques are introduced in details, like taint analysis and heuristics-based code review, static code analysis, dynamic web vulnerability testing or fuzzing. Various types of tools are introduced that can be applied in order to automate security evaluation of software products, which is also supported by a number of exercises, where we execute these tools to analyze the already discussed vulnerable code. Many real life case studies support better understanding of various vulnerabilities. This course prepares testers and QA staff to adequately plan and precisely execute security tests, select and use the most appropriate tools and techniques to find even hidden security flaws, and thus gives essential practical skills that can be applied on the next day working day. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Understand security testing approaches and methodologies
  • Get practical knowledge in using security testing techniques and tools
  • Get sources and further readings on secure coding practices
Audience Developers, Testers
Więcej...

Secure Web Application Development and Testing

21 godzin
Protecting applications that are accessible via the web requires well-prepared security professional who are at all time aware of current attack methods and trends. Plethora of technologies and environments exist that allow comfortable development of web applications. One should not only be aware of the security issues relevant to these platforms, but also of all general vulnerabilities that apply regardless of the used development tools. The course gives an overview of the applicable security solutions in web applications, with a special focus on understanding the most important cryptographic solutions to be applied. The various web application vulnerabilities are presented both on the server side (following the OWASP Top Ten) and the client side, demonstrated through the relevant attacks, and followed by the recommended coding techniques and mitigation methods to avoid the associated problems. The subject of secure coding is wrapped up by discussing some typical security-relevant programming mistakes in the domain of input validation, improper use of security features and code quality. Testing plays a very important role in ensuring security and robustness of web applications. Various approaches – from high level auditing through penetration testing to ethical hacking – can be applied to find vulnerabilities of different types. However, if you want to go beyond the easy-to-find low-hanging fruits, security testing should be well planned and properly executed. Remember: security testers should ideally find all bugs to protect a system, while for adversaries it is enough to find one exploitable vulnerability to penetrate into it. Practical exercises will help understanding web application vulnerabilities, programming mistakes and most importantly the mitigation techniques, together with hands-on trials of various testing tools from security scanners, through sniffers, proxy servers, fuzzing tools to static source code analyzers, this course gives the essential practical skills that can be applied on the next day at the workplace. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Have a practical understanding of cryptography
  • Understand security testing approaches and methodologies
  • Get practical knowledge in using security testing techniques and tools
  • Be informed about recent vulnerabilities in various platforms, frameworks and libraries
  • Get sources and further readings on secure coding practices
Audience Developers, Testers
Więcej...

Web Application Security

14 godzin
Protecting applications that are accessible via the web requires well-prepared security professional who are at all time aware of current attack methods and trends. Plethora of technologies and environments exist that allow comfortable development of web applications (like Java, ASP.NET or PHP, as well as Javascript or Ajax on the client side). One should not only be aware of the security issues relevant to these platforms, but also of all general vulnerabilities that apply regardless of the used development tools. The course gives an overview of the applicable security solutions in web applications, focusing on the most important technologies like secure communication and web services, tackling both transport-layer security and end-to-end security solutions and standards like Web Services Security and XML. It also gives a brief overview of the typical programming mistakes, above all connected to missing or improper input validation. The web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained to avoid the associated problems. Exercises can be easily followed by programmers using different programming languages, thus the web application-related topics can be easily combined with other secure coding subjects, and can thus effectively satisfy the needs of corporate development groups, who typically deal with various languages and development platforms to develop web applications. Participants attending this course will
  • Understand basic concepts of security, IT security and secure coding
  • Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
  • Learn client-side vulnerabilities and secure coding practices
  • Have a practical understanding of cryptography
  • Understand security concepts of Web services
  • Get practical knowledge in using security testing tools
  • Get sources and further readings on secure coding practices
Audience Developers
Więcej...

DevOps Security: Creating a DevOps Security Strategy

7 godzin
DevOps is a software development approach that aligns application development with IT operations. Some of the tools that have emerged to support DevOps include: automation tools, containerization and orchestration platforms. Security has not kept up with these developments. In this instructor-led, live course, participants will learn how to formulate the proper security strategy to face the DevOps security challenge. Format of the course
  • Interactive lecture and discussion.
  • Lots of exercises and practice.
  • Hands-on implementation in a live-lab environment.
Course Customization Options
  • To request a customized training for this course, please contact us to arrange.
Więcej...

Embedded Systems Security

21 godzin
Opis
To prowadzone przez instruktora szkolenie na żywo przedstawia architekturę systemu, systemy operacyjne, kwestie związane z siecią, pamięcią masową i kryptografią, które należy wziąć pod uwagę przy projektowaniu bezpiecznych systemów wbudowanych. Pod koniec tego kursu uczestnicy będą dobrze rozumieć zasady, obawy i technologie bezpieczeństwa. Co ważniejsze, uczestnicy zostaną wyposażeni w techniki potrzebne do tworzenia bezpiecznego oprogramowania wbudowanego. Formuła kursu
Interaktywny wykład i dyskusja.
Dużo ćwiczeń i ćwiczeń.
Praktyczne wdrożenie w środowisku live-lab.

Język szkolenia
Polski
Więcej...

Interactive Application Security Testing (IAST)

14 godzin
Interactive Application Security Testing (IAST) is a form of application security testing that combines Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) or Runtime Application Self-protection (RASP) techniques. IAST is able to report the specific lines of code responsible for a security exploit and replay the behaviors leading to and following such an exploit. In this instructor-led, live training, participants will learn how to secure an application by instrumenting runtime agents and attack inducers to simulate application behavior during an attack.   By the end of this training, participants will be able to:
  • Simulate attacks against applications and validate their detection and protection capabilities
  • Use RASP and DAST to gain code-level visibility into the data path taken by an application under different runtime scenarios
  • Quickly and accurately fix the application code responsible for detected vulnerabilities
  • Prioritize the vulnerability findings from dynamic scans
  • Use RASP real-time alerts to protect applications in production against attacks.
  • Reduce application vulnerability risks while maintaining production schedule targets
  • Devise an integrated strategy for overall vulnerability detection and protection
Audience
  • DevOps engineers
  • Security engineers
  • Developers
Format of the course
  • Part lecture, part discussion, exercises and heavy hands-on practice
Więcej...

How to Write Secure Code

35 godzin
After the major attacks against national infrastructures, Security Professionals found that the majority of the vulnerabilities that caused the attacks came from poor and vulnerable code that the developers write.  Developers now need to master the techniques of how to write Secure Code, because we are in a situation where anyone can use availble tools to write a script that can effectivly disable a large organization's systems because the developers have written poor code. This Course aims to help in the following:
  1. Help Developers to master the techniques of writing Secure Code
  2. Help Software Testers to test the security of the application before publishing to the production environment
  3. Help Software Architects to understand the risks surrounding the applications
  4. Help Team Leaders to set the security base lines for the developers
  5. Help Web Masters to configure the Servers to avoid miss-configurations
In this course you will also see details of the latest cyber attacks that have been used and the countermeasures used to stop and prevent these attacks. You will see for yourself how developers mistakes led to catastrophic attacks, and by participatig in the labs during the course you will be able to put into practise the security controls and gain the experience and knowledge to produce secure coding. Who should Attend this Course?  This Secure Code Training is ideal for those working in positions such as, but not limited to:
  • Web Developers
  • Mobile Developers
  • Java Developers
  • Dot Net Developers
  • Software Architects
  • Software Tester
  • Security Professionals
  • Web Masters
Więcej...

Secure Developer Java (Inc OWASP)

21 godzin
This course covers the secure coding concepts and principals with Java through Open Web Application Security Project (OWASP) methodology of testing. The Open Web Application Security Project is an online community which creates freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security.
Więcej...

Secure Developer .NET (Inc OWASP)

21 godzin
This course covers the secure coding concepts and principals with ASP.net through the Open Web Application Security Project (OWASP) methodology of testing , OWASP is an online community which creates freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security.  This Course explores the Dot Net Framework Security features and how to secure web applications.   
    
    
    
    
    
Więcej...

Last Updated:

Opinie uczestników (37)

Lot's of information explained very well. Good examples, interesting exercises. Trainer showed us his real world experience.

Gergely Bathó - GE Medical Systems Polska Sp. Z O.O.
Szkolenie - Application Security for Developers

The Burpe suite i need more training in this

Gontse Ntshegi - Vodacom
Szkolenie - Android Security

Nothing it was perfect.

Zola Madolo - Vodacom
Szkolenie - Android Security

Azure web security, to było bardziej to, czego oczekiwałem, testy penetracyjne, których nigdy bym nie przeprowadził w mojej pracy

Toby
Szkolenie - Application Security in the Cloud

Przetłumaczone przez sztuczną inteligencję

Informacje o cold boot attack i omówienie sposobów zabezpieczenia przed tym atakiem.

Marcin Piliszczuk - Diebold Nixdorf
Szkolenie - Application Security in the Cloud

the balance between lectures and practice, the rhythm, the trainer knowledge and pedagogic skill

Armando Pinto - EID
Szkolenie - C/C++ Secure Coding

The trainer provided up-to-date information and valuable references and tools.

Jose Vicente - EID
Szkolenie - C/C++ Secure Coding

to get a lot of good info about the course subject

Paulo Pereira - EID
Szkolenie - C/C++ Secure Coding

The coach solid knowledge and the experience, nice slides, good examples.

Celso Almeida - EID
Szkolenie - C/C++ Secure Coding

Pushowanie zmian na bieżąco, jak w 3 dzień zaczęłam się już gubić bardziej niż wcześniej i było ciężej wyłapać błąd na szybko to na szybko byłam w stanie zcheckoutować się na najnowszą zmiane i być na bieżąco z materiałem

Paulina
Szkolenie - Advanced Java Security

It opens up a lot and gives lots of insight what security

Nolbabalo Tshotsho - Vodacom SA
Szkolenie - Advanced Java Security

Very good knowledge and character.

Constantinos Michael
Szkolenie - Java and Web Application Security

The organization

Panagiotis Foutros
Szkolenie - Java and Web Application Security

Bardzo dobrze jest zrozumieć, w jaki sposób haker mógłby potencjalnie analizować witryny pod kątem słabości i narzędzi, które mógłby wykorzystać.

Roger - OTT Mobile
Szkolenie - .NET, C# and ASP.NET Security Development

Przetłumaczone przez sztuczną inteligencję

the corny jokes. Love the first 2 day session because of the labs.

Kevin Galacgac - Human Edge Software Philippines, Inc.
Szkolenie - .NET, C# and ASP.NET Security Development

The trainer is really connecting with us and making sure that nobody left out of the current topic. Explains well to each topic and provides an example that is easy to understand.

Edgarico Llaneta - Human Edge Software Philippines, Inc.
Szkolenie - .NET, C# and ASP.NET Security Development

The hands-on training and the examples.

Lord-Sam Lamparero - Human Edge Software Philippines, Inc.
Szkolenie - .NET, C# and ASP.NET Security Development

The exercises (SQL injection, XSS, CRSF...)

David Lemoine - Statistical Solutions
Szkolenie - .NET, C# and ASP.NET Security Development

Beginning by how to hack to better understand how to secure was very interesting and appreciated.

Raphaël Capocasale - Mikron SA Boudry
Szkolenie - Advanced C#, ASP.NET and Web Application Security

The explanations of how the most common attacks happen against web applications.

Jacob Fisher - Mikron SA Boudry
Szkolenie - Advanced C#, ASP.NET and Web Application Security

The learning material

morena xaba - Vodacom
Szkolenie - The Secure Coding Landscape

The real life examples.

Marios Prokopiou
Szkolenie - Secure coding in PHP

All topics were well covered and presented with a lot of examples. Ahmed was very efficient and managed to keep us focused and attracted at all times.

Kostas Bastas
Szkolenie - Secure coding in PHP

Trainer willing to answer questions and give bunch of examples for us to learn.

Eldrick Ricamara - Human Edge Software Philippines, Inc. (part of Tribal Group)
Szkolenie - Security Testing

Nauka korzystania z nowych narzędzi. Głównie zobaczenie, jak można przeprowadzić testy bezpieczeństwa

Jason - Kropman
Szkolenie - Secure Web Application Development and Testing

Przetłumaczone przez sztuczną inteligencję

El profesor explica muy bien, tiene un buen conocimiento, ayuda a que siempre de ejemplos de lo que esta explicando para entender mas facil, va a un ritmo bien.

Yamir Aguilar - ATEB Servicios
Szkolenie - Secure Web Application Development and Testing

I liked he was passionate about the subject and very convincing too.

Diana Vladulescu
Szkolenie - Secure Web Application Development and Testing

Web 的同源策略和跨域的内容，以及XSS 的危害，這個很貼切我們的工作。

Princess Ou - 广东溢达纺织有限公司
Szkolenie - Web Application Security

Overview of most among important topics related to software architecture. This training inspired me to learn some of them in depth ;)

Konrad Fuchsig - EY GDS
Szkolenie - Web Application Security

Explanation of the concepts I had no knowledge about. Tutors calm and kind attitude and also his very vast knowledge.

Michał Kowalczyk - EY GDS
Szkolenie - Web Application Security

Practical examples and possibility to try how web injections are functioning from the other side - not user but attacker side.

Jessica Wierzbicka - EY GDS
Szkolenie - Web Application Security

The hands-on labs were excellent.

Dr. Farhan Hassan Khan - TDM GROUP
Szkolenie - Web Application Security

Duża liczba dodatkowych materiałów (książki, strony internetowe, podcasty), gdzie można szukać dodatkowych informacji

Mateusz Półrola - Mobica Limited Sp. z o.o. Oddział w Polsce
Szkolenie - Embedded Systems Security

Modele bezpieczeństwa, omówienie dobrych praktyk programistycznych, różne rodzaje ataków.

Piotr Piątek - EduBroker Sp. z o.o.
Szkolenie - Embedded Systems Security

Praktyka laboratoryjna

Angel - Vodacom
Szkolenie - How to Write Secure Code

Przetłumaczone przez sztuczną inteligencję

obserwowanie zagrożeń bezpieczeństwa w akcji

kesh - Vodacom
Szkolenie - How to Write Secure Code

Przetłumaczone przez sztuczną inteligencję

Sesja indywidualna z Raymondem była niesamowita, był naprawdę świetny i uważny na wszystkie moje potrzeby treningowe.

Joshua
Szkolenie - Secure Developer .NET (Inc OWASP)

Przetłumaczone przez sztuczną inteligencję

Pozostałe regiony w Polsce

Other Countries

These courses are also available in other countries

Konsultacje

Secure Code Konsultacje
Szkolenie Secure Code małopolskie, szkolenie wieczorowe Secure Code małopolskie, szkolenie weekendowe Secure Code małopolskie, Secure Code boot camp małopolskie, kurs zdalny Secure Code małopolskie, kurs online Secure Code małopolskie, nauczanie wirtualne Secure Code małopolskie, edukacja zdalna Secure Code małopolskie, lekcje Secure Code małopolskie, nauka przez internet Secure Code małopolskie, instruktor Secure Code małopolskie, Kursy Secure Code małopolskie, Kurs Secure Code małopolskie, Trener Secure Code małopolskie, wykładowca Secure Code małopolskie
1