Application Security Training in Christchurch

This instructor-led, live training in Christchurch (online or onsite) is aimed at intermediate-level to advanced-level developers who wish to understand and apply secure coding practices, identify security risks in software, and implement defenses against cyber threats.

By the end of this training, participants will be able to:

• Understand common security vulnerabilities in web and software applications.
• Analyse security threats and exploit techniques used by attackers.
• Implement secure coding practices to mitigate security risks.
• Use security testing tools to identify and fix vulnerabilities.

The EC-Council Certified DevSecOps Engineer (ECDE) is a practical course designed to equip professionals with the skills needed to embed security throughout the DevOps lifecycle, enabling secure software development from initial planning through to deployment.

This instructor-led, live training (available online or on-site) is tailored for intermediate-level software and DevOps professionals who aim to integrate security practices into CI/CD pipelines, ensuring secure and compliant code delivery.

By the conclusion of this training, participants will be able to:

• Grasp the core principles and practices of DevSecOps.
• Secure each stage of the CI/CD pipeline using automated tools.
• Implement secure coding standards and conduct vulnerability scanning.
• Prepare for the ECDE certification through hands-on labs and review sessions.

Course Format

• Interactive lectures and group discussions.
• Practical application of DevSecOps tools within simulated pipelines.
• Guided exercises focused on secure development and deployment.

Course Customisation Options

• To request a customised training session for this course based on your team's workflows or toolchain, please contact us to make arrangements.

Android is an open platform for mobile devices such as handsets and tablets. It offers a wide range of security features designed to simplify the development of secure software; however, it also lacks certain security aspects found in other handheld platforms. This course provides a comprehensive overview of these features and highlights the most critical shortcomings to be aware of, particularly those related to the underlying Linux system, the file system, and the broader environment, as well as the use of permissions and other Android software development components.

Typical security pitfalls and vulnerabilities are examined for both native code and Java applications, accompanied by recommendations and best practices to prevent and mitigate them. In many cases, the issues discussed are illustrated with real-world examples and case studies. Finally, the course offers a brief overview of how to use security testing tools to uncover programming bugs with security implications.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding
• Learn about the security solutions available on Android
• Gain proficiency in using various security features of the Android platform
• Acquire information on recent vulnerabilities affecting Java on Android
• Learn to identify typical coding mistakes and how to avoid them
• Develop an understanding of native code vulnerabilities on Android
• Recognise the serious consequences of insecure buffer handling in native code
• Understand architectural protection techniques and their inherent weaknesses
• Access sources and further reading materials on secure coding practices

Audience

Professionals

Today, a range of programming languages are available to compile code for the .NET and ASP.NET frameworks. While these environments offer powerful capabilities for developing secure applications, developers must understand how to apply architecture-level and coding-level techniques to implement the required security functions, avoid vulnerabilities, and limit their potential exploitation.

The aim of this course is to equip developers through numerous hands-on exercises with the skills to prevent untrusted code from executing privileged actions, protect resources via strong authentication and authorisation, implement remote procedure calls, manage sessions, explore various implementation approaches for specific functionality, and much more. A dedicated section is also included to address the configuration and hardening of the .NET and ASP.NET environment for enhanced security.

A brief introduction to the fundamentals of cryptography provides a shared practical foundation for understanding the purpose and operation of various algorithms. Building on this, the course explores the cryptographic features available in .NET. This is followed by an overview of recent cryptographic vulnerabilities, including those affecting specific algorithms and protocols, as well as side-channel attacks.

The discussion of various vulnerabilities begins with an examination of common programming issues encountered when working with .NET, covering categories such as input validation, error handling, and race conditions. Special attention is given to XML security, while the section on ASP.NET-specific vulnerabilities addresses unique challenges and attack methods, such as ViewState manipulation and string termination attacks.

Participants attending this course will

• Understand the fundamental concepts of security, IT security, and secure coding
• Learn to leverage the various security features of the .NET development environment
• Gain a practical understanding of cryptography
• Understand recent attacks targeting cryptosystems
• Receive information on recent vulnerabilities in .NET and ASP.NET
• Learn about typical coding mistakes and how to avoid them
• Acquire practical knowledge in using security testing tools
• Access resources and further reading materials on secure coding practices

Audience

Developers

Building a secure networked application can be challenging, even for developers who have previously worked with various cryptographic components such as encryption and digital signatures. To help participants grasp the role and application of these cryptographic primitives, the course first establishes a solid foundation covering the core requirements of secure communication—secure acknowledgment, integrity, confidentiality, remote identification, and anonymity. It also explores typical issues that can compromise these requirements, along with real-world solutions.

As cryptography is a critical pillar of network security, the course examines key algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. Rather than delving into complex mathematical theory, these topics are presented from a developer's perspective, featuring practical use cases and considerations such as the implementation of public key infrastructures. The course introduces security protocols across various domains of secure communication, with in-depth coverage of widely used protocol families like IPSEC and SSL/TLS.

Common cryptographic vulnerabilities are examined, including those affecting specific algorithms and protocols such as BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding Oracle, Lucky Thirteen, POODLE, and the RSA timing attack. For each vulnerability, practical implications and potential consequences are outlined, again avoiding deep mathematical detail.

Finally, as XML plays a central role in data exchange for networked applications, the course addresses XML security. This includes the use of XML in web services and SOAP messages, along with protective measures such as XML signature and XML encryption. It also highlights weaknesses in these protections and XML-specific security threats, including XML injection, XML External Entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Understand the requirements of secure communication
• Learn about network attacks and defenses at different OSI layers
• Have a practical understanding of cryptography
• Understand essential security protocols
• Understand some recent attacks against cryptosystems
• Get information about some recent related vulnerabilities
• Understand security concepts of Web services
• Get sources and further readings on secure coding practices

Audience

Developers, Professionals

This course delivers cross-platform secure coding expertise by integrating C/C++, Java, and web application security into a single, cohesive training programme. Participants gain a deep understanding of modern vulnerabilities, attack techniques, and secure development practices across diverse environments.

Delivered as an instructor-led, live session (either online or on-site), this course is designed for intermediate to advanced-level developers seeking to strengthen their secure coding capabilities for enterprise and web applications.

By the conclusion of this training, participants will be able to:

• Apply secure coding principles within C/C++ and Java development environments.
• Identify and mitigate common vulnerabilities such as buffer overflows, SQL injection, and cross-site scripting (XSS).
• Effectively implement and configure Java security services and APIs.
• Understand the OWASP Top Ten and beyond, including client-side security risks.
• Use cryptography securely for data protection and secure communications.
• Analyse code for architectural weaknesses and apply defensive coding strategies.
• Stay informed about the latest vulnerabilities affecting platforms, frameworks, and libraries.

Course Format

• Interactive lectures and group discussions.
• Hands-on secure coding labs and exploit demonstrations.
• Case studies and real-world vulnerability analysis.

Course Customisation Options

• To request a customised version of this training, please contact us to make arrangements.

Adopting the cloud transforms how applications are built, deployed, and operated—shifting responsibilities between vendor and customer while introducing cloud-native platforms (containers, serverless, managed services) that require tailored security controls. As a result, security must address infrastructure hardening, identity and access management, data protection, secure development practices, and cloud-specific threat vectors.

This instructor-led, live training (available online or on-site) is designed for intermediate-level developers, security engineers, and IT managers who wish to gain practical, hands-on skills to secure cloud applications and their supporting infrastructure. Participants will learn repeatable controls and assessment techniques aligned with current industry frameworks and cloud provider guidance.

By the end of this training, participants will be able to:

• Explain the cloud shared-responsibility model and apply it to application security decisions.
• Harden cloud infrastructure (IaaS), secure platform services (PaaS), and evaluate SaaS configurations.
• Apply secure coding and OWASP-based mitigation patterns to cloud-hosted applications.
• Integrate security tooling into CI/CD pipelines (SAST/DAST/IAST/RASP) and adopt shift-left practices.

Course Format

• Interactive lectures and discussions supported by live demonstrations.
• Hands-on labs using cloud consoles, containers, serverless functions, and CI/CD pipelines.
• Practical exercises covering secure configuration, vulnerability scanning, attack simulation, and remediation planning.

Course Customisation Options

• To request a customised training session for this course, please contact us to arrange.

This three-day course covers the fundamentals of securing C/C++ code against malicious users who may exploit numerous vulnerabilities, particularly those related to memory management and input handling. The course explores the principles of writing secure code.

Even seasoned Java developers do not fully master the diverse security services offered by Java, nor are they always aware of the various vulnerabilities pertinent to Java-based web applications.

Beyond introducing the security components of the Standard Java Edition, this course addresses security challenges in Java Enterprise Edition (JEE) and web services. Discussions of specific services are preceded by foundational concepts in cryptography and secure communication. A range of practical exercises explores both declarative and programmatic security techniques within JEE, while also covering transport-layer and end-to-end security for web services. All components are demonstrated through hands-on exercises, allowing participants to experiment with the discussed APIs and tools first-hand.

The course also examines and explains the most common and severe programming flaws inherent to the Java language and platform, as well as web-related vulnerabilities. In addition to typical errors made by Java developers, the security issues covered include both language-specific concerns and those arising from the runtime environment. All vulnerabilities and associated attacks are illustrated through clear, easy-to-follow exercises, followed by recommended coding guidelines and potential mitigation strategies.

Participants attending this course will

• Understand the fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to prevent them
• Grasp the security concepts underlying web services
• Gain proficiency in using various security features within the Java development environment
• Develop a practical understanding of cryptography
• Understand the security solutions provided by Java EE
• Identify common coding mistakes and learn how to avoid them
• Access information on recent vulnerabilities in the Java framework
• Acquire hands-on experience with security testing tools
• Obtain resources and further reading materials on secure coding practices

Audience

Developers

Even experienced programmers do not necessarily master all the security features offered by their development platforms, nor are they always aware of the various vulnerabilities relevant to their work. This course is designed for developers working with both Java and PHP, equipping them with essential skills to make their applications resilient against modern Internet-based attacks.

The course explores the layers of the Java security architecture, covering access control, authentication, authorisation, secure communication, and a range of cryptographic functions. It also introduces various APIs that can be used to secure PHP code, such as OpenSSL for cryptography and HTML Purifier for input validation. On the server side, best practices are provided for hardening and configuring the operating system, web container, file system, SQL server, and PHP itself. Special emphasis is placed on client-side security, addressing security issues related to JavaScript, Ajax, and HTML5.

General web vulnerabilities are examined through examples aligned with the OWASP Top Ten, illustrating various injection attacks, script injections, session handling attacks, insecure direct object references, file upload issues, and more. The course also covers language-specific problems and runtime environment issues in both Java and PHP, grouped into standard vulnerability categories such as missing or improper input validation, incorrect use of security features, flawed error and exception handling, time- and state-related problems, code quality issues, and mobile code-related vulnerabilities.

Participants will have the opportunity to experiment with the discussed APIs, tools, and configuration effects firsthand. Each vulnerability introduction is supported by hands-on exercises that demonstrate the consequences of successful attacks, guide learners on how to fix the bugs, apply mitigation techniques, and make use of various extensions and tools.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to avoid them
• Gain knowledge of client-side vulnerabilities and secure coding practices
• Learn how to utilise various security features within the Java development environment
• Develop a practical understanding of cryptography
• Learn how to apply various security features in PHP
• Understand security concepts related to web services
• Gain practical experience using security testing tools
• Learn about common coding mistakes and how to avoid them
• Stay informed about recent vulnerabilities in Java and PHP frameworks and libraries
• Access resources and further reading materials on secure coding practices

Audience

Developers

Description

The Java language and the Runtime Environment (JRE) were designed to be free from the most problematic common security vulnerabilities seen in other languages, such as C/C++. However, software developers and architects should not only understand how to leverage the various security features of the Java environment (positive security) but also remain aware of the numerous vulnerabilities that still affect Java development (negative security).

The introduction to security services is preceded by a concise overview of the foundations of cryptography, establishing a common baseline for understanding the purpose and operation of relevant components. These components are explored through a series of practical exercises, allowing participants to experiment with the discussed APIs firsthand.

The course also examines and explains the most frequent and serious programming flaws in the Java language and platform, covering both typical mistakes made by Java developers and issues specific to the language and its environment. All vulnerabilities and associated attacks are demonstrated through easy-to-understand exercises, followed by recommended coding guidelines and possible mitigation techniques.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to avoid them
• Learn to utilise various security features of the Java development environment
• Gain a practical understanding of cryptography
• Learn about typical coding mistakes and how to prevent them
• Receive information on recent vulnerabilities in the Java framework
• Access resources and further reading on secure coding practices

Audience

Developers

Description

Beyond a solid grasp of Java components, even seasoned Java developers must possess in-depth knowledge of web-related vulnerabilities on both the server and client sides. This includes understanding the various vulnerabilities specific to Java-based web applications and the potential consequences of associated risks.

General web-based vulnerabilities are illustrated through relevant attack scenarios, while recommended coding techniques and mitigation strategies are explained within the context of Java. The primary aim is to help developers avoid these pitfalls. Additionally, special emphasis is placed on client-side security, addressing key issues related to JavaScript, Ajax, and HTML5.

The course introduces the security components of Standard Java Edition, preceded by foundational concepts in cryptography. This provides a common baseline for understanding the purpose and operation of the relevant components. Each component is explored through practical exercises, allowing participants to test the discussed APIs and tools firsthand.

Finally, the course examines the most frequent and serious programming flaws inherent to the Java language and platform. Beyond typical coding mistakes made by Java developers, the covered security vulnerabilities span both language-specific issues and problems arising from the runtime environment. All vulnerabilities and corresponding attacks are demonstrated through clear, easy-to-follow exercises, followed by recommended coding guidelines and practical mitigation techniques.

Participants attending this course will

• Understand the fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to prevent them
• Gain knowledge of client-side vulnerabilities and secure coding practices
• Learn to leverage various security features within the Java development environment
• Develop a practical understanding of cryptography
• Identify common coding errors and learn how to avoid them
• Receive up-to-date information on recent vulnerabilities in the Java framework
• Acquire hands-on experience with security testing tools
• Access resources and further reading materials on secure coding practices

Audience

Developers

Participants attending this course in Christchurch will

• Understand fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to avoid them
• Gain knowledge of client-side vulnerabilities and secure coding practices
• Learn to utilise various security features of the Java development environment
• Develop a practical understanding of cryptography
• Understand security concepts pertaining to web services
• Understand security solutions within Java EE
• Learn about common coding mistakes and how to avoid them
• Gain insight into recent vulnerabilities within the Java framework
• Acquire practical knowledge of security testing tools
• Access resources and further reading on secure coding practices

As a developer, your responsibility is to write bulletproof code.

But what if, despite all your efforts, the code you've been writing throughout your career is riddled with vulnerabilities you never knew existed? What if, while you're reading this, hackers are actively attempting to breach your code? How likely are they to succeed? What if they could steal your database and sell it on the black market?

This Web application security course will transform the way you view code. Through hands-on training, we'll teach you all the techniques attackers use and how to defend against them, leaving you with nothing but a desire to learn more.

It's your choice to stay ahead of the pack and be recognised as a game-changer in the fight against cybercrime.

Delegates attending will:

• Understand the fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to prevent them
• Explore client-side vulnerabilities and adopt secure coding practices
• Gain knowledge of Node.js security
• Understand MongoDB security
• Develop a practical understanding of cryptography
• Grasp essential security protocols
• Comprehend the security concepts of web services
• Learn about JSON security
• Acquire practical knowledge of security testing techniques and tools
• Learn how to address vulnerabilities in the platforms, frameworks, and libraries you use
• Access resources and further reading on secure coding practices

Today, numerous programming languages are available to compile code for the .NET and ASP.NET frameworks. While this environment offers powerful capabilities for security development, developers must understand how to apply architecture- and code-level programming techniques to implement the desired security functionality, avoid vulnerabilities, and limit their exploitation.

This course aims to equip developers through extensive hands-on exercises with the skills to prevent untrusted code from performing privileged actions, protect resources through robust authentication and authorisation, manage remote procedure calls, handle sessions, implement various solutions for specific functionality, and much more.

The introduction to different vulnerabilities begins by examining typical programming issues encountered when using .NET, while the discussion of ASP.NET vulnerabilities also covers various environment configurations and their impacts. Finally, the topic of ASP.NET-specific vulnerabilities addresses not only general web application security challenges but also specialised issues and attack methods, such as attacking ViewState or string termination attacks.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to avoid them
• Learn to utilise various security features within the .NET development environment
• Gain practical knowledge in using security testing tools
• Learn about common coding mistakes and how to prevent them
• Receive information on recent vulnerabilities in .NET and ASP.NET
• Access resources and further readings on secure coding practices

Audience

Developers

Beyond a solid grasp of the various security features within .NET and ASP.NET, even experienced developers must possess a deep understanding of web-related vulnerabilities on both the server and client sides, along with the implications of these risks.

This course demonstrates common web-based vulnerabilities through relevant attack scenarios, while explaining recommended coding techniques and mitigation strategies within the context of ASP.NET. Special emphasis is placed on client-side security, addressing security concerns related to JavaScript, Ajax, and HTML5.

The course also covers the security architecture and components of the .NET framework, including code-based and role-based access control, permission declaration and verification mechanisms, and the transparency model. A concise introduction to the fundamentals of cryptography establishes a practical foundation for understanding the purpose and operation of various algorithms, upon which the course builds to present the cryptographic features available in .NET.

Different security bugs are introduced following established vulnerability categories, addressing input validation, security features, error handling, time- and state-related issues, general code quality concerns, and a dedicated section on ASP.NET-specific vulnerabilities. These topics conclude with an overview of testing tools that can automatically uncover some of the vulnerabilities discussed.

Topics are delivered through practical exercises, allowing participants to experience the consequences of specific vulnerabilities, test mitigation approaches, and explore the discussed APIs and tools first-hand.

Participants attending this course will

• Understand the fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to avoid them
• Gain knowledge of client-side vulnerabilities and secure coding practices
• Learn to utilise various security features of the .NET development environment
• Develop a practical understanding of cryptography
• Gain insight into recent vulnerabilities affecting .NET and ASP.NET
• Acquire hands-on experience with security testing tools
• Learn about common coding mistakes and how to avoid them
• Access resources and further reading on secure coding practices

Audience

Developers

This course introduces key security concepts, provides an overview of the nature of vulnerabilities irrespective of programming languages or platforms, and explains how to manage software security risks across the various phases of the software development lifecycle. While not delving deeply into technical specifics, it highlights some of the most compelling and pressing vulnerabilities across diverse software development technologies, outlines the challenges of security testing, and presents practical techniques and tools for identifying existing issues in code.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding
• Gain insight into web vulnerabilities on both server and client sides
• Recognise the serious consequences of insecure buffer handling
• Be informed about recent vulnerabilities affecting development environments and frameworks
• Learn about common coding mistakes and how to avoid them
• Understand security testing approaches and methodologies

Audience

Managers

This course equips PHP developers with essential skills to build applications resilient against modern internet-based attacks. Web vulnerabilities are explored through PHP-focused examples that extend beyond the OWASP Top Ten, covering a range of injection attacks, script injections, session handling exploits in PHP, insecure direct object references, file upload issues, and more. PHP-specific vulnerabilities are introduced and categorised under standard vulnerability types such as missing or improper input validation, incorrect error and exception handling, misuse of security features, and time- and state-related issues. For the latter, we examine attacks like open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. In each scenario, participants will become familiar with the most critical techniques and functions needed to mitigate these risks.

Special attention is given to client-side security, addressing security concerns related to JavaScript, Ajax, and HTML5. A variety of PHP security-related extensions are introduced, including hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening are presented in the context of PHP configuration (setting php.ini), Apache, and server-level settings. Finally, an overview is provided of various security testing tools and techniques available to developers and testers, including security scanners, penetration testing frameworks, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.

Both the introduction of vulnerabilities and the configuration practices are reinforced through numerous hands-on exercises. These demonstrate the real-world impact of successful attacks, illustrate how to apply mitigation techniques, and introduce the use of various extensions and tools.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to prevent them
• Gain knowledge of client-side vulnerabilities and secure coding practices
• Develop a practical understanding of cryptography
• Learn how to utilise various PHP security features
• Identify typical coding mistakes and learn how to avoid them
• Stay informed about recent vulnerabilities in the PHP framework
• Gain hands-on experience with security testing tools
• Access resources and further reading materials on secure coding practices

Audience

Developers

The Combined SDL core training offers insight into secure software design, development and testing through the Microsoft Secure Development Lifecycle (SDL). It provides a Level 100 overview of the fundamental building blocks of SDL, followed by design techniques to detect and rectify flaws in the early stages of the development process.

Focusing on the development phase, the course gives an overview of typical security-relevant programming bugs in both managed and native code. Attack methods are presented for the discussed vulnerabilities, along with associated mitigation techniques, all explained through a series of hands-on exercises that provide live hacking experiences for participants. An introduction to different security testing methods is followed by demonstrations of the effectiveness of various testing tools. Participants can understand how these tools operate through practical exercises, applying them to the vulnerable code previously discussed.

Participants attending this course will

Understand basic concepts of security, IT security and secure coding

Become familiar with the essential steps of the Microsoft Secure Development Lifecycle

Learn secure design and development practices

Learn about secure implementation principles

Understand security testing methodology

• Gain access to sources and further reading on secure coding practices

Audience

Developers, Managers

Having become familiar with vulnerabilities and attack methods, participants will explore the general approach and methodology for security testing, along with techniques designed to uncover specific vulnerabilities. Security testing begins with gathering information about the system (the Target of Evaluation, or ToC), followed by a comprehensive threat modelling exercise to identify and prioritise all potential threats, ultimately leading to a risk analysis-driven test plan that is both appropriate and effective.

Security evaluations can be conducted at various stages of the Software Development Life Cycle (SDLC). Accordingly, this course covers design reviews, code reviews, reconnaissance and information gathering, testing of implementations, and the testing and hardening of environments for secure deployment. A range of security testing techniques are explored in detail, including taint analysis, heuristic-based code review, static code analysis, dynamic web vulnerability testing, and fuzzing. Participants will also be introduced to a variety of tools that can automate the security evaluation of software products. These tools are reinforced through hands-on exercises where participants apply them to analyse previously discussed vulnerable code. Numerous real-world case studies further enhance understanding of different types of vulnerabilities.

This course equips testers and QA staff with the practical skills needed to plan and execute security tests effectively, select and apply the most suitable tools and techniques to uncover even the most elusive security flaws, and immediately apply these skills in their day-to-day work.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to prevent them
• Gain knowledge of client-side vulnerabilities and secure coding practices
• Understand security testing approaches and methodologies
• Acquire practical expertise in using security testing techniques and tools
• Access resources and further reading materials on secure coding practices

Audience

Developers, Testers

Safeguarding web-accessible applications demands security professionals who are thoroughly prepared and constantly attuned to the latest attack methods and emerging trends. A wide array of technologies and environments now enables comfortable development of web applications. It is essential not only to understand the security issues specific to these platforms but also to recognise the general vulnerabilities that apply regardless of the development tools used.

This course provides an overview of applicable security solutions for web applications, with particular emphasis on understanding the most critical cryptographic measures to implement. Web application vulnerabilities are examined on both the server side (aligned with the OWASP Top Ten) and the client side, illustrated through relevant attack scenarios, followed by recommended coding practices and mitigation strategies to prevent associated risks. The topic of secure coding is concluded by exploring common security-related programming errors in areas such as input validation, improper use of security features, and code quality.

Testing plays a vital role in ensuring the security and resilience of web applications. Various approaches—from high-level auditing and penetration testing to ethical hacking—can be employed to uncover different types of vulnerabilities. However, if you aim to go beyond the easily discoverable low-hanging fruit, security testing must be meticulously planned and competently executed. Remember: security testers ideally need to identify all bugs to protect a system, whereas adversaries only require finding one exploitable vulnerability to breach it.

Practical exercises will deepen your understanding of web application vulnerabilities, programming mistakes, and, most importantly, mitigation techniques. Through hands-on trials with a range of testing tools—from security scanners and sniffers to proxy servers, fuzzing utilities, and static source code analyzers—this course delivers essential practical skills that can be applied immediately in the workplace.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to avoid them
• Gain knowledge of client-side vulnerabilities and secure coding practices
• Develop a practical understanding of cryptography
• Understand security testing approaches and methodologies
• Acquire practical knowledge of using security testing techniques and tools
• Be informed about recent vulnerabilities across various platforms, frameworks, and libraries
• Access resources and further readings on secure coding practices

Audience

Developers, Testers

Web Application Security is the discipline of safeguarding online applications against modern security threats and vulnerabilities, including those that are platform-agnostic and impact core application architecture and input handling.

This instructor-led, live training (available online or on-site) is designed for intermediate-level developers who wish to understand and apply secure coding techniques to mitigate web vulnerabilities and implement robust web application security.

By the conclusion of this training, participants will be able to:

• Understand fundamental concepts of security, IT security, and secure coding.
• Learn about web vulnerabilities beyond the OWASP Top Ten and know how to prevent them.
• Gain knowledge of client-side vulnerabilities and secure coding practices.
• Develop a practical understanding of cryptography.
• Understand the security concepts underpinning web services.
• Acquire hands-on experience with security testing tools.
• Access sources and further readings on secure coding practices.

Course Format

• Interactive lectures and discussions.
• Abundant exercises and practice opportunities.
• Hands-on implementation in a live-lab environment.

Course Customisation Options

• To request a customised training session for this course, please contact us to arrange.

In this instructor-led, live course in Christchurch, participants will learn how to formulate the appropriate security strategy to address the DevOps security challenge.

This instructor-led, live training (available online or on-site) is designed for developers, engineers, and architects who want to secure their web applications and services.

By the end of this training, participants will be able to integrate, test, protect, and analyse their web applications and services using the OWASP testing framework and tools.

This course in Christchurch aims to support the following: 

1. Help developers master secure coding techniques
2. Assist software testers in evaluating application security before deployment to the production environment
3. Enable software architects to understand the risks associated with applications
4. Support team leaders in establishing security baselines for developers
5. Aid web administrators in configuring servers to prevent misconfigurations

This course covers secure coding concepts and principles in Java through the Open Web Application Security Project (OWASP) methodology of testing. The Open Web Application Security Project is an online community that produces freely available articles, methodologies, documentation, tools, and technologies in the field of web application security.

This course covers secure coding concepts and principles using ASP.NET through the Open Web Application Security Project (OWASP) testing methodology. OWASP is an online community that produces freely available articles, methodologies, documentation, tools, and technologies in the field of web application security.

This course explores the .NET Framework security features and how to secure web applications.

Description:

This course will provide participants with a comprehensive understanding of security concepts, web application concepts, and the frameworks used by developers to both exploit and protect targeted applications. In today's rapidly evolving world, where technologies change at a fast pace, web applications are exposed to hacker attacks 24/7. To safeguard applications from external attackers, one must understand every component that makes up a web application—including frameworks, programming languages, and technologies used in development—and much more. The challenge lies in the fact that an attacker needs only one vulnerability to breach an application, whereas developers (or system administrators) must be aware of all possible exploits to prevent such incidents. Consequently, achieving a bulletproof, secure web application is extremely difficult, and in most cases, applications remain vulnerable to certain threats. These vulnerabilities are regularly exploited by cybercriminals and opportunistic hackers but can be minimised through effective planning, development practices, web application testing, and proper configuration.

Objectives:

To equip you with the skills and knowledge necessary to understand and identify potential exploits in live web applications, and to exploit identified vulnerabilities. By gaining insights through the identification and exploitation phases, you will be better positioned to protect web applications against similar attacks. Upon completion of this course, participants will be able to understand and identify the OWASP Top 10 vulnerabilities and incorporate this knowledge into their web application protection strategies.

Audience:

Developers, police and other law enforcement personnel, defence and military personnel, e-business security professionals, system administrators, professionals from banking, insurance and other sectors, government agencies, IT managers, CISOs, and CTOs.