Training outline: Secure Software Development
We focus on practical delivery. No long and boring slide decks – expect hands‑on exercises, interaction and real case studies. The agenda can be fine‑tuned or customised to your needs.
Why application security matters
- Regulation, compliance and developer responsibilities
- Importance of building secure, trustworthy applications for users (real case studies and examples)
- How attackers think – and how it differs from developers
Finding and fixing vulnerabilities in real code
Real applications, around 50 different code examples and dozens of case studies.
Authorization
- Most common issues and how to spot them (BOLA, BFLA, BOPLA...)
- Examples of correct authorization implementations
- ABAC, RBAC – authorization as a regulatory requirement
- Automated tools for testing application security (DAST, vulnerability scanners)
- Case studies and analysis of real incidents
Logging & monitoring
- Common pitfalls (log injection, over‑logging...)
- How to log correctly and in line with regulations
- Types of logs – audit logs, application logs…
- Log management systems, SIEM, monitoring and alerting
- Case studies and analysis of real incidents
Dependencies & supply chain
- Most common vulnerabilities and how to detect them
- Package manager vulnerabilities and dependency integrity
- Automated tools for dependency and license scanning (SCA)
- Virtual patching, WAF and RASP tools
- Vulnerabilities related to technical debt
- Case studies and analysis of real incidents
Resource exhaustion
- Typical issues and how to uncover them
- Correct design and configuration of rate limiting
- Cloud service consumption and overuse of 3rd‑party resources
- Case studies and analysis of real incidents
Injection vulnerabilities
- Most common flaws and how to detect them (NoSQL, command, code, SQL...)
- Correct query parametrization, ORM usage, etc.
- Static analysis tools (SAST) and where they help
- Case studies and analysis of real incidents
Secure Software Development Lifecycle (S‑SDLC)
- How to set up team processes that support secure development
- Where to look for trusted information on security, CVEs and incidents
- Backups, incident response and disaster recovery
Security tooling
- SAST
- DAST
- SCA
- WAF, RASP
- SIEM
Secure "vibe coding" and AI usage in development
- How to use AI tools safely and configure them properly
- Risks associated with "vibe coding" tools
- Case studies and analysis of real incidents
Developers see us as peers because we have an engineering background ourselves – we're not just "trainers".
We are practitioners who have both built and secured real applications. Our trainings are practical and go deep.