Duration
3 days
Overview
In this training, you will learn how to understand the DevSecOps Essentials and how to create secure code. We will start with the fundamental of application security and DevSecOps concepts, types of application attacks, input and output validation techniques and also how to securely code and how to increase the effectiveness of secure coding.
We will also cover how to gather security requirements and design secure application with secure architectures.
Your training will be conducted by one of our trainers over 3 days from 9 am to 5 pm each day. Training sessions will be comprised of both theory, demos and hands-on exercises that will touch upon the following subjects:
- Introduction to DevSecOps and Application Security.
- Secure SDLC and CI/CD pipelines
- Security requirements and Threat Modelling
- Threat Actors and Application attack surface.
- Secure Design - Input and Output validation techniques.
- Authentication attacks.
- Secure Design - Authentication defenses.
- Secure Design - Authorization Attacks and Defenses.
- Secure Design - Session management.
- Secure Design - Exception and error handling.
- Secure log handling.
- Secure code best practices.
- Increasing the effectiveness of secure coding.
Training Methodology
The training will be:
- Delivered in an enthusiastic and interesting way that will involve all the delegates.
- Whilst being consistent with the plan, the training will be flexible and responsive to the needs of the individual delegate group.
- Highly practical, structured and organized.
The training method follows this general pattern:
- The trainer gives a clear explanation of the point in question with specific examples.
- Then, the delegates practice by doing an exercise with each other.
- The delegates practice by doing exercises with the trainer.
- All points are supported with full written notes to take away.
- Delegates are asked to write down an associated action, for each point made. (At the end of the day, we have about twenty such actions, from which the delegates choose six which are the most personally meaningful).
Day 1
01 INTRODUCTION TO DEVSECOPS
- What is DevSecOps?
- DevSecOps Building Blocks- People, Process and Technology.
- DevSecOps Principles – Culture, Automation, Measurement and Sharing (CAMS)
- Benefits of DevSecOps – Speed, Reliability, Availability, Scalability, Automation, Cost and Visibility.
- What is Continuous Integration and Continuous Deployment?.
- Continuous Integration to Continuous Deployment to Continuous Delivery.
- Continuous Delivery vs Continuous Deployment.
- General workflow of CI/CD pipeline.
- Blue/Green deployment strategy
- Achieving full automation.
- Designing a CI/CD pipeline for a web application.
- Common Challenges faced when using DevOps principle.
- Case studies on DevOps of cutting edge technology at Facebook, Amazon, and Google
02 SECURE SDLC AND CI/CD PIPELINE
- What is Secure SDLC in DevSecOps
- Secure SDLC Activities and Security Gates
- Security Requirements ( Requirements)
- Threat Modelling (Design and Architecture)
- Static Analysis and Secure by Default ( Implementation)
- Dynamic Analysis(Testing)
- OS Hardening, Web/Application Hardening (Deploy)
- Security Monitoring/Compliance (Maintain)
- Security Requirement gathering
- Secure Design and Architecture
- Security Principles
- Introduction to Secure Coding
03 SECURITY REQUIREMENTS and THREAT MODELLING (TM)
- What is Threat Modelling?
- Threat Actors and Attacks.
- STRIDE vs DREAD approaches
- Threat modeling (Secure Design and architecture) and its challenges.
- Classical Threat modeling tools and how they fit in CI/CD pipeline
Day 2
04 APPLICATION LAYER ATTACKS
- SQL Injection
- OS/Command Injection
- Cross-Site Scripting
- Cross-Site Request Forgery (CSRF)
- Directory Traversal
- HTTP Response Splitting
- Parameter Manipulation
05 SECURE DESIGN - INPUT AND OUTPUT VALIDATION TECHNIQUES
- Character Encoding
- Input Validation
- Output Encoding
- Whitelisting & Blacklisting
- Normalization of the input and output
- Regular Expressions
- HTML Encoding
- Prepared Statements
- Stored Procedures
06 AUTHENTICATION ATTACKS
- Brute force attacks
- Weak password storage
- Default passwords
- Password reset
- Remember me
- Secret questions
- Account lockout
- Logout
07 SECURE DESIGN - AUTHENTICATION DEFENSES
- Strong Password policy
- Basic Authentication
- Form-Based Authentication
- CAPTCHA
08 SECURE DESIGN - AUTHORIZATION
- Role based access control
- Declarative access control
- Programmatic access control
- Role-based Access control
- Unvalidated redirects and forwards
Day 3
09 SECURE DESIGN - SESSION MANAGEMENT
- Weak session management
- Session hijacking
- Session fixation
- Client certificates
- Protecting Sessions
- Regeneration of Session tokens
- Session Timeouts
- Using SSL
10 SECURE DESIGN - EXCEPTION AND ERROR HANDLING
- Error Handling
- Exceptions
- Using try/catch/final
11 SECURE DESIGN - SECURE LOG HANDLING
- Logging
- Logging frameworks
- ESAPI logging
12 INCREASING EFFECTIVENESS OF SECURE CODING
- Introduction to secure code review
- Need for code review in SDLC
- Secure coding and Secure Code review.
- Manual code review and using a code review tool.
- Fixing the vulnerabilities found.
Programme scope, delivery arrangements and suitability are confirmed during enquiry.