Course Overview
An intensive four-day course designed for software engineers, architects, and security professionals seeking to embed security into every stage of software development. In this course you can explore the foundational and advanced principles of secure software design, from the classic Saltzer and Schroeder principles to real-world vulnerabilities and defensive coding strategies. Participants will dive deep into core concepts such as the CIA triad, risk analysis, secure coding practices, exception handling, input validation, and the critical role of configuration and hardening.
The course blends theory with practice through numerous labs and case studies, covering modern security challenges such as SQL injection, insecure deserialization or container hardening. Topics such as cryptography, access control, authentication, race conditions, and denial of service are addressed in detail, ensuring a comprehensive understanding of how to identify and mitigate risks in contemporary software systems. Whether you’re building web or desktop applications, monolithic apps or microservices, this course equips you with the skills to architect, develop, and maintain secure and resilient systems.
So that you are prepared for the forces of the dark side.
So that nothing unexpected happens.
Nothing.
Who should attend
Architects and developers
Prerequisites
General software design and development
Course Objectives
- Getting familiar with essential cyber security concepts
- Input validation approaches and principles
- Understanding security design principles
- Detailed analysis of the various mistakes and the best practices
- Going beyond the low hanging fruits
- Understanding how cryptography supports security
Course Content
- Cyber security basics
- Secure design principles of Saltzer and Schroeder
- Economy of mechanism
- Fail-safe defaults
- Complete mediation
- Open design
- Separation of privilege
- Least privilege
- Least common mechanism
- Psychological acceptability
- Work factor
- Compromise recording
- Secure coding beyond the high-level principles
- Wrap up