So if you have the skills and can do it, ping me and I'll put you in touch with the company organising it
Day 1 – General security considerations:
- Introduction
o Basic Security Concepts
o Hacking Methodologies
o Techniques and Tools
o Logical and Technical Flaws
- Networks considerations
o Security elements (Firewall, VPN, IPS…) – pros/cons, considerations
- General infrastructures problems related to our market
o Routers
o Operating systems
- Main threats
o Information Gathering & Disclosure
o Forceful Browsing
o Buffer Overflow
o Denial of Service
o Cross Site Scripting & Scripts Injection
o Flow Bypassing
o Parameter Tampering and Field Manipulation
o SQL Injection
o DoS vs ADoS
o Client Side Implementation of Logic (JS/VBS/Extension)
Day 2 – Secure coding and testing for embedded (C/C++) systems:
- Input Validation and Output Sanitation
o Input Validation Methods
o Output Sanitation
- Errors and Exceptions Handling
o Exception Handling Overview
o Log Writing
o Error messages
o Handling Errors in the Web/Application Server Layer
- Event Logging
o Application Logs Overview
o What should and should not be logged?
o Alerts and Monitoring
- Information Disclosure Prevention
o Information Disclosure in the Application
o Protecting the Source Code from Disclosure
o User Authentication & Authorization
o User Authentication Mechanisms
- SSL Based Authentication
o Proper Session Usage
o Users and Password Policies
o Single Sign On Mechanisms
o Managing User Authorization
- Minimum Privilege Principle
- Risks and Mitigations in the Infrastructure Layer
o Known Vulnerabilities
o Insecure Deployment and Configuration
- Hardening System Services
- Virus, Worms and Trojan Horses
- Risks and Mitigations in the Communication Layer
- Eavesdropping
- Replay Attacks, MITM
- Flavors of DoS, DDoS
Day 3 – Secure coding and testing for Java:
- Fundamentals
- Denial of Service
- Confidential Information
- Injection and Inclusion
- Accessibility and Extensibility
- Input Validation
- Mutability
- Object Construction
- Serialization and Deserialization
- Access Control
- Data base considerations
