*We know each team has their own needs and specifications. That is why we can modify the training outline per need.
Module 1: Secure coding mindset and lifecycle
- Principles for writing safer code least privilege, fail safe defaults, defense in depth
- Where security fits in requirements, design, coding, review, and deployment
- Typical weakness categories and how defects become exploits
Module 2: Application platforms at a glance web, Windows, mobile
- How web, desktop, and mobile differ in trust boundaries and data flow
- Platform specific risks cookies and sessions, file system and registry, device storage and permissions
- Starter checklists for building safely on each platform
Module 3: Client and data layer attack techniques
- Script injection in the browser XSS variants and prevention patterns
- Query tampering against data stores SQL injection and parameterization
- Cross site request forgery and how to enforce intent with tokens and same site settings
Module 4: Server side risks and resource abuse
- Service exhaustion patterns and ways to reduce DoS impact
- Memory safety and bounds issues buffer overflows and safer libraries
- Common server misconfigurations headers, error handling, and dependency risk
Module 5: Trust the input last validate, normalize, encode
- Input validation strategies allow lists, canonicalization, and type checks
- Output handling to stop injection output encoding and context awareness
- Data cleaning and safe parsing patterns
Module 6: Putting controls in place
- Enforcing identity and permissions authentication, authorization, session control
- Safeguarding data in motion and at rest TLS, key management, encryption basics
- Guarding against frequent threats rate limits, CSP, dependency updates, secure headers
Module 7: Building safer mobile apps
- Mobile specific exposures storage, logs, intents, clipboard, background tasks
- Secure app structure separation of concerns, secure IPC, least privilege
- Handling keys, tokens, and offline data on the device
Module 8: Standards, verification, and fit for release
- Using community guides OWASP cheat sheets, ASVS, MASVS as reference points
- Techniques to find issues static checks, dependency scanning, basic dynamic tests
- Simple acceptance criteria and a pre release security checklist
