MOTTO
Producing secure code for applications is a key aspect of protecting GÉANT applications and systems. With the move towards multi-domain systems and services there is a greater emphasis on securing these multi-domain systems as well as ensuring secure deployment of them. The Secure Coding Training focuses on areas that affect the development and analysis of application's source code!
"Secure Coding Training 2024"
TOPICS:
- Continuous Integration / Continuous Development and Secure Development Life Cycle
- Continuous Integration / Continuous Development pipelines: cybersecurity top threats and best practices
- Secure Programming in Python – secure coding practices
- Secure Programming in Python – common vulnerabilities
- Overview of the SonarQube capabilities
- OWASP ASVS – reminder andcurrent status, incl. working in groups
- Write Hacker Proof Code – Malicious Code
- Write Hacker Proof Code – Files and Resources
ATTENDED BY:
17 INDIVIDUALS 9 NRENs
TOPICS:
- How to design Continuous Integration and Continuous Development pipelines (CI/CD) with respect to Secure Development Life Cycle paradigm
- Secure Programming in Python
- Introduction
- Python gotchas
- Secure coding practices
- Tools and conclusions
- Practical workshop
- Writing Hacker Proof Code - Files and Resources
- Writing Hacker Proof Code - Session Management
- HackMe Contest
ATTENDED BY:
12 INDIVIDUALS 6 NRENs
"OWASP ASVS as a source of security requirements"
TOPICS:
- OWASP ASVS as a source of security requirements
- Fuzz testing
- Introduction and basic concepts
- Overview of selected tools workshop introduction
- Workshop
- Writing Hacker Proof Code – Validation, Sanitization and Encoding
- Writing Hacker Proof Code – Data Protection
- Continuous Integration / Continuous Development and Secure Development Life Cycle
- Review of the current freely available tools for static source code review
- HackMe Contest
ATTENDED BY:
12 INDIVIDUALS 9 NRENs
"Securing multi-domain systems"
TOPICS:
- Popular attacks against Web applications workshop
- Continuous Integration / Continuous Development and Secure DevelopmentLife Cycle
- (ASVS based) Writing Hacker proof code – Authorization (Access control)
- (ASVS based) Writing Hacker proof code – Authentication
- (ASVS based) Writing Hacker proof code – Error handling and logging verification
- HackMe contest
ATTENDED BY:
16 INDIVIDUALS 9 NRENs
“High level of interest in most training topics”
"Scanning real source code and interpreting results is the most favored method of working directly with code"
"Producing Bullet-Proof Software for your Infrastructure"
TOPICS:
- OWASP Application Security Verification Standard v. 4.0
- Implementing the most recent authentication and authorization methods
- New or improved security tools for the developer teams
ATTENDED BY:
16 INDIVIDUALS 8 NRENs
“Best practices (development, testing, deployment, workflows and concepts on type of attacks and some known/recent threats”
"More knowledge about GEANT project training resources, better knowledge about the state of projects participants skills"
"Knowledge, which was the main reason why I decided to participate. The training does not make me an expert in security, but it will help me in the future when it comes to security related issues"
"Good concepts, info about best practices with tested examples. The subject is dense and the trainers made an effort to transmit these concepts in an easy and enjoyable way"
"Different this time and... it is happening!"
TOPICS:
Secure programming in JavaScript
JavaScript security issues
A crisis of Trust
Not hidden code
XSS vulnerability
Poor validation
Cryptless
Quality code
Weak types & poor code quality
Secure Code Training
Threat modeling
Continuous Integration and Secure Software Development Life Cycle
HTTP Security Headers
Modern secure authentication and authorization mechanisms
The most popular attacks against Web applications
API Security
ATTENDED BY:
20 INDIVIDUALS 10 NRENs