CyberSecurity Trainer

Day 1 – Secure Coding Practices (Java / .NET / PHP) 1. Secure Coding Fundamentals • Secure coding principles and security-by-design • Common application security weaknesses • Input validation and output encoding • Authentication and authorization fundamentals • Secure error handling and logging • Secrets and sensitive-data handling 2. Secure Coding in Java • Java input validation and sanitization • Secure session and authentication handling • SQL injection prevention using parameterized queries • Secure file handling • Secure serialization and deserialization • Exception handling and secure logging 3. Secure Coding in .NET • .NET authentication and authorization patterns • Input validation and model validation • Parameterized queries and ORM security • Secure configuration and secrets management • Secure file and API handling • Exception handling and logging 4. Secure Coding in PHP • PHP input validation and sanitization • Prepared statements and database security • Session and authentication security • Secure file uploads • CSRF and XSS prevention • Secure configuration and secrets management Day 2 – SAST, DAST & Dependency Scanning 1. Application Security Testing Fundamentals • Application security testing lifecycle • Static vs dynamic security testing • Security testing within CI/CD • Vulnerability discovery and prioritization • False positives and false negatives • Security testing metrics 2. SAST – Static Application Security Testing • SAST architecture and workflow • Source-code vulnerability identification • Injection and authentication issues • Security rules and coding standards • Triaging SAST findings • Remediation and developer feedback 3. DAST – Dynamic Application Security Testing • DAST methodology • Web application attack-surface discovery • Authentication and session testing • Input and parameter testing • Common runtime vulnerabilities • DAST findings analysis and remediation 4. Dependency & Software Composition Security • Third-party dependency risks • Software Composition Analysis (SCA) • Known vulnerable dependencies • Version and patch management • Transitive dependency risks • SBOM fundamentals • Dependency scanning in CI/CD pipelines Day 3 – Prompt Engineering for Developers 1. Prompt Engineering Fundamentals • Large Language Model fundamentals • Prompt structure and components • System, user and developer instructions • Context and grounding • Prompt patterns for software engineering • Prompt quality and evaluation 2. Developer Productivity with AI • Code generation and code explanation • Debugging and troubleshooting with AI • Test-case generation • Documentation generation • Code refactoring and optimization • Secure code review using AI 3. Secure Prompt Engineering • Prompt injection awareness • Handling untrusted input • Context separation • Sensitive information protection • Safe use of proprietary source code • Output validation and verification 4. Practical Prompt Engineering Workshop • Build prompts for secure coding tasks • Generate and review application code • Improve prompts using iterative techniques • Compare weak and strong prompts • Validate AI-generated outputs • Developer-focused prompt library creation Day 4 – Copilot / GenAI App Development & Secure AI Tool Use 1. AI Coding Assistants & Copilot Concepts • AI coding assistant architecture • Developer workflows with Copilot / GenAI tools • Code completion and generation • AI-assisted debugging • AI-assisted testing and documentation • Human review of AI-generated code 2. Secure Use of AI Development Tools • Source-code confidentiality • Sensitive data and credential protection • Enterprise AI usage policies • Third-party AI tool risks • Data retention and privacy considerations • Secure developer workflows 3. GenAI Application Development • LLM application architecture • Model APIs and application integration • Prompt and context management • System prompts and application controls • Input/output validation • Authentication and authorization for AI applications 4. Hands-on GenAI Application Exercise • Build a simple GenAI-enabled application • Integrate an LLM API • Implement basic security controls • Identify AI application risks • Test prompt and application behavior • Secure and review the implementation Day 5 – Threat Modeling Workshop 1. Threat Modeling Fundamentals • Purpose and benefits of threat modeling • Threat modeling lifecycle • Asset identification • Trust boundaries • Data-flow diagrams • Attack-surface identification 2. Threat Identification & Analysis • Threat actors and attack scenarios • STRIDE methodology • Application and infrastructure threats • AI-specific threats • Abuse cases and misuse cases

Work arrangement
No