EC-Council Certified DevSecOps Engineer (ECDE) Training Course

Upon completing this training, participants will be capable of:

• Explaining application security and potential vulnerabilities
• Describing ABAP programming best practices and the handling of SY-SUBRC
• Understanding injection vulnerabilities
• Describing security testing tools
• Explaining ATC and CVA

Course Format

• Interactive lectures and discussions
• Extensive exercises and practical work
• Hands-on implementation in a live-lab environment

This course addresses the essential secure coding topics pertinent to a wide range of web application developers. It instructs students on the principles of secure programming by examining specific code snippets, identifying security vulnerabilities, and implementing corrective measures.

Participants will observe demonstrations of real-world attacks and learn effective prevention strategies, building confidence as they work to enhance their applications' security.

Duration: 3 days
Who Should Attend: Developers seeking to expand their expertise in secure coding.

Upon Completion
• Students will gain knowledge in:
• Web Application Security.
• Common Web Application Risks.
• Demo Web Application Penetration Testing.
• Data Validation.
• Authentication.
• Session Management.
• Secure SDLC.

The EC-Council’s CCISO Program has certified leading information security professionals around the world. A core group of high-level information security executives, the CCISO Advisory Board, contributed by forming the foundation of the program and outlining the content that would be covered by the exam, body of knowledge, and training. Some members of the Board contributed as authors, others as exam writers, others as quality assurance checks, and still others as trainers. Each segment of the program was developed with the aspiring CISO in mind and looks to transfer the knowledge of seasoned professionals to the next generation in the areas that are most critical in the development and maintenance of a successful information security program.

The Certified CISO (CCISO) program is the first of its kind training and certification program aimed at producing top-level information security executives. The CCISO does not focus solely on technical knowledge but on the application of information security management principles from an executive management point of view. The program was developed by sitting CISOs for current and aspiring CISOs.

The Certified Ethical Hacking (C|EH® v13 AI) program is a distinctive and specialized training initiative designed to equip you with comprehensive knowledge of ethical hacking. Through practical training, dedicated labs, assessments, mock engagement exercises, and a global hacking competition, you will gain the most sought-after skills necessary to excel in the cybersecurity sector.

This course is accredited by EC-Council and delivered by an authorized trainer using certified materials within an accredited training environment.

This is the official Certified Ethical Hacker training course designed to prepare participants for the Certified Ethical Hacker 312-50 Exam.

The CEH program explores a broad spectrum of subjects centered on the Tactics, Techniques, and Procedures (TTPs) essential for a tactical cybersecurity professional. By focusing on the entire kill-chain process, CEH addresses various stages, including foot printing and reconnaissance, scanning, gaining access, maintaining access, and erading detection. This five-phase ethical hacking methodology is applicable to diverse scenarios, encompassing traditional on-premises networks, cloud environments, hybrid setups, and IoT systems across different topologies and application landscapes. Students will master an array of tools and techniques throughout this evaluation process, while also understanding how malicious actors leverage these same TTPs to breach organizational defenses.

Android serves as an open platform for mobile devices, including smartphones and tablets. While it offers a wide array of security features designed to facilitate the development of secure software, it also lacks certain security aspects found in other handheld platforms. This course provides a comprehensive overview of these features and highlights critical shortcomings related to the underlying Linux system, the file system, and the general environment, as well as those associated with permissions and other Android software development components.

Common security pitfalls and vulnerabilities are explained for both native code and Java applications, accompanied by recommendations and best practices to prevent and mitigate these issues. The topics discussed are often supported by real-life examples and case studies. Finally, the course briefly covers how to utilize security testing tools to identify security-related programming bugs.

Participants attending this course will

• Understand the fundamental concepts of security, IT security, and secure coding
• Learn about security solutions on Android
• Learn to use various security features of the Android platform
• Gain information about recent Java vulnerabilities on Android
• Learn about typical coding mistakes and how to avoid them
• Understand native code vulnerabilities on Android
• Recognize the severe consequences of insecure buffer handling in native code
• Understand architectural protection techniques and their weaknesses
• Access sources and further readings on secure coding practices

Audience

Professionals

Developing a secure networked application is challenging, even for developers familiar with cryptographic building blocks like encryption and digital signatures. To help participants grasp the role and application of these cryptographic primitives, the course establishes a solid foundation on the core requirements of secure communication: secure acknowledgment, integrity, confidentiality, remote identification, and anonymity. It also highlights common threats to these requirements and presents real-world solutions.

Given that cryptography is a critical component of network security, the course examines the most important cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. Rather than focusing on complex mathematical theories, these topics are approached from a developer’s perspective, featuring typical use-case examples and practical considerations such as public key infrastructures. The course introduces security protocols used in various areas of secure communication, with an in-depth exploration of widely adopted protocol families like IPSEC and SSL/TLS.

Typical cryptographic vulnerabilities are discussed, both concerning specific algorithms and protocols. Examples include BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and RSA timing attacks. For each issue, practical implications and potential consequences are explained without delving into deep mathematical details.

Finally, as XML technology is central to data exchange in networked applications, the course covers XML security. This includes the use of XML in web services and SOAP messages, alongside protection mechanisms like XML signature and XML encryption. The course also addresses weaknesses in these protection measures and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Understand the requirements of secure communication
• Learn about network attacks and defenses at different OSI layers
• Gain a practical understanding of cryptography
• Understand essential security protocols
• Understand some recent attacks against cryptosystems
• Get information about some recent related vulnerabilities
• Understand security concepts of Web services
• Get sources and further readings on secure coding practices

Audience

Developers, Professionals

This three-day course provides an overview of securing C/C++ code against malicious actors who may exploit vulnerabilities related to memory management and input handling. The course emphasizes the core principles of writing secure code.

Even seasoned Java developers often do not fully master the diverse security services provided by Java, and may remain unaware of the various vulnerabilities pertinent to web applications built with Java.

Beyond introducing the security components of Standard Java Edition, this course addresses security challenges in Java Enterprise Edition (JEE) and web services. Discussions on specific services are preceded by foundational knowledge of cryptography and secure communication. A range of hands-on exercises explores both declarative and programmatic security techniques within JEE, while also covering transport-layer and end-to-end security for web services. Participants will gain practical experience by applying the discussed APIs and tools through multiple real-world scenarios.

The course further examines the most common and critical programming flaws inherent to the Java language and platform, as well as web-related vulnerabilities. In addition to typical coding mistakes made by Java developers, the introduced security issues encompass language-specific problems and those arising from the runtime environment. Each vulnerability and associated attack vector is illustrated through clear, easy-to-follow exercises, followed by recommended coding practices and effective mitigation strategies.

Participants attending this course will

• Grasp fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and understand how to prevent them
• Comprehend security concepts specific to web services
• Learn how to leverage various security features within the Java development environment
• Acquire practical knowledge of cryptography
• Understand security solutions available in Java EE
• Identify typical coding errors and learn how to avoid them
• Gain insight into recent vulnerabilities affecting the Java framework
• Develop practical skills in using security testing tools
• Access resources and further reading materials on secure coding practices

Audience

Developers

Description

While the Java language and its Runtime Environment (JRE) were engineered to avoid many of the common security vulnerabilities found in languages like C/C++, developers and architects must still master both the positive aspects (utilizing Java's built-in security features) and the negative aspects (recognizing and avoiding persistent vulnerabilities specific to Java).

The course begins with a concise overview of cryptographic foundations to establish a common understanding of how key security components work. This theoretical knowledge is reinforced through practical exercises, allowing participants to explore and apply the relevant APIs hands-on.

Additionally, the curriculum thoroughly examines the most frequent and critical programming flaws within the Java ecosystem. It addresses typical errors made by Java developers as well as issues unique to the language and its runtime environment. Each vulnerability and its corresponding attack vector are demonstrated via accessible exercises, followed by recommended coding guidelines and effective mitigation strategies.

Participants attending this course will

• Grasp fundamental concepts of IT security and secure coding principles
• Identify web vulnerabilities beyond the OWASP Top Ten and learn strategies to prevent them
• Master the utilization of various security features within the Java development environment
• Develop a practical understanding of cryptography
• Recognize common coding mistakes and acquire techniques to avoid them
• Gain insights into recent vulnerabilities affecting the Java framework
• Access valuable resources and further reading materials on secure coding practices

Audience

Software Developers

The Certified Penetration Testing Professional (CPENT) certification is a globally recognized validation of an individual's knowledge and skills in the field of penetration testing or ethical hacking. CPENT-certified professionals demonstrate their ability to identify, assess, and manage security vulnerabilities within network infrastructure. The certification requires mastery of penetration testing methodologies, a solid understanding of legal and regulatory concerns, and technical knowledge of attack vectors and countermeasures. Industries often seek CPENT-certified professionals to protect their systems from malicious intruders. Thus, the CPENT certification serves as a reliable assurance of a candidate's expert capability in securing networks and systems, which is essential in a constantly evolving cybersecurity landscape.

It is a comprehensive specialist-level program that imparts knowledge and skills on how organizations can effectively manage post-breach consequences by reducing the impact of the incident, both financially and reputationally. Learning objectives are emphasized through practical learning, with 40% of this course covering hands-on experience of the latest incident handling and response tools, techniques, methodologies, frameworks, etc.

Description:

This course immerses students in an interactive learning environment where they learn to scan, test, exploit, and secure their own systems. The highly practical, lab-based setting provides each participant with in-depth knowledge and hands-on experience with essential modern security systems. The journey begins with understanding how perimeter defenses function, followed by guided activities on scanning and attacking personal networks—ensuring no actual network infrastructure is compromised. Students then explore how attackers escalate privileges and discover the steps necessary to fortify systems against such threats. Additional topics include Intrusion Detection, Policy Creation, Social Engineering, DDoS Attacks, Buffer Overflows, and Virus Creation.

Target Audience:

This course is highly beneficial for security officers, auditors, security professionals, site administrators, and anyone responsible for maintaining the integrity of network infrastructure.

Course Structure

• Engaging lectures paired with interactive discussions.
• Extensive exercises and practical application sessions.
• Practical implementation within a live-lab environment.

Customization Options

• For personalized training tailored to your specific needs, please reach out to us for arrangements.

Course Format

• Interactive lectures and discussions.
• Extensive exercises and practical activities.
• Hands-on implementation within a live-lab environment.

Options for Customizing the Course

• For personalized training options, please reach out to us to make arrangements.