A number of programming languages are available today to compile code to .NET and ASP.NET frameworks. The environment provides powerful means for security development, but developers should know how to apply the architecture- and coding-level programming techniques in order to implement the desired security functionality and avoid vulnerabilities or limit their exploitation.
The aim of this course is to teach developers through numerous hands-on exercises how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization, provide remote procedure calls, handle sessions, introduce different implementations for certain functionality, and many more. A special section is devoted to configuration and hardening of the .NET and ASP.NET environment for security.
A brief introduction to the foundations of cryptography provides a common practical baseline for understanding the purpose and the operation of various algorithms, based on which the course presents the cryptographic features that can be used in .NET. This is followed by the introduction of some recent crypto vulnerabilities both related to certain crypto algorithms and cryptographic protocols, as well as side-channel attacks.
Introduction of different vulnerabilities starts with presenting some typical programming problems committed when using .NET, including bug categories of input validation, error handling or race conditions. A special focus is given to XML security, while the topic of ASP.NET-specific vulnerabilities tackles some special issues and attack methods: like attacking the ViewState, or the string termination attacks.
I really liked the Crypto part
I liked the trainer was passionate about the subject and very convincing too.
I mostly was benefit from the hands-on examples.
The subject of the course was very interesting and gave us many ideas.
I generally enjoyed the interaction.
Most of the known subjects related with secure coding covered and explained well Nice presentations Easy to watch, not boring.
The way and its approach on each different section.
The trainer has very good communication skills and can easily get & hold audience's attention. He can explain the matter in a very easy and detailed way so that each person can...
All topics were well covered and presented with a lot of examples. Ahmed was very efficient and managed to keep us focused and attracted at all times.
Everything! I didn't have any experience with Secure Coding and the whole training was interesting and helpful.
I genuinely enjoyed the real life examples.
I loved the delivery from the trainer's side. Very enthusiastic and made the training really pleasant and interesting. Also, very clear about the content he was delivering.
I genuinely liked the real world scenarios.
I genuinely liked the organization.
Very good knowledge and character.
I was benefit from the exercises (SQL injection, XSS, CRSF. .).
I liked the blend of theory/fundamentals/principles and activity/interactive-web-apps. Excellent mix.
Good pacing, by switching between lectures and activities the trainer was able to hold my attention, good variety of topics covered, trainer was very knowledgeable and able to...
Trainers command in his field
The hands-on labs were excellent.
The practical exercises
The hands-on approach to explain the concepts.
Exercise and be able to experiment.
The OWASP overview, especially slides with the specific examples of attacks. OWASP Zap tool.
I saw some security risk being easier to use than I expected It helped us to find some security holes in our Product
It's good to start with the cause and anderstand why we need to secure our application.
The explanations of how the most common attacks happen against web applications.
Beginning by how to hack to better understand how to secure was very interesting and appreciated.