Schedule & Trainings
Training subject to change based on trainer availability.
June Trainings | July Trainings | August Trainings
Please note: All courses take place simultaneously over two days, only register for one for this month
Applied Data Science and Machine Learning For Cyber Security
- This interactive course will teach security professionals how to use data science techniques to quickly manipulate and analyze security data. The course will cover the entire data science process from data preparation, exploratory data analysis, data visualization, machine learning, and model evaluation—all with a focus on security related problems
Attacking and Defending Containers and Kubernetes
- Organizations are rapidly moving towards microservice style architectures for their applications which has led to container technology being implemented and taking over at a rapid rate.
Leading container technologies like Docker have risen in popularity and have been widely used because they have helped package and deploy consistent-state applications across multiple environments. Container orchestration technologies like Kubernetes help these deployments massively scale which can potentially increase the overall attack-surface to a massive extent, if security is not given the attention required.
Security continues to remain a key challenge that both Organizations and security practitioners face with containerized deployments.While containers continue to be vulnerable to security threats that plague any typical application deployment, they also face specific security threats related to the containerization daemon, the shared kernel and other shared resources like network, process and the filesystem. Serverless deployments face risks such as insecure deployment configurations, inadequate monitoring and logging of functions, broken authentication, function event data injection, insecure secret storage, and many more.
Attacking applications leveraging containers requires specific skill set and a deep understanding of their underlying architecture.
This training is a practical approach with both Offensive and Defensive flavours making it ideal for security engineers, red-teammers, devops engineers and developers with a plethora of hands-on exercises that have been designed from real-world attacks and the security-specific challenges that we faced while implementing these technologies, helping them test and implement security in a scalable manner.
The training consists of, but not limited to the following focus areas in Container and Kubernetes Security:
- Introduction to Container Technology
- Containerized Deployments and Container Orchestration Technologies
- Container Threat-Model
- Attacking Containers and Security deep-dive
- Introduction to Kubernetes
- Threat-Model of Orchestration technologies
- Attacking Kubernetes
- Kubernetes Defense-in-Depth
- Logging & Monitoring Orchestrated deployments
Checkov: Static analysis for infrastructure code
- Automating policy checks for infrastructure as code prior to deployment is becoming a critical part of the Devops and security CI/CD pipeline. Incorporating infrastructure-as-code into software development is also helping cloud security practitioners prevent bad configurations upstream, without inflating development backlogs. In this trainning, we’ll cover a simple method to write, test, and maintain infrastructure-as-code at scale using policy-as-code. We will discuss common open-source packages, integrated development environment plug-ins, continuous integration, and more. We’ll also review sample use cases that showcase the benefits of preventing cloud misconfigurations on Terraform, CloudFormation and Kubernetes at build-time using the open-source tool https://github.com/bridgecrewio/checkov/
Container Security Crash Course
- With containers continuing to grow in popularity with developers and DevOps teams, it's only a matter of time before you're asked how to secure them. In this crash-course, we'll cover container fundamentals focusing on Docker, the most prominent container runtime. As we cover the building blocks of Docker, we'll point where you can go wrong (and right). Topics covered include: building images, built-in security mechanisms in Docker, networking, CICD, vulnerability scanning and running containers either alone or with an orchestration system like Kubernetes. The training also includes exercises and labs to provide hands-on experience during and after the course. By the end of the training, you'll leave with a solid understanding of how containers work and, most importantly, how to keep them secure.
Defensive Coding in JavaScript
- In this hands-on, in-depth exploration of the security best practices for JavaScript, participants will dive into JavaScript language and Node.js specific idiosyncrasies and related security implications.
Along the way, participants will gain a deeper understanding of JavaScript language and Node.js fundamentals and essential practical knowledge for building secure Single Page front-end and server-side APIs using JavaScript language, Node.js.
DevSecOps - Automating Security in DevOp
- One Day training to automate security into a fast-paced DevOps environment using various open-source tools and scripts.
Don't Run With Scissors: How to protect your developers from hurting themselves with their frameworks
- Developers often do not know what the common issues are with the framework they are using. At the same time, most common frameworks ship with easy ways to shoot your application’s security in the foot. In this world we live in, developer education will fail if even one mistake is made, which will expose a dangerous vulnerability. In this talk, we’ll show how you can dramatically reduce the chance developers will shoot themselves in the foot by giving them safer versions of their common tools so your company can ship more secure code.
We will write wrapper classes and safe versions of common tools to eliminate XSS vectors, open redirects, XXE, SSRF, LFI, and other dangerous bugs in your codebase. After that we’ll show simple steps to educate developers and gain traction in your organization. Then we’ll show how easy it is to integrate SAST tools in your CI/CD pipeline to ensure your developers use your safe tools rather than the footguns built into common frameworks.
This session is ideal for security engineers interested in eliminating entire classes of security bugs inside their code base.
Hacking Modern Desktop apps: Master the Future of Attack Vectors
- This course is a 100% hands-on deep dive into the OWASP Security Testing Guide and relevant items of the OWASP Application Security Verification Standard (ASVS), so this course covers and goes beyond the OWASP Top Ten.
Long are the days since web servers were run by perl scripts and desktop apps written in Delphi. What is common between Microsoft Teams, Skype, Bitwarden, Slack and Discord? All of them are written in Electron: JavaScript on the client. Modern Desktop apps share traditional attack vectors and also introduce new opportunities to threat actors. This course will teach you how to review modern desktop apps, showcasing Node.js and Electron but using techniques that will also work against any other desktop app platform. Ideal for Penetration Testers, Desktop app Developers as well as everybody interested in JavaScript/Node.js/Electron app security.
All action, no fluff, improve your security analysis workflow and immediately apply these gained skills in your workplace, packed with exercises, extra mile challenges and CTF, self-paced and suitable for all skill levels, with continued education via unlimited email support and lifetime access to training portal with step-by-step video recordings and interesting apps to practice, including all future updates for free.
Hacking the Cloud
- This compressed version of our hugely popular Hacking and Securing Cloud Infrastructure course cuts through the mystery of Cloud Services (including AWS, Azure, and GCP) to uncover the vulnerabilities that lie beneath. We will cover a number of popular services and delve into both what makes them different, and what makes them the same, as compared to hacking traditional network infrastructure. Whether you are an Architect, Developer, Pentester, Security or DevOps Engineer, or anyone with a need to understand and manage vulnerabilities in a Cloud environment, understanding relevant hacking techniques is critical. This course covers both the theory as well as a number of modern techniques that may be used to compromise various Cloud services and infrastructure. Prior pentest/security experience is not a strict requirement, however, some knowledge of Cloud Services and familiarity with common Unix command-line syntax will be beneficial.
Securing Microservices with OAuth 2.0 and OpenID Connect (Hands-On Workshop)
- OAuth 2.0 and OpenID Connect (OIDC) are the most commonly used solutions for stateless, token-based authentication in distributed microservice architectures as of today. But have you ever asked yourself how OAuth 2.0 really works and how it differs from OpenID Connect?
Then this workshop is a good opportunity to get to know how it works by making your hands dirty in code using Spring Security.
After an introduction to the basic concepts of OAuth 2.0 and OpenID Connect, we will use a boot-based Spring sample application to gradually implement authentication and authorization using these standards.
Learning Objectives:- Differences between OAuth 2.0 and OpenID Connect (OIDC)
- What is an Authorization Grant and when do I use which grant
- The detailed procedure of the Authorization Code Grant protocol flow
- Implementation of an OAuth 2.0/OIDC compliant Resource Server
- Differences between JWT and reference tokens
- Authorization by means of claims in JWT
- Implementation of an OAuth 2.0/OIDC compliant client
- Automated testing with OAuth 2.0 and OpenID Connect
- Current best practices for OAuth 2.0 and OpenID Connect
- An outlook on OAuth 2.1 and other specifications that are in progress
Threat Modeling: Getting from None to Done
- This session offers participants an interactive introduction to Threat Modeling, based on the instructor's learning and experience over the past several years. A primary focus of this course is the introduction of threat modeling activities into your organization's software development processes, to improve the overall quality and security of the applications you build.
As a recent 'convert' to the application security world, your instructor has developed his 'expertise' in threat modeling by gathering information from a variety of sources. He's combined those learnings with his own experience to create a practical threat modeing approach he has successfully applied within his professional roles.
In addition to addressing key questions around the 'Five Ws', the presentation will cover the 'Four Questions' approach to developing a model, and include several interactive exercises to provide direct experience. A brief review of available modeing tools will also be included, along with a discussion of the opportunities and challenges for introducing Threat Modelng into your SDLC.