About the course
Integrating security measures into the software development process from its inception is crucial and significantly more cost-effective than addressing vulnerabilities retrospectively. The OWASP Top Ten Proactive Controls provide developers with a set of essential, actionable security techniques designed to be implemented early and consistently in every software project. By focusing on preventative measures, these controls help developers build more resilient applications that are inherently more secure. This 2-day intensive training course delves into these critical proactive controls, guiding participants on how to effectively integrate security best practices into their daily coding workflows and development practices, thereby addressing security concerns from the earliest stages of the development lifecycle.
The course introduces the fundamental philosophy behind the OWASP Proactive Controls and underscores their importance in achieving a "shift left" in security – moving security considerations earlier in the development process. Participants will gain a deep understanding of the core controls necessary for establishing a strong security foundation for any application. This includes learning how to implement effective Access Control mechanisms to rigorously enforce authorisation policies and protect sensitive resources, applying best practices for Using Cryptography the proper way to ensure data confidentiality and integrity, implementing robust techniques to Validate all Input to prevent common issues like Injection attacks (e.g., SQL Injection, XSS) and securely Handle Exceptions to avoid leaking sensitive information. Additionally, the course covers implementing secure Digital Identity and authentication controls and establishing Secure By Default Configurations to minimise the application's attack surface right out-of-the-box.
Building on these foundational controls, the workshop explores further critical proactive measures vital for comprehensive application security. Participants will learn practical strategies to Keep your Components Secure by understanding dependency management risks and the software supply chain, how to effectively Leverage Browser Security Features to enhance client-side protection (e.g., Content Security Policy, Same-Origin Policy), and the importance and implementation details of comprehensive Security Logging and Monitoring for the timely detection of and response to security events. The course also addresses the specific and often critical vulnerability class of Server-Side Request Forgery (SSRF) and details the practical controls needed to prevent it. For each proactive control discussed, the training covers its underlying principle, illustrates common related vulnerabilities it helps prevent (often linking back to the OWASP Top 10 Risks for contextual understanding), and provides practical strategies, code considerations, and implementation guidance applicable across various programming languages and application architectures. Through focused discussions, practical examples, and exploration of real-world scenarios, attendees will gain the knowledge and confidence to effectively apply these proactive controls to build significantly more secure applications from inception.
Instructor-led online and in-house face-to-face options are available - as part of a wider customised training programme, or as a standalone workshop, on-site at your offices or at one of many flexible meeting spaces in the UK and around the World.
-
- Understand the critical importance and underlying philosophy of implementing proactive security controls in software development, referencing the OWASP Proactive Controls.
- Design and implement secure Access Control mechanisms to enforce authorisation policies effectively.
- Apply best practices for Using Cryptography to protect sensitive data confidentiality and integrity appropriately.
- Implement robust input validation and securely Handle Exceptions to prevent common vulnerabilities, including injection attacks and information leakage.
- Configure Secure By Default Configurations for applications and individual components to minimise attack surface.
- Understand the risks associated with third-party and internal dependencies and apply strategies for keeping Components Secure (Software Supply Chain Security).
- Implement secure Digital Identity and authentication controls.
- Leverage available Browser Security Features to enhance the security posture of web applications client-side.
- Implement effective Security Logging and Monitoring to aid in the detection and response to security incidents.
- Understand the nature of Server-Side Request Forgery (SSRF) vulnerabilities and implement controls to prevent them.
- Relate the implementation of these proactive controls to the prevention of common software vulnerabilities, particularly those highlighted in the OWASP Top 10 Risks.
- Apply the principles of "Address Security from the Start" by integrating these controls throughout the development lifecycle.
-
This 2-day intensive training course is designed for software developers, architects, and technical leads who want to build more secure applications by implementing preventative security controls from the start of the development process. It is ideal for:
Software Developers (at all levels) responsible for writing secure code.
Application Architects designing secure systems.
Security Champions within development teams promoting secure coding practices.
DevOps Engineers involved in application deployment and secure configuration.
QA Engineers involved in security testing and vulnerability assessment.
Technical leads overseeing development teams and secure coding standards.
Anyone involved in writing or reviewing code who wants to understand and apply secure coding best practices based on preventative controls.
-
Participants should have:
Experience with software development in at least one programming language.
Basic understanding of web application concepts (e.g., client-server interaction, HTTP requests, databases).
Familiarity with common security terms (e.g., authentication, authorisation, vulnerability) is helpful but not strictly required, as key concepts will be explained.
We can customise the training to match your team's experience and needs - with more time and coverage of fundamentals for newer developers, for instance.
-
This OWASP Proactive Controls course is available for private / custom delivery for your team - as an in-house face-to-face workshop at your location of choice, or as online instructor-led training via MS Teams (or your own preferred platform).
Get in touch to find out how we can deliver tailored training which focuses on your project requirements and learning goals.
-
Introduction
The importance of proactive security in software development.
Understanding the OWASP Top Ten Proactive Controls philosophy: Shifting Left.
Contrasting Proactive Controls with reactive approaches (e.g., addressing OWASP Top 10 Risks after they appear).
Overview of the controls covered in the course.
Implement Access Control
Understanding Authentication vs. Authorisation.
Common Access Control models (e.g., Role-Based Access Control - RBAC).
Enforcing access control checks on every request to sensitive resources.
Pitfalls: Vertical and Horizontal Access Control issues.
Prevents vulnerabilities like Broken Access Control (OWASP Top 10 Risk).
Use Cryptography the proper way
When and where to use cryptography (data in transit, data at rest).
Using standard, well-vetted cryptographic libraries and algorithms.
Common mistakes: Rolling your own crypto, using deprecated algorithms, key management issues.
Hashing vs. Encryption vs. Digital Signatures.
Securely storing passwords (salting, stretching).
Helps prevent vulnerabilities related to sensitive data exposure.
Validate all Input & Handle Exceptions
The importance of input validation: Never trust user input.
Positive vs. Negative validation models.
Validating data format, length, type, and content.
Common injection attack vectors (SQL Injection, Cross-Site Scripting - XSS, Command Injection).
Parameterized queries and prepared statements.
Encoding output to prevent XSS.
Securely handling exceptions: Avoiding information leakage in error messages.
Logging errors securely.
Helps prevent vulnerabilities like Injection and Information Disclosure.
Implement Digital Identity
Secure Authentication: Verifying user identity.
Different authentication factors (something you know, have, are).
Securely managing sessions.
Protecting against credential stuffing and brute force attacks.
Multi-factor authentication (MFA).
Helps prevent vulnerabilities like Broken Authentication.
Secure By Default Configurations
Designing applications and components with security in mind from the start.
Minimising the attack surface out-of-the-box.
Disabling unnecessary services, features, or ports.
Using secure default settings for frameworks, libraries, and servers.
Helps prevent vulnerabilities related to Security Misconfiguration.
Keep your Components Secure
Understanding the software supply chain risks.
Risks of using vulnerable libraries and dependencies.
Using dependency management tools and security scanners.
Keeping components updated.
Helps prevent vulnerabilities related to Vulnerable and Outdated Components (OWASP Top 10 Risk).
Leverage Browser Security Features
Understanding the Same-Origin Policy (SOP).
Content Security Policy (CSP): Mitigating XSS and data injection attacks.
HTTP Headers for security (e.g., Strict-Transport-Security - HSTS, X-Content-Type-Options, X-Frame-Options).
Cookies security attributes (Secure, HttpOnly, SameSite).
Helps prevent vulnerabilities like XSS, Clickjacking, and enhances client-side protection.
Implement Security Logging and Monitoring
Why comprehensive logging is essential: Detection, forensics, monitoring.
What information to log (authentication attempts, access to sensitive data, errors).
Securely storing and managing logs.
Monitoring logs for suspicious activity.
Integrating with security monitoring tools (SIEM).
Essential for Detection and Response, helps limit the impact of breaches.
Stop Server-Side Request Forgery (SSRF)
Understanding what SSRF is and how it works.
Common SSRF attack vectors (e.g., manipulating URLs in server-side requests).
Impact of SSRF (accessing internal resources, cloud metadata, internal services).
Prevention strategies: Input validation for URLs, enforcing allow lists/deny lists, disabling redirect follows, network segmentation.
Directly prevents Server-Side Request Forgery (OWASP Top 10 Risk).
Address Security from the Start
Integrating security into the Software Development Lifecycle (SDLC).
Threat modelling: Identifying potential security risks early.
Secure design principles.
Security code reviews.
Automated security testing (SAST, DAST, IAST - overview).
Building a security culture in development teams.
(This control is placed here to reinforce the overarching principle after specific controls have been discussed, showing how they fit into a broader secure development process).
Summary
Review of the OWASP Proactive Controls covered.
Recap of how proactive implementation prevents common vulnerabilities.
Next steps for applying these controls in your projects.
Q&A.
-
OWASP Official Website: The primary source for web application security knowledge and projects.
OWASP Top 10 Proactive Controls: Detailed information on the Proactive Controls project.
OWASP Cheat Sheet Series: Practical guidance on preventing specific vulnerabilities.
CWE/SANS Top 25 Most Dangerous Software Errors: A list of the most common and impactful programming errors.
Trusted by
