Courses Solutions Case Studies & Testimonials News & Insights About Us Contact Us
Public Sector Graduate Training Schemes Learning & Development Corporate & Volume Pricing Custom Learning Paths

Public Sector

We've had the pleasure of working with UK and overseas central and local government departments, including Healthcare (NHS and Foundation Trusts), Defence, Education (Universities and colleges), many of the main Civil Service departments, Emergency Services; also public-owned corporations including the BBC, Bank of England, Ordnance Survey, and regulatory bodies such as Ofgem.

We are registered on Crown Commercial Service’s (CCS) Dynamic Purchasing System (RM6219 Training and Learning) and also with numerous tender portals such as Ariba, Coupa and Delta E-Sourcing.

Read more...

Graduate Training Schemes

Framework Training has a strong track record of providing a solid introduction into the working world for technical graduates across myriad industries. We provide the opportunity to learn and gain valuable hands-on experience in a supportive, friendly and sociable training environment.

Attract & retain the brightest new starters

We know it is vital for our clients to invest in the future of their talented grads; not only to provide them with high-quality, professional training essential for their roles, but to embed them within the organisation’s culture and guide them on the right path to a successful career.

After all, your new hires could well be the next leaders and their creative ideas and unique insights are invaluable to your business.

Read more ...

Learning & Development

Our unique portfolio of high-quality technical courses and training programmes are industry-respected. They’re carefully designed so that delegates can seamlessly apply what they’ve learnt back in the workplace. Our team of domain experts, trainers, and support teams know our field — and all things tech — inside out, and we work hard to keep ourselves up to speed with the latest innovations. 

We’re proud to develop and deliver innovative learning solutions that actually work and make a tangible difference to your people and your business, driving through positive lasting change. Our training courses and programmes are human-centred. Everything we do is underpinned by our commitment to continuous improvement and learning and generally making things much better.

Read more...

Corporate & Volume Pricing

Whether you are looking to book multiple places on public scheduled courses (attended remotely or in our training centres in London) or planning private courses for a team within your organisation, we will be happy to discuss preferential pricing which maximise your staff education budget.

Enquire today about:

  • Training programme pricing models  

  • Multi-course voucher schemes

Read more...

Custom Learning Paths

We understand that your team training needs don't always fit into a "one size fits all" mould, and we're very happy to explore ways in which we can tailor a bespoke learning path to fit your learning needs.

Find out about how we can customise everything from short overviews, intensive workshops, and wider training programmes that give you coverage of the most relevant topics based on what your staff need to excel in their roles.

Read more...

Secure Java Development with OWASP

Secure your Java code: prevent OWASP Top 10 Web App and API security risks.

About the course

This Secure Java Development course is designed for people involved in the production of Java software applications, and will give delegates useful tools and techniques to harden systems against attack.

It's all too often the case that security comes as an afterthought - if it comes at all, in the drive to keep pushing out new iterations and products. Without being given adequate time to explore security in depth, it's unlikely many development team members will have considered the extent to which businesses are exposed to external - and internal - malicious actors.

This secure Java development course will give you the techniques and hands-on experience with relevant security tools to help protect your business systems from attackers, and help instil a security-first mindset. We also encourage ways to implement security quickly, efficiently, at the right time, and most importantly, effectively too!

This training uses hands-on technical examples, security tools and teamwork to thoroughly analyse and understand the modern security environment.

We will give delegates access to deliberately vulnerable virtual environments which reflect real-world scenaros in order to learn how to fortify against malicious intrusion. We're happy for delegates to choose their preferred Java IDE and can discuss other ways to make the course as relevant as possible to your tech stack.

Our secure Java development course course also takes a good hard look at the Open Web Application Security Project (OWASP) Top Ten most critical web application security risks and how to guard against them.

Instructor-led online and in-house face-to-face options are available - as part of a wider customised training programme, or as a standalone workshop, on-site at your offices or at one of many flexible meeting spaces in the UK and around the World.

    • Understand the business impact of insecurity and integrate security principles throughout the Software Development Lifecycle (SDLC).
    • Explain the most critical web application security risks covered by the OWASP Top 10 and the specific threats targeting APIs in the OWASP API Security Top 10.
    • Identify, detect, and implement effective mitigation techniques in Java for a wide range of common web vulnerabilities, including Cross-site Scripting (XSS), Log Injection, CSRF, Response Splitting, and Open Redirect.
    • Identify, detect, and implement effective mitigation techniques in Java for file-related vulnerabilities such as Directory Traversal and Malicious File Upload.
    • Identify, detect, and implement effective mitigation techniques in Java for SQL and NoSQL Injection vulnerabilities, including using ORMs and bind variables, and understand how to detect them in automated tests.
    • Understand and implement defences for the risks in the OWASP API Security Top 10 that are relevant to Java API development
    • Explain and implement defence strategies for Unrestricted Resource Consumption and Unsafe Consumption of APIs.

  • This intensive hands-on training course is designed for IT professionals involved in building and securing applications and APIs using the Java platform. It is ideal for:

    • Java Software Developers who want to write secure code and prevent common vulnerabilities.

    • Java Architects and Technical Leads responsible for designing secure application architectures and guiding development teams.

    • Quality Assurance (QA) Engineers and Testers involved in identifying and testing for security vulnerabilities in Java applications, including integrating security checks into automated tests.

    • Anyone involved in building or maintaining web applications or APIs using Java frameworks (e.g., Spring, Jakarta EE).

  • Participants should have:

    • Experience developing applications using the Java programming language.

    • Familiarity with building web applications or APIs using Java frameworks (e.g., Spring, Jakarta EE) is highly recommended, as many examples and demos will focus on web and API vulnerabilities.

    • A basic understanding of web technologies (HTTP, browsers, client-server, APIs).

    We can customise the training to match your team's experience and needs - with more time and coverage of fundamentals for newer developers, for instance.

  • This secure Java coding course is available for private / custom delivery for your team - as an in-house face-to-face workshop at your location of choice, or as online instructor-led training via MS Teams (or your own preferred platform).

    Get in touch to find out how we can deliver tailored training which focuses on your project requirements and learning goals.

  • Building in Security First

    • The Cost of Insecurity

    • The Security Development Lifecycle

    OWASP – The Big Picture

    • OWASP Top 10

    • OWASP API Security Top 10

    • Using the OWASP API Security Top 10

    • Metrics behind the Top 10 Risks

    Preventing Cross-site Scripting Attacks

    • Detecting Cross-site Scripting in Automated Regression Tests

    • A Simple Cross-site Scripting Exploit

    • Mitigating Cross-site Scripting with Blacklisting

    • Mitigating Cross-site Scripting with Whitelisting

    • The Importance of Canonicalization

    • Mitigating Cross-site Scripting with HTTP Response Headers

    • Defense In-depth with Cross-site Scripting

    • Mitigating Cross-site Scripting with Spring Security

    • Detecting Persisted Cross-site Scripting in Automated Regression Tests

    • Mitigating Cross-site Scripting with Output Encoding

    Preventing Log Injection and Log Forgery

    • Cross-site Scripting the Noc

    • Detecting Log Injection

    • Mitigating Log Injection Using Timestamps

    • Mitigating Log Injection Using Guids

    • Mitigating Log Injection Using Output Encoding

    Preventing CSRF, Response Splitting, and Open Redirect

    • How to Smuggle in a Carriage Return

    • Detecting CRLF Injection in Automated Regression Tests

    • Mitigating CRLF Injection Using Output Encoding

    • A Perfectly Forged Check

    • Detecting CSRF in Automated Regression Tests

    • Mitigating CSRF Using a Custom Header

    • Mitigating CSRF by Verifying Source and Target Origins

    • Mitigating CSRF Using Synchronized Tokens

    • Storing CSRF Synchronized Tokens in a Cookie

    • Storing CSRF Synchronized Tokens in the Session

    • Storing CSRF Synchronized Tokens in a JWT

    • Mitigating CSRF Using Spring Security

    • Getting CSRF Defense Right

    • Redirect Dancing with Two Left Feet

    • Detecting Open Redirect in Automated Regression Tests

    • Mitigating Open Redirect with State

    • Mitigating Open Redirect with Whitelisting

    Preventing Directory Traversal and Malicious File Upload

    • Spot-the-forgery

    • Running Terracotta in a Docker Container

    • Detecting Malicious File Upload in Automated Regression Tests

    • Mitigating Malicious File Upload Using File Extensions

    • Mitigating Malicious File Upload Using Apache Tika

    • Mitigating Malicious File Upload Using ClamAV

    • Mitigating Malicious File Upload Using MultipartConfig

    • Detecting Directory Traversal in Automated Regression Tests

    • Mitigating Directory Traversal

    Preventing SQL and NoSQL Injection

    • How SQL Injection Makes a Database an Open Book

    • Detecting SQL Injection in Automated Regression Tests

    • Mitigating SQL Injection Using Bind Variables

    • Mitigating SQL Injection Using an ORM

    • An Infinite Loop in a Haystack

    • Detecting NoSQL Injection in Automated Regression Tests

    • Mitigating NoSQL Injection

    Broken Object Level Authorization

    • Understanding Broken Object Level Authorization

    • Object Level Attacks

    • Demo: Broken Object Level Attacks

    • Examining Defenses

    Broken Authentication

    • Understanding Broken Authentication

    • Password Based Attacks and Defenses

    • Other Attacks and Defenses

    • Demo: Common JWT Attacks

    Broken Object Property Level Authorization

    • Understanding Broken Object Property Level Authorization

    • Object Property Attacks and Defenses

    • Demo: Exploiting Object Properties

    Unrestricted Resource Consumption

    • Unrestricted Resource Consumption Attacks

    • Defenses for Resource Consumption

    Broken Function Level Authorization

    • Attacking Broken Function Level Authorization

    • Demo: Exploiting Broken Function Level Authorization

    • Defenses

    Unrestricted Access to Sensitive Business Flows

    • Sensitive Business Flows and Potential Attacks

    • Demo: Attacking an Unrestricted Business Flow

    • Business Flow Defenses

    Server-side Request Forgery

    • Understanding Server-side Request Forgery

    • Demo: Forging Requests from the Server

    • SSRF Defenses

    Security Misconfiguration

    • Misconfiguration and Patching

    • HTTP Request Chain Misconfigurations

    • Server Environment Misconfigurations

    • Misconfiguration in the API and Response Chain

    Improper Inventory Management

    • Understanding Improper Inventory Management

    • Demo: Deprecated Functionality

    • Attacks and Defenses

    Unsafe Consumption of APIs

    • Understanding Unsafe Consumption of APIs

    • API Consumption Attacks

    • API Consumption Defenses

    Oracle – Secure Coding Guidelines for Java

    • Introduction

    • Fundamentals

    • Denial of Service

    • Confidential Information

    • Injection and Inclusion

    • Accessibility and Extensibility

    • Input Validation

    • Mutability

    • Object Construction

    • Serialization and Deserialization

    • Access Control

    Conclusion

    • Course Review

    • Next Steps in Secure Java Development

Trusted by

Amadeus Services company logo BBC logo CERN organisation logo

Public Courses Dates and Rates

Please get in touch for pricing and availability.

Related courses