Training programme
Secure Development for Engineering Teams
For working developers: the vulnerability classes that reach production most often, how to catch them in review, and how to wire the checks into your pipeline.
Intermediate
- Delivery
- Online, live instructor-led
- Modules
- 6
- Price
- On request
Learning outcomes
What you'll be able to do afterwards
- Identify the vulnerability classes that most often survive to production, and recognise them in code review
- Apply secure defaults for authentication, authorisation, input handling and secret management
- Threat model a feature in a working session, not as a separate documentation exercise
- Configure dependency scanning, secret detection and security tests in a CI pipeline
- Set review thresholds that keep alert volume low enough to stay trusted
Prerequisites
- Professional experience writing and reviewing application code
- Familiarity with a version control workflow and a CI system
Curriculum
6 modules
Every module and the topics it covers.
Module 01
Threat modelling a real feature
- Trust boundaries and data flow, mapped quickly
- Choosing which risks to design against and which to accept
- Recording decisions so they survive team turnover
Module 02
Access control
- Broken access control as the most consequential common defect
- Enforcing authorisation at the right layer
- Multi-tenant data isolation patterns and how they leak
Module 03
Input, output and injection
- Parameterisation and why string building keeps returning
- Output encoding and the contexts that get missed
- Deserialisation and file upload handling
Module 04
Secrets and configuration
- Getting credentials out of source control and keeping them out
- Managed secret stores and rotation
- Environment separation without configuration drift
Module 05
Dependencies and supply chain
- Reading an advisory and judging whether it applies to you
- Lockfiles, pinning and update strategy
- Scanning in CI with thresholds that do not train people to ignore it
Module 06
Security in the pipeline
- Static analysis and secret detection as pipeline stages
- Writing tests that assert a security property
- Handling a finding on a branch about to ship
Enquire
Ask about Secure Development for Engineering Teams
We'll reply with confirmed dates, delivery format and pricing.