Secure development training your engineers will finish.

01

• —Secure design principles — least privilege, defence in depth, fail securely, threat modelling
• —Injection attacks — SQL and beyond, and the prevention techniques that hold
• —Data attacks and cryptography failures — buffer overflows, race conditions, weak crypto
• —Business logic and client-side flaws — XSS, CSRF, API abuse, Content Security Policy
• —Access control and authentication — broken access control, IDOR, privilege escalation
• —Security testing tools — what each type of testing finds, and how to use them well

02

• —SQL injection — bypass a login, then parameterise the query
• —Insecure direct object reference — read another user's record, then enforce ownership
• —Reflected cross-site scripting — land a payload, then encode the output
• —Client-side price tampering — edit the price in the browser, then validate server-side