This security engineering training teaches modern secure development and cryptography engineering practices to help you build more secure applications.

Developers attending our class will gain a more security-oriented mindset, yet based on pragmatic decision-making and practical techniques.

Building software today entails protecting user data, but software security engineering skills are scarce and hard to attain. Being good at software development does not equal having good security skills, and following popular online checklists might not save from troubles.

You will learn about fundamental data security practices, including: secure software development lifecycle, risk and threat modelling, components of a security system, choosing and using cryptographic APIs, designing security features, managing data flow, protecting secrets and keys, and, for example, why turning on the “encryption” checkbox in AWS S3 buckets is insufficient.

Content

1. Introduction into SSDLC (1h30):

1. Risk modelling, threats, trust.

2. Using SSDLC.

3. Components of security system (data protection, component security, process security, infrastructure security).

4. Principles of building security controls (reactive & proactive).

2. Cryptography basics (1h30):

1. Randomness and random generators, and possible vulnerabilities.

2. Encryption and key agreement.

3. TLS best practices and TLS 1.3.

4. Common cryptography-related mistakes.

3. Cryptographic software (1h):

1. Overview of the libraries and APIs available.

2. Typical pitfalls and shortcomings.

3. Examples and recommendations on selecting most suitable crypto library.

4. Secure architectures (1h30):

1. Secure architecture and planning.

2. Data security architectures (centralised, end-to-end encrypted, distributed trust).

3. Modelling, planning, assessing data flow and trust across all components.

5. Protecting secrets (45min):

1. Passwords security and hashing (from PBKDF2 to Argon2).

2. Database encryption methods and overview of modern solutions.

6. Q&A session

Schedule

08:30-09:00 – Morning coffee
09:00-09:10 – Welcome intro
09:10-10:30 – Introduction into SSDLC
10:30-10:50 – Large coffee break
10:50-12:30 – Cryptography basics
12:30-13:30 – Lunch (included)
13:30-15:00 – Secure architectures
15:10-16:00 – Protecting secrets
16:00-16:20 – Large coffee break
16:20-17:20 – Cryptographic software
17:20-18:00 – Q&A

Lunch and coffee breaks are included in a ticket price.

Who will benefit from the training?

This training is best suited for software developers and solution architects that are responsible for building and maintaining applications (be it mobile or web), as well as security engineers, penetration testers, core-team engineers.

What do you get from the training?

• Learn about SSDLC best practices and how using them can reduce security risks.

• Understand the variety of existing security controls and their areas of use.

• Learn the basic notions of modern cryptography and how to leverage them.

• Choose the right crypto components and libraries for your products.

• Know why and how to integrate cryptography in your applications.

• Learn how to find and protect the weakest data security points across the whole data flow of your system.

• Understand how to improve the security of your system when planning new features.

• Top tips, tricks, and tool picks from our experts.

The training area is comfortable, coffee is good, and we might run blind testing of ukrainian vs swiss chocolate during break "Guess which chocolate is this".

Trainers

Jean-Philippe (JP) Aumasson (@veorq), managing director at Teserakt. JP is well known for his work in cryptography including the reference book Serious Cryptography, the widely used algorithms BLAKE2 and SipHash, and talks at leading industry conferences. JP has been giving cryptography trainings since 2013 in multiple public and private settings.

Anastasiia Voitova (@vixentael), product engineer at Cossack Labs. Anastasiia is a software engineer with a wide background, focused on cryptography/applied security. She maintains open-source cryptographic library Themis, conducts secure software development training, speaks at international conferences and co-organizes cyber-security events.

Having questions?

If you have any questions about content, group discounts, payment way – contact us.

Ping our trainers in twitter and we will help! Or write us at jp@teserakt.io anastasi@cossacklabs.com