Duration 2 days – 14 hours
Overview
This Web Application Security with SDL training equips participants with the essential knowledge and practical skills to build and maintain secure web applications by integrating security into every phase of the Secure Development Lifecycle (SDL).
Participants will learn how common web vulnerabilities happen (based on modern industry threats), how to prevent them through secure coding practices, and how to apply SDL controls such as threat modeling, secure design reviews, security testing (SAST/DAST), code review, and release security gates. The course combines hands-on demonstrations, real-world scenarios, and practical checklists to help teams implement security-by-design and reduce application security risks.
Objectives
- Explain web application security risks and why SDL is critical
- Identify common web vulnerabilities and attack paths
- Apply secure coding and secure design principles for web apps
- Conduct basic threat modeling and security requirement definition
- Implement SDL checkpoints (planning → build → test → release → operations)
- Use secure code review practices and vulnerability prevention techniques
- Understand security testing approaches (SAST, DAST, dependency scanning)
- Establish practical security controls for continuous improvement and compliance
Target Audience
- Web Developers (Front-End / Back-End / Full Stack)
- Software Engineers and Technical Leads
- QA / Test Engineers (especially Security Testing roles)
- DevOps / DevSecOps Engineers
- Application Support / Production Support Teams
- Software Architects
- IT Security / InfoSec Professionals involved in application security
- Project Managers / Delivery Managers managing software releases
Prerequisites
- Basic knowledge of web application concepts (HTTP/HTTPS, APIs, cookies, sessions)
- Familiarity with modern web development practices (any language/framework)
- Basic understanding of SDLC is helpful but not required
- Laptop recommended for hands-on demos/tools (optional)
Course Outline
Day 1 — Web Application Security Fundamentals + Core Vulnerabilities
Module 1: Introduction to Web Application Security
- Why web apps are prime targets
- Security goals: Confidentiality, Integrity, Availability
- Common attack surfaces (web, API, auth, data, 3rd party components)
- Security mindset: “Shift Left” + security-by-design
Module 2: Secure Development Lifecycle (SDL) Overview
- What is SDL and how it reduces security risks
- SDL phases and security gates
- Roles & responsibilities (Dev, QA, Security, Product, Ops)
- Defining “Done”: security acceptance criteria
Module 3: Top Web Vulnerabilities (Modern and Practical)
- Injection (SQL/NoSQL, command injection)
- Cross-Site Scripting (XSS) and input/output encoding
- Broken authentication & session management
- Access control failures (IDOR, privilege escalation)
- CSRF basics and mitigation
- Security misconfiguration and exposed secrets
- Vulnerable components / dependency risks
- Data exposure risks (PII, encryption basics)
Activity: Vulnerability recognition workshop (real scenarios)
Module 4: Secure Coding Foundations
- Input validation (server-side vs client-side)
- Output encoding and safe rendering
- Password storage best practices (hashing + salt)
- Secure logging practices (avoid sensitive leakage)
- Safe error handling (avoid information disclosure)
Lab/Demo: Secure vs insecure patterns and prevention
Day 2 — Integrating Security into SDL + Security Testing & Controls
Module 5: Threat Modeling & Secure Design
- Threat modeling fundamentals (assets, actors, threats, mitigations)
- STRIDE approach (simple and usable version)
- Secure design principles (least privilege, defense in depth)
- Designing secure APIs and web services
Workshop: Threat model a sample web app + define controls
Module 6: Authentication & Authorization Security
- Authentication vs Authorization
- Multi-factor authentication basics
- Role-based access control (RBAC) and permission validation
- Secure session handling, token security (JWT basics)
- Security considerations for OAuth/SSO (overview)
Module 7: Security Testing in the SDL (Shift Left Testing)
- Static Application Security Testing (SAST)
- Dynamic Application Security Testing (DAST)
- Software Composition Analysis (SCA) / dependency scanning
- Secrets scanning and config validation
- Penetration testing vs vulnerability scanning
- Choosing tools and defining test coverage
Module 8: Secure Code Review & Release Readiness
- What to look for during secure code reviews
- Common red flags and recurring coding mistakes
- Security checklist for pre-release approval
- Secure configuration baselines and hardening
- Security documentation and traceability
Module 9: Monitoring, Incident Readiness, and Continuous Improvement
- Monitoring and alerting basics
- Handling vulnerability reports and patch workflows
- Secure operations: patching, logging, incident response alignment
- Metrics: vulnerability trends, risk scoring, time-to-fix
Output: SDL security checklist + team action plan
