Group training options will be displayed here. Contact us for more information about group training opportunities.
Special offers will be displayed here. Check back later for promotional deals and special pricing.
DISA's Application Security and Development STIG, in conjunction with the associated checklist, provides a comprehensive listing of requirements and needs for improving and maintaining the security of software applications and systems within the Department of Defense. This course fills in the context, background, and best practices for fulfilling those requirements and needs. As with all of our courses, we maintain tight synchronization between the latest DISA releases and our materials. A key component to our coverage of DISA's Security Technical Implementation Guides (STIGS), this course is a companion course with several developer-oriented courses and seminars
Application Security and Development (STIGs) is an immersive, comprehensive, STIG-driven application security training course essential for developers, designers, architects, QA, Testing, and other personnel who need to deliver and/or evaluate secure applications within the DOD. In addition to teaching a solid understanding of applicable ASD STIGS, this course digs deep into the features to examine for those STIGs with hands-on programming.
The ASD STIGs are covered in a series of categories that cover groups for SITGs related to a general topic area such as access control, cryptography and information protection, authentication, etc. Each category will start with a listing of applicable STIGs, followed by the technical foundations for those STIGs. These technical foundations will be supplemented by labs and examples to stimulate critical thinking. Each category will end with an extensive lab of each covered STIG during which students will evaluate the STIG itself, the check text (verification), and fix text.
Students who attend this course will leave armed with the skills required to recognize actual and potential software vulnerabilities, implement defenses for those vulnerabilities, and test those defenses for sufficiency. This course introduces developers to the most common security vulnerabilities faced by web applications today. Each vulnerability is examined from a Java/JEE perspective through a process of describing the threat and attack mechanisms, recognizing associated vulnerabilities, and, finally, designing, implementing, and testing effective defenses.
Multiple practical labs reinforce these concepts with real vulnerabilities and attacks. Students are then challenged to design and implement the layered defenses they will need in defending their own applications.
Students who attend this course will leave armed with the skills required to recognize actual and potential software vulnerabilities based on STIGs and STIG checklists. This course introduces developers to the most common security vulnerabilities faced by web applications today.
Working in a dynamic, lab-intensive hands-on coding environment students will learn to:
The course provides a solid foundation in basic terminology and concepts, extended and built upon throughout the engagement. Students will examine various recognized attacks against web applications. Processes and best practices are discussed and illustrated through both discussions and group activities. Attending students will be led through a series of advanced topics comprised of integrated lectures, group discussions and comprehensive demonstrations.
Need different skills or topics? If your team requires different topics or tools, additional skills or custom approach, this course may be further adjusted to accommodate. We offer additional STIG, application security, secure coding, secure software development, hacking, database security, bug hunting and other related topics that may be blended with this course for a track that best suits your needs. Our team will collaborate with you to understand your needs and will target the course to focus on your specific learning objectives and goals.
This is an intermediate -level programming course, designed for experienced Java developers who wish to get up and running on developing well defended software applications using the STIG guidelines. Familiarity with Java and JEE is required and real world programming experience is highly recommended. Ideally students should have approximately 6 months to a year of Java working knowledge.
This is an intermediate -level programming course, designed for experienced Java developers who wish to get up and running on developing well defended software applications using the STIG guidelines. Familiarity with Java and JEE is required and real world programming experience is highly recommended. Ideally students should have approximately 6 months to a year of Java working knowledge.
Please note that this list of topics is based on our standard course offering, evolved from typical industry uses and trends. We'll work with you to tune this course and level of coverage to target the skills you need most. Topics, agenda and labs are subject to change, and may adjust during live delivery based on audience interests and skill-level.
Session: STIG Foundation
Lesson: DISA's Security Technical Implementation Guides (STIGs)
Lesson: Why Hunt Bugs?
Lesson: Safe and Appropriate Bug Hunting/Hacking
Lesson: Removing Bugs
Session: Foundation for Securing Web Applications
Lesson: Principles of Information Security
Session: STIG Stomping 101
Lesson: Unvalidated Data
Lesson: Access Control
Lesson: Cryptographic Failures
Lesson: Injection
Lesson: Security Misconfiguration
Session: STIG Stomping 102
Lesson: Vulnerable and Outdated Components
Lesson: Identification and Authentication Failures
Lesson: Software and Data Integrity Failures
Lesson: Security Logging and Monitoring Failures
Lesson: Server-Side Request Forgery (SSRF)
Session: Additional Concerns, Services, and Rich Interfaces
Lesson: Database Security
Lesson: Defending Web Services
Lesson: Defending Rich Interfaces and REST
Session: Moving Forward with Application Security
Lesson: Application Security and Development Checklists
Lesson: SDL Process Overview
Optional Content
Emerging Game Changers in Web Application Security
Tailor your learning experience with Trivera Tech. Whether you need a custom course offering or want to schedule a specific date and time for corporate training, we are here to help. Our team works with you to design a solution that fits your organization's unique needs; whether that is enrolling a small team or your entire department. Simply let us know how many participants you'd like to enroll and the skills you want to develop, and we will provide a detailed quote tailored to your request.
Contact Trivera Today to discuss how we can deliver personalized training that equips your team with the critical skills needed to succeed!
