• Authored Course

About this Course

With the increase in cyber-attacks on business, it's time to start building security into new systems developments right from the start. The majority of successful cyber-attacks depend on exploiting a few well-known common vulnerabilities. This course, updated for 2018, will show you how security can be designed into, managed and maintained within a development lifecycle.

Learn from the UK's leading Business Systems trainer

  • Comprehensive curriculum

    Our courses cover the entire business system development lifecycle – analysing, designing, creating, developing and testing.

  • Experienced experts

    Our expert trainers work full-time for QA and form the largest directly-employed team in Europe, ensuring the highest standards.

  • Superb satisfaction scores

    95% of our customers say their Business Systems training with QA will definitely improve job performance.

  • Trusted training

    We work with all the leading international bodies and frameworks – BCS (The Chartered Institute for IT), TOGAF, Lean Six Sigma, Agile.

Why people choose QA

Locations

There are over 20 QA learning centres and many other sites spread across the UK, providing a convenient choice of learning locations and ensuring that over 90% of the population is within 45 minutes of a training destination. Learn more

  • London

    London

    International House

  • Manchester

    Manchester

    Oxford Street

Delegate portal

Booking courses with QA has always been easy, but now we've made it even easier. With myQA you can book, administer and manage all your bookings online, in one place. Login / sign-up

Detailed Information

Module 1 - Secure Development Lifecycle (SDLC)

  • An overview of the main SDLC models
  • Development models (Inc. DevSecOps)
  • Configuration and source code management
  • Risk analysis tools
  • Privacy by Design

Module 2 - Secure By Design

  • Secure development processes
  • Threat modelling
  • Risk mitigation
  • Security best practice
  • Secure design architecture

Module 3 – Introduction to Application Security (OWASP 2017)

  • Vulnerabilities and mitigations available to any development environment
  • Attack vectors and security controls
  • The OWASP (2017) Top 10 in detail
  • Vulnerability 1 (2017) – Injection
  • Vulnerability 2 (2017) – Broken Authentication
  • Vulnerability 3 (2017) – Sensitive Data Exposure
  • Vulnerability 4 (2017) – XML External Entities (XXE)
  • Vulnerability 5 (2017) – Broken Access Controls
  • Vulnerability 6 (2017) – Security Misconfigurations
  • Vulnerability 7 (2017) – Cross-Site Scripting
  • Vulnerability 8 (2017) – Insecure Deserialization
  • Vulnerability 9 (2017) – Using Components with Known Vulnerabilities
  • Vulnerability 10 (2017) – Insufficient Logging and Monitoring

Module 4 – Introduction to Defensive Coding

  • Secure coding techniques and principles.
  • Methods of testing code, and code test analysis
  • Using, compromising and defending encryption, hashes and passwords
  • Classification of security flaws

There are no specific pre-requisites for this course. However a general understanding of development practices and a broad understanding of current threats would be desired. There are group exercises, and instructor led ‘hands-on’ labs within each module of this course. Delegates can observe the instructor demonstrations or engage fully with each hands-on lab, subject to experience.

The intended audience for this course is primarily Project Managers, Business Analysts, Junior Developers and Designers. Plus anyone with an interest in building and maintaining secure systems lifecycle.

Note: This course is not designed for the experienced software developer and does not cover hands-on coding.

  • Understand the main Secure Development Lifecycle (SDLC) Models, and their principal differences
  • Be able to choose which SDLC model is most appropriate in a given situation.
  • Learn how to apply secure development techniques from the initial design stage and throughout a development lifecycle
  • Understand the latest (2017) OWASP vulnerabilities and how to counter/mitigate them
  • Learn about useful system design tools
  • Discover resources to help introduce and use secure design and development best practices
  • Learn Threat Modelling methodologies and techniques
  • Understand the benefits of code review
  • Understand various testing strategies
  • Learn about encryption, securing and compromising passwords and meta data
  • An introduction to the classification of security flaws and application security

BCS
BCS International Diploma in Business Analysis

Industry-recognised certification that demonstrates the skills of an effective Business Analyst.

BCS
BCS Advanced Diploma in Business Analysis

A new certification from the BCS designed for experienced and senior Business Analysts.