Secure Coding and Cyber Security for Software Developers Training Course

Course overview

Software developers are increasingly expected to prevent security defects before code reaches production, yet many teams still discover injection flaws, broken access controls, exposed secrets and vulnerable dependencies during penetration tests or incidents. This course equips developers to make defensible security decisions within everyday design, coding, review and delivery work. It focuses on the issues engineers can directly control: how data enters an application, how identities and permissions are enforced, how services trust one another, and how code is verified before release.

Participants learn a repeatable secure development workflow using threat modelling, OWASP guidance, secure coding patterns and automated security testing. They analyse attack paths with STRIDE and abuse cases; implement validation, output encoding, parameterised queries and secure error handling; strengthen authentication, session management and authorisation checks; protect secrets and sensitive data; and assess third-party components and CI/CD pipeline risks. Labs cover web application vulnerabilities, API security controls, static analysis findings and remediation priorities.

The course is delivered through instructor-led technical sessions, guided coding labs, code-review workshops and realistic incident scenarios. Participants work with intentionally vulnerable application components, identify root causes, implement remediations and test the results using developer-focused security tools. Each participant leaves with a practical secure coding action pack: a threat model, prioritised remediation backlog, secure code-review checklist, CI/CD security gate design and a 90-day implementation plan that can be adapted to their own engineering environment.

It is designed for developers and technical leads who already build, review or maintain software and need to embed security practices into delivery rather than treat security as a separate specialist activity.

Course objectives

By the end of this course, participants will be able to:

• Construct a STRIDE threat model with data-flow diagrams, trust boundaries and prioritised abuse cases
• Implement input validation, output encoding and parameterised database queries to prevent common injection attacks
• Apply secure authentication, session management and authorisation patterns to web applications and APIs
• Review source code against OWASP ASVS controls and document actionable security findings
• Configure Semgrep rules and triage static analysis results by exploitability and business impact
• Test web and API attack surfaces with OWASP ZAP and Burp Suite Community Edition
• Design dependency, secret-scanning and software supply-chain checks for a CI/CD pipeline
• Produce a prioritised secure coding remediation plan with owners, acceptance criteria and verification evidence

Benefits of attending

Target competencies

Who should attend

• Software Developers — who write and maintain application code that handles identities, data and transactions
• Senior Software Engineers — who set implementation patterns and review high-risk changes
• Full-Stack Developers — who need to secure browser, API, database and service-to-service interactions
• Backend and API Developers — who design authorisation, validation and data-access controls
• Technical Leads — who must translate security requirements into team engineering practices
• DevOps Engineers — who build CI/CD controls for code, dependencies, secrets and deployment artefacts

Requirements and prerequisites

Participants should be able to read and modify application code in at least one mainstream language, such as Java, C#, Python, JavaScript or TypeScript, and understand HTTP requests, JSON, APIs, databases and Git-based development. Prior experience building or reviewing web applications is strongly recommended. Familiarity with command-line use and a local development environment will help in the labs. Security expertise, penetration-testing experience, advanced cryptography knowledge and prior use of Burp Suite, OWASP ZAP or Semgrep are not required; the course introduces these tools from a developer remediation perspective.

Training methodology

Instructor-led sessions establish the security principles behind each control, followed by guided labs in which participants inspect and remediate vulnerable web and API code. Small groups create data-flow diagrams, model abuse cases and defend remediation priorities against realistic business constraints. Code-review workshops use OWASP ASVS criteria and static-analysis findings rather than abstract checklists. Participants test selected flaws with OWASP ZAP and Burp Suite Community Edition, then design practical CI/CD gates. The final workshop converts lab outputs into a 90-day secure development implementation plan.

Course outline

Day 1: Secure development foundations and threat modelling

• Secure software development lifecycle activities and developer accountability
• OWASP Top 10 and OWASP ASVS as engineering requirements
• Attack surface mapping for web applications and APIs
• Data-flow diagrams, assets, actors and trust boundaries
• STRIDE threat modelling categories and threat statements
• Abuse cases, attack trees and misuse scenarios
• Risk prioritisation using likelihood, impact and exploitability

Workshop: Create a data-flow diagram and STRIDE threat model for a customer-facing API, producing a ranked abuse-case register.

Day 2: Defensive coding for input, data and web attacks

• Allow-list validation and canonicalisation of untrusted input
• Context-aware output encoding for HTML, JavaScript, URL and SQL contexts
• Parameterised queries and safe ORM data-access patterns
• Cross-site scripting prevention and Content Security Policy design
• Cross-site request forgery controls and SameSite cookie settings
• Secure file upload validation, storage isolation and content-type handling
• Safe error handling, logging and prevention of information disclosure

Workshop: Remediate SQL injection, reflected XSS and unsafe file-upload defects in a vulnerable application, then record verification tests.

Day 3: Identity, access control and API security

• Password storage using adaptive hashing, salts and credential handling
• Multi-factor authentication flows and recovery-path security
• Session lifecycle controls, cookie flags and token storage decisions
• OAuth 2.0 and OpenID Connect roles, scopes and token validation
• Authorisation models including RBAC, ABAC and object-level access checks
• API rate limiting, schema validation and mass-assignment prevention
• Cryptographic key management, secret rotation and protected configuration

Workshop: Review an API for broken object-level authorisation and token-validation weaknesses, then implement and test corrected access controls.

Day 4: Security testing, code review and supply-chain controls

• OWASP ASVS-based secure code-review criteria
• Semgrep rule execution, finding interpretation and custom rule selection
• OWASP ZAP spidering, passive scanning and authenticated scan setup
• Burp Suite Community Edition proxying, request replay and manual verification
• False-positive triage using reachability, exploitability and compensating controls
• Software composition analysis, dependency pinning and vulnerability remediation
• Secret scanning, SBOM concepts and signed build artefacts

Workshop: Run static and dynamic checks against a lab service, validate two findings manually and produce a remediation ticket backlog.

Day 5: Embedding secure coding into delivery

• Security acceptance criteria and definition-of-done controls
• CI/CD security gates for code scanning, secrets and dependencies
• Security test coverage and regression-test design for fixed vulnerabilities
• Vulnerability severity, service ownership and remediation SLAs
• Secure pull-request templates and peer-review escalation paths
• Incident learning, root-cause analysis and prevention actions
• Measuring secure development adoption with actionable engineering metrics

Workshop: Build a team-specific secure coding implementation plan, including pipeline gates, review checks, remediation ownership and 90-day milestones.

Tools & standards covered

OWASP ASVS, Semgrep, OWASP ZAP, Burp Suite Community Edition

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions