Secure coding in PHPのトレーニングコース

This instructor-led, live training in 日本 (online or onsite) is aimed at intermediate-level software developers and QA engineers who wish to adopt and master TDD principles and practices to improve code quality and development efficiency.

By the end of this training, participants will be able to:

• Understand the principles and workflow of Test-Driven Development (TDD).
• Write effective and maintainable unit tests.
• Utilize mocking frameworks to create comprehensive test scenarios.
• Apply TDD as a design tool to create robust and flexible code.

Android is an open platform for mobile devices such as handsets and tablets. It has a large variety of security features to make developing secure software easier; however, it is also missing certain security aspects that are present in other hand-held platforms. The course gives a comprehensive overview of these features, and points out the most critical shortcomings to be aware of related to the underlying Linux, the file system and the environment in general, as well as regarding using permissions and other Android software development components.

Typical security pitfalls and vulnerabilities are described both for native code and Java applications, along with recommendations and best practices to avoid and mitigate them. In many cases discussed issues are supported with real-life examples and case studies. Finally, we give a brief overview on how to use security testing tools to reveal any security relevant programming bugs.

Participants attending this course will 

• Understand basic concepts of security, IT security and secure coding
• Learn the security solutions on Android
• Learn to use various security features of the Android platform
• Get information about some recent vulnerabilities in Java on Android
• Learn about typical coding mistakes and how to avoid them
• Get understanding on native code vulnerabilities on Android
• Realize the severe consequences of unsecure buffer handling in native code
• Understand the architectural protection techniques and their weaknesses
• Get sources and further readings on secure coding practices

Audience

Professionals

Implementing a secure networked application can be difficult, even for developers who may have used various cryptographic building blocks (such as encryption and digital signatures) beforehand. In order to make the participants understand the role and usage of these cryptographic primitives, first a solid foundation on the main requirements of secure communication – secure acknowledgement, integrity, confidentiality, remote identification and anonymity – is given, while also presenting the typical problems that may damage these requirements along with real-world solutions.

As a critical aspect of network security is cryptography, the most important cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement are also discussed. Instead of presenting an in-depth mathematical background, these elements are discussed from a developer's perspective, showing typical use-case examples and practical considerations related to the use of crypto, such as public key infrastructures. Security protocols in many areas of secure communication are introduced, with an in-depth discussion on the most widely-used protocol families such as IPSEC and SSL/TLS.

Typical crypto vulnerabilities are discussed both related to certain crypto algorithms and cryptographic protocols, such as BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE and similar, as well as the RSA timing attack. In each case, the practical considerations and potential consequences are described for each problem, again, without going into deep mathematical details.

Finally, as XML technology is central for data exchange by networked applications, the security aspects of XML are described. This includes the usage of XML within web services and SOAP messages alongside protection measures such as XML signature and XML encryption – as well as weaknesses in those protection measures and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Understand the requirements of secure communication
• Learn about network attacks and defenses at different OSI layers
• Have a practical understanding of cryptography
• Understand essential security protocols
• Understand some recent attacks against cryptosystems
• Get information about some recent related vulnerabilities
• Understand security concepts of Web services
• Get sources and further readings on secure coding practices

Audience

Developers, Professionals

This three day course covers the basics of securing the C/C++ code against the malicious users who may exploit many vulnerabilities in the code with memory management and input handling, the course cover the principals of writing secure code.

Even experienced Java programmers are not mastering by all means the various security services offered by Java, and are likewise not aware of the different vulnerabilities that are relevant for web applications written in Java.

The course – besides introducing security components of Standard Java Edition – deals with security issues of Java Enterprise Edition (JEE) and web services. Discussion of specific services is preceded with the foundations of cryptography and secure communication. Various exercises deal with declarative and programmatic security techniques in JEE, while both transport-layer and end-to-end security of web services is discussed. The use of all components is presented through several practical exercises, where participants can try out the discussed APIs and tools for themselves.

The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform and web-related vulnerabilities. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Understand security concepts of Web services
• Learn to use various security features of the Java development environment
• Have a practical understanding of cryptography
• Understand security solutions of Java EE
• Learn about typical coding mistakes and how to avoid them
• Get information about some recent vulnerabilities in the Java framework
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers

This instructor-led, live training in 日本 (online or onsite) is aimed at web developers who wish to build web applications with CodeIgniter.

By the end of this training, participants will be able to:

• Use CRUD in CodeIgniter for refactoring API code.
• Extend CodeIgniter to consume dependencies.
• Load CodeIgniter models and views from containers.

This instructor-led, live training in 日本 introduces the fundamentals of Laravel and walks participants through the creation of a Laravel-based web application.

This instructor-led, live training in 日本 (online or onsite) is aimed at developers who wish to learn and use Livewire to build modern and dynamic application interfaces.

By the end of this training, participants will be able to:

• Build and test livewire components.
• Build applications using the Livewire library.
• Create dynamic components within PHP.

This instructor-led, live training in 日本 (online or onsite) is aimed at web developers who wish to use Laravel and Vue JS for fullstack web development.

By the end of this training, participants will be able to:

• Develop web applications with Laravel and Vue JS.
• Integrate the Laravel backend API into Vue JS.
• Deploy a Laravel application.

This instructor-led, live training in 日本 teaches participants how to write testable code in the form of testing units to facilitate the diagnosis, isolation, and resolution of bugs. The training walks participants through the creation of a work-ready, testing environment using the PHPUnit testing framework.

By the end of this training, participants will be able to:

• Distinguish between good and bad testing units.
• Read and interpret test results.
• Proactively manage and diagnose their code base to reduce bugs.
• Ensure that their code base is fit for continuous integration and deployment.

This instructor-led, live training in (online or onsite) is aimed at web developers who wish to build middleware and web services in Laravel.

By the end of this training, participants will be able to:

• Use Laravel PHP Aritisan to generate code and components.
• Build RESTful APIs in Laravel that can browse, read, edit, add, and delete.
• Filter and sort results based on URL parameters using RESTful APIs.

This instructor-led, live training in 日本 (online or onsite) is aimed at intermediate-level developers and software engineers who wish to use Symfony2 to create structured, maintainable, and scalable web applications.

By the end of this training, participants will be able to:

• Understand the philosophy and structure of the Symfony2 framework.
• Use Symfony2 components such as Doctrine, Twig, and Routing effectively.
• Build secure and testable web applications using custom bundles and REST APIs.
• Integrate Symfony2 into enterprise environments and estimate project implementation costs.

This instructor-led, live training in 日本 (online or onsite) is aimed at intermediate-level developers who wish to develop robust web applications using Symfony3.

By the end of this training, participants will be able to:

• Set up and configure a Symfony3 development environment.
• Build dynamic web applications using Symfony3 features and tools.
• Utilize built-in and custom services, templates, forms, and security mechanisms.
• Access databases using Doctrine ORM.
• Write automated tests and apply performance optimization techniques.

Symfony 4 is a software development framework for PHP. It contains reusable PHP libraries to facilitate the development and testing of new applications written in PHP (Web apps or APIs). Symfony 4 is a command-line software framework with the built-in commands that makes PHP code development more efficient.

In this instructor-led, live training, participants will learn to use the Symfony framework and the PHP language as they step through the creation of a PHP application.

By the end of this training, participants will be able to:

• Use Symfony 4 to create and test code written in PHP
• Create simple code for PHP that reads and writes to a database

Audience

• Programmers and web developers with working knowledge of PHP and HTML
• Advanced developers who seek more efficient development tools for faster closures
• Software designers who need to update their understanding of current development tools that match user needs

Format of the course

• Part lecture, part discussion, exercises and heavy hands-on practice

This instructor-led, live training in 日本 (online or onsite) is aimed at beginner-level developers who wish to build robust and maintainable web applications using Yii 2.

By the end of this training, participants will be able to:

• Install and configure Yii 2.
• Understand Yii’s MVC architecture and project structure.
• Build secure and scalable web applications using Yii 2 components.
• Work with databases, forms, and REST APIs.