SECO Institute Secure Programming Foundation

By passing the SPF certification exam and earning a SECO Secure Programming Foundation (S-SPF) certificate, you demonstrate your ability to

• Understand the importance of security in the software lifecycle and the logic behind industry-approved secure development principles;
• Understand web application attack surfaces and trust boundaries;
• Understand the workings of HTTP requests and header injection;
• Understand password authentication vulnerabilities and effective countermeasures;
• Understand the security implications of session management and identify effective countermeasures against session fixation;
• Identify countermeasures against cross-site request forgery (CSRF) and clickjacking attacks;
• Identify countermeasures against injection attacks;
• Identify countermeasures against buffer overflows;
• Identify countermeasures against cross-site scripting (XSS);
• Identify countermeasures against file upload attacks;
• Identify countermeasures against character encoding vulnerabilities;
• Understand privilege escalation and list relevant mitigation techniques;
• Secure products by hardening and vulnerability scanning;
• Understand how to prevent side-channel attacks;
• Understand how to prevent DoS attacks;
• Understand the importance of good error handling practices;
• Understand the security risks involved in logging;
• Understand symmetric and asymmetric cryptography, Man-in-the-Middle attacks, and the pitfalls in SSL/TLS and HTTPS certificates.
• Explain how security requirements can/should be identified;
• Perform simple threat modelling exercises and identify security requirements for a system.

The course and the certificate are ideal for your career advancement if you are a(n):

• (Aspiring) software developer, software engineer or software auditor;
• Aspiring lead developer or architect;
• Aspiring software development manager.

• Introduction to Secure Programming
• Secure Programming Awareness
• Authentication and Session Management
• Input Handling
• Authorization
• Configuration, Error Handling and Logging
• Cryptography
• Secure Software Engineering

This is an entry-level course. No previous knowledge or experience is required.

• Virtual course duration: 3 sessions of 4,5 hours