Basic

Hands-On Training

During the basic training the participants will work hands-on with multiple security challenges and will complete both the Certified Secure Essential Security and Essential Specialties certifications. At the start of the training the Certified Secure instructor will provide the participants with relevant background information after which the participants will directly start to work hands-on with several SQL Injection and Path Traversal challenges. During the training, the Certified Secure instructor will provide expert knowledge and 1-on-1 guidance to all the participants.

The following subjects are covered in this training:

Intermediate

Hands-On Training

The Certified Secure Intermediate Training is the logical next step after completing the basic training. This training introduces Cross-Site Scripting and network/server related vulnerabilities. All participants complete the Certified Secure Security Specialist certification.

All participants for the Certified Secure Intermediate training must have completed the Certified Secure Essential Security certification and have a score of at least 33% for the Certified Secure Essential Specialties certification.

The following subjects are covered in this training:

Web/Server Security Specialist

Hands-On Training

During the Web/Server Security Specialist training the participants will work hands-on and focus on finding and exploiting multiple intermediate web application and server vulnerabilities. All participants complete the Certified Secure Security Web Security Specialist and Server Security Specialist certifications. All participants for this training must have completed the Certified Secure Security Specialist certification.

The following subjects are covered in this training:

Full Stack Security - The Salt Road

Hands-On Training

In this intense full-stack security training the bug bounty program of the (fictitious) Salt Road online marketplace takes the center stage. The participants will work hands-on exposing multiple vulnerabilities in both the frontend (React), backend (Java Spring) mobile application (Android) and multiple Linux-based servers.

The training starts with a fun and relevant introduction where the Certified Secure instructor will discuss multiple recent vulnerabilities and high-impact cybersecurity incidents. After the introduction the participants will be in the right Hacker Mindset and will start hands-on with the first part of the Salt Road challenge.

The second day of the training focuses on further improving the Hacker Mindset of the participants. Using the Certified Secure LIVE training system all participants will be provided with real time access to an Android emulator and MiTM proxy, uncovering and experiencing realistic vulnerabilities in mobile applications.

This training covers both defense (mitigating the found vulnerabilities) and offense (finding and exploiting the vulnerabilities to the improve the Hacker Mindset of the participants). At the end of the training the lessons learned and best practices will be presented in the broader context of the Secure Development Lifecycle

The following subjects are covered in this training:

Full Stack Security - Salt Recovery

Hands-On Training

In this 2 day full-stack security training the Certified Secure Salt Road Recovery cybersecurity challenges take the center stage. During the training the participants will be working hands-on; finding, patching and exploiting multiple frontend, backend and infrastructure vulnerabilities. The main focus of this security training is to (further) improve the Hacker Mindset of the participants, enabling them to rapidly increase the overall security and cyber resilience of the products they are working on.

The training starts with a quick-paced and engaging introduction where the Certified Secure instructor will discuss and demonstrate a state-of-the-art vulnerability commonly found in cloud-based deployments, for example in deployments using the Google Cloud Platform. After the introduction, the Hacker Mindset of the participants will have received a kick-start and the first day of hands-on training will begin.

During the first day of the training the participants will be confronted with a large full-stack web-application. The participants will work hands-on to identify and exploit multiple vulnerabilities covering a broad spectrum of different technologies. Working together with the Certified Secure instructor, the participants will gain an in-depth understanding of the presented vulnerabilities and the best method of mitigating and preventing these vulnerabilities in their own products.

The second day of the training focuses on vulnerabilities in the (kubernetes and cloud based) infrastructure of the full-stack web-application. The participants will join a (fictional) “Red Team” and will work hands-on combining both analytical security skills, offensive security skills (identifying and exploiting infrastructure vulnerabilities), mobile security skills (reverse engineering) and defensive security skills (detecting, patching and mitigating the found vulnerabilities).

During the training the Certified Secure instructor will discuss the various vulnerabilities in the context of the Secure Development Lifecycle (SDLC/SPLC) and will highlight the importance and benefits of secure development, security testing, systems hardening and the Hacker Mindset.

Extra time will be allocated to give the participants hands-on guidance on how to integrate best-practices, security checklists and security tooling during their day-to-day work. By combining vulnerabilities and technologies relevant for sysops, development and testing teams in a single effective training, this full stack security training is an excellent match for all of your teams.

Full Stack Security - Solar Support

Hands-On Training

The brand-new Certified Secure “Solar Support” challenge takes the center stage in this full stack security training. During this (2.0 days) hands-on security training the participants will be tasked with protecting the security of the customers of the (fictional) “Solar Support” space transportation and services company.

Working hands-on from a state-of-the-art mission control center, the participants will be confronted with a multitude of real-world security incidents, ranging from compromised supply chains, vulnerable backend- and frontend code, vulnerable microservices and mobile applications to insecure cloud deployments and compromised CI/CD pipelines.

With 1-on-1 expert guidance from dedicated Certified Secure instructors, the participants will take a deep-dive into the source-code, infrastructure and tooling of Solar Support and her customers, uncovering the root-cause vulnerabilities of the various incidents. The participants will gain a profound and in-depth understanding of all the presented vulnerabilities and will be provided with expert guidance on the best method of mitigating and preventing these vulnerabilities in their own projects.

By incorporating real-world incidents and vulnerabilities in a fun and realistic scenario, this Certified Secure full stack security training provides a highly-effective method to extend and improve the cybersecurity skills and Hacker Mindset of all of your development, sysops, devops and testing (QA) teams world-wide.

Chatty McChatFace

Hands-On Training

The Secure Development Lifecycle (SDLC) and understanding, exploiting, mitigating and preventing XSS, XSRF and IDOR vulnerabilities take the center stage in the Chatty McChatFace training. The participants will work hands-on with the Chatty McChatFace challenge containing multiple iterations of selected vulnerabilities and possible mitigations. Working together with the Certified Secure instructor, the participants will gain an in-depth understanding of the presented vulnerabilities and the best method of mitigating and preventing these vulnerabilities.

For every vulnerability, Certified Secure will make available a “best practice” solution and overview of the common pitfalls. At the end of this module the Certified Secure instructor will discuss the presented material and the lessons learned in the broader context of the Secure Development Lifecycle.

The following subjects are covered in this training:

Web Application Security Deep Dive

Hands-On Training

The Web Application Security Deep Dive training takes the Hacker Mindset of the participants to the next level. The participants will work hands-on with multiple advanced Certified Secure challenges and will learn how to keep developing their Hacker Mindset. This training surpasses the “standard” vulnerabilities and introduces multiple new vulnerabilities and techniques.

The following subjects are covered in the Web Application Security Deep Dive training:

K8S Internal Network Security

Hands-On Training

The Kubernetes and Internal Network Security training focusses on the security of the internal network. What happens once a frontend server is compromised? What risks are introduced or mitigated by using Kubernetes? The participants will work hands-on with a vulnerable K8S cluster and discover the answers to these questions.

The Certified Secure Kubernetes Internal Network Security training is suited for technical participants with an interest in infrastructure cybersecurity. All participants need to be comfortable on the Linux Command Line Interface (CLI).

The following subjects are covered in this training:

Wireless Security Bootcamp

Hands-On Training

The Wireless Security Bootcamp training provides the participants with a fun and relevant introduction in the world of wireless security and network traffic analysis. The participants will work hands-on with an engaging multi-stage challenge where they are tasked with breaching the security of a building by analyzing the network traffic that can be found inside this building. After analyzing all the network traffic, the participants will gain access to a secure server room inside the building and will obtain the root password of a backup server.

The following subjects are covered in this training:

Case Study - Botnet Takedown

Hands-On Training

The Botnet Takedown training is based on (IoT) malware that is being used to perform a DDoS attack. Working hands-on and together with their Certified Secure instructor the participants will analyze multiple network-based tracks and will uncover the owner of the DDoS botnet.

After completing the Certified Secure Botnet Takedown training all the participants will have decent understanding of networking and DDoS attacks and will be able to perform basic network analysis tasks.

The following subjects are covered in this training: