Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
Foundations of IT Security and Secure Coding
- Fundamentals of threat modeling: STRIDE methodology, attack surfaces, and privilege escalation vectors
- Integrating secure SDLC practices: shifting left, conducting threat-aware design reviews, and implementing defense-in-depth
- Applying the principle of least privilege, defense by contract, and establishing secure default configurations
- Workshop: Mapping a .NET microservice to a threat model and identifying architectural controls
Web Application Security in ASP.NET
- Understanding the ASP.NET request pipeline, middleware execution order, and filter interception points
- HTTP protocol risks: header injection, request smuggling, and CORS misconfigurations
- Best practices for session management, state persistence, and cookie security
- Implementing secure remote procedure calls and managing external API consumption patterns
- Lab: Exploiting and patching a vulnerable middleware chain in a sample ASP.NET application
.NET Security Architecture and Built-in Services
- CLR security model: evidence, permissions, and the evolution of CAS (Code Access Security)
- ASP.NET Core Identity, authentication schemes, and token-based security (JWT, OAuth2, OpenID Connect)
- Data Protection API: encryption techniques, key rotation, and secure data serialization
- Using cryptographic primitives in .NET: RNG, hashing, symmetric/asymmetric encryption, and signature validation
- Lab: Implementing secure token issuance, key rotation, and data protection across a microservice boundary
Common Coding Errors, Vulnerabilities, and Mitigation Strategies
- Defending against deserialization attacks, ViewState tampering, and string termination/overflow pitfalls in .NET
- Managing configuration drift: securing web.config/appsettings.json, environment variable exposure, and secret management
- Addressing injection vectors: SQL, command, XSS, and LDAP vulnerabilities in C# data access and routing
- Avoiding insecure defaults, hardcoding, and improper error handling that lead to information leakage
- Lab: Reverse-engineering a vulnerable .NET module, applying secure patterns, and validating fixes with static/dynamic analyzers
Security Testing, Validation, and Continuous Improvement
- Static Application Security Testing (SAST): utilizing Roslyn analyzers, Security Code Scan, and CI/CD integration
- Dynamic Application Security Testing (DAST): employing OWASP ZAP, Burp Suite workflows, and automated scanning
- Runtime protection: implementing Application Guardrails, memory safety practices, and secure logging/auditing
- Managing patches, tracking dependencies, and responding to .NET/ASP.NET security advisories
- Lab: Building a pre-commit and pipeline security gate for a .NET solution
Knowledge Resources and the Secure Development Ecosystem
- Accessing official Microsoft security guidance, .NET security documentation, and ASP.NET hardening references
- Monitoring CVE databases, advisory feeds, and adhering to responsible disclosure workflows for open-source dependencies
- Navigating secure library ecosystems: PGP, crypto-ops, authentication scaffolds, and compliant cryptography
- Establishing internal secure coding standards, enabling developer education, and launching security champion programs
- Workshop: Curating a personalized secure development toolkit and establishing ongoing monitoring practices
Requirements
- Strong working knowledge of C# programming and core .NET framework concepts
- Experience with ASP.NET web development (Razor Pages, MVC, or Minimal APIs)
- Understanding of foundational HTTP protocols, routing, and web server operations
- While no prior security certification is mandatory, professional production coding experience is expected
14 Hours
Testimonials (5)
Very good to understand how a hacker would potentially analyse sites for weakness and tools they might employ .
Roger - OTT Mobile
Course - .NET, C# and ASP.NET Security Development
the corny jokes. Love the first 2 day session because of the labs.
Kevin Galacgac - Human Edge Software Philippines, Inc.
Course - .NET, C# and ASP.NET Security Development
The trainer is really connecting with us and making sure that nobody left out of the current topic. Explains well to each topic and provides an example that is easy to understand.
Edgarico Llaneta - Human Edge Software Philippines, Inc.
Course - .NET, C# and ASP.NET Security Development
The hands-on training and the examples.
Lord-Sam Lamparero - Human Edge Software Philippines, Inc.
Course - .NET, C# and ASP.NET Security Development
I was benefit from the exercises (SQL injection, XSS, CRSF. .).
