A Builder's Guide to Securing Modern Applications

Securing modern web applications is hard, really hard. Not only do you have to make the right architectural security decisions, but you also have to be aware of various implementation vulnerabilities in both frontend apps and APIs. Common failures result in data extraction or complete system compromise.

  • Jan 23
    Queen Elizabeth II Centre
    2 days
    09:00 - 17:00 UTC
    Philippe De Ryck
    1 450 GBP
  • This course will also be held at NDC Security 2023

Through in-depth lectures, hands-on labs, live demos and interactive quizzes, this workshop will teach you how to build secure applications for the modern web. We explore fundamental challenges that drive the design of your applications. We also introduce common vulnerabilities in frontend and backend and investigate relevant defenses. Additionally, we dive into coding guidelines and defense-in-depth strategies that allow you to increase the security of your applications.

Concretely, we will cover the following topics in this hands-on training:

  • The security model of modern web applications
  • Cross-Site Scripting problems in modern frontends
  • Using Trusted Types to eradicate XSS vulnerabilities
  • Assessing and improving your authorization policies
  • JWT security failures in modern applications
  • API security testing to avoid common misconfigurations
  • Server-Side Request Forgery (SSRF) attacks and defenses
  • Q & A throughout the workshop

At the end of this workshop, you will understand modern application security best practices and you walk away with a list of actionable items to assess and improve the security of your applications.

Who should attend?

This security training specifically targets developers and architects building modern web frontends / APIs. Anyone involved in building, testing, and designing modern applications should be here. This training course gives you an up-to-date and in-depth look at current security best practices. We do not merely brush over a threat and defense but focus on the underlying cause and consequences. Why do we have this problem? Which mitigations are often used? Why are some ineffective? Which one is the current best practice? These are the questions that will be answered throughout the training.

Testimonials

These testimonials from previous workshops give you a good idea of what to expect:

  • Trainer is great and an expert in the domain. All of the topics are very relevant. Practical examples for most of the topics. Excellent communication and addressing of questions.
  • Even though the topic is broad, there was no single moment where my focus went astray. Philippe talks in a way to keep you interested to listen to him.
  • I liked the the pleasant and relaxed way of speaking and the fresh style of presentation of this kind of dry stuff :)
  • Philippe is a friendly and knowledgable trainer and delivered an interesting course that was well presented. Questions were answered promptly and in a detailed way.

Prerequisites

To participate in this training, you should have development experience with web applications and APIs. Familiarity with the basics of security is helpful but not required. The training will include Angular / React / NodeJS / Java Spring / .NET Core examples but is just as relevant for other frameworks and technologies.

Computer setup

To participate in the lab sessions, participants need a computer with a full-featured modern browser installed (E.g., Chrome, Firefox).

Philippe De Ryck
Founder of Pragmatic Web Security, Google Developer Expert

Philippe De Ryck helps developers protect companies through better web security. As the founder of Pragmatic Web Security, he travels the world to train developers on web security and security engineering. His Ph.D. in web security from KU Leuven lies at the basis of his exceptional knowledge of the security landscape. Google recognizes Philippe as a Google Developer Expert for his work on security in Angular applications.

    Programutvikling uses cookies to see how you use our website. We also have embeds from YouTube and Vimeo. How do you feel about that?