C# Developer

Overview

The Secure Developer – Advanced Learning Path explores different models, standards, frameworks, and security concepts that you can use to understand security issues and improve the security posture of your applications. The curriculum provides individuals with an understanding of how to ensure security is part of software design. Learners will gain in-depth knowledge of security practices that must be considered within every phase of the development lifecycle to help secure software applications and data. By introducing the DevSecOps philosophies, learners are prepared to focus on time saving but effective techniques that maximize security resources all while shortening system development lifecycles and providing continuous delivery of high-quality software.

Upon successful completion of this path, you will have the knowledge and skills to:

• Use NIST and MITRE ATT&CK security frameworks to identify and categorize potential threats
• Identify and apply relevant cryptographic technologies to secure applications and data
• Apply techniques to remove architecture weak spots and avoid vulnerability propagation
• Implement a zero-trust architecture
• Create a threat model for application scenarios
• Manage identities, privileges, and secrets securely
• Understand, create, and articulate security requirements as part of a software requirement document
• Determine which types of automated tests should be performed at various stages of the SDLC

NOTE: This Learning Path is considered principal to all Elite Secure Developer Learning Paths. Learn and Skill labs are elective training modules that help transform concepts into tangible skills through hands-on, realistic examples of real-world threat scenarios.

Courses

• CYB 250 – Cyber Threat Hunting: Tactics, Techniques, and Procedures (TTP)
• CYB 310 – Using Cyber Supply Chain Risk Management(C-SCRM) to Mitigate Threats to IT/OT
• DES 204 – The Role of Cryptography in Application Development
• DES 212 – Architecture Risk Analysis and Remediation
• DES 311 – Creating Secure Application Architecture
• DSO 212 – Fundamentals of Zero Trust Security
• DSO 302 – Automated Security Testing
• DSO 307 – Secure Secrets Management
• ENG 205 – Fundamentals of Threat Modeling
• ENG 211 – How to Create Application Security Design Requirements
• ENG 212 – Implementing Secure Software Operations
• ENG 312 – How to Perform a Security Code Review
• ENG 320 – Using the Software Composition Analysis (SCA) to Secure Open Source Components

Overview

The Elite Secure Developer – C# Learning Path builds on a thorough grounding of security features necessary to avoid common pitfalls and build scalable applications that run on desktops or back-end processes, powering modern web applications using defensive coding practices throughout the software development life cycle (SDLC). The curriculum equips developers with the competency to develop desktop, API, and back-end applications written in C#. The Elite Secure Developer – C# covers key application security concepts, including:

• Defensive coding best practices
• Developing scalable applications using multithreading features of the .NET framework
• Avoiding common pitfalls

NOTE: Secure Developer – Core and Advanced Learning paths are considered principal to all Elite Secure Developer Learning Paths. All Learn and Skill labs are elective training modules that help transform concepts into tangible skills through hands-on, realistic examples of real-world threat scenarios.

Courses

• COD 216 – Leveraging .NET Framework Code Access Security (CAS)
• COD 217 – Mitigating .NET Security Threats
• COD 308 – Common ASP.NET Vulnerabilities and Attacks
• COD 309 – ASP.NET MVC Authentication and Authorization
• COD 321 – Protecting C# from Integer Overflows and Canonicalization Issues
• COD 322 – Protecting C# from SQL Injection
• COD 323 – Using Encryption with C#
• COD 324 – Protecting C# from XML Injection
• LAB 214 – Defending C# Applications Against Credentials in Code Medium
• LAB 218 – Defending C# Applications Against Business Logic Error for Input Validation
• LAB 221 – Defending C# Applications Against SQL Injection
• LAB 227 – Defending C# Applications Against Forceful Browsing
• LAB 232 – Defending C# Against XSS
• LAB 238 – Defending Against Weak AES ECB Mode Encryption (C#)
• LAB 239 – Defending Against Weak PRNG (C#)
• LAB 241 – Defending C# Against eXternal XML Entity (XXE) Vulnerabilities
• LAB 250 – Defending Against Parameter Tampering (C#)
• LAB 251 – Defending Against Plaintext Password Storage (C#)
• LAB 260 – Defending Against Sensitive Information in Error Messages (C#)
• LAB 263 – Defending Against SSRF C#
• LAB 266 – Defending Against Sensitive Information in Log Files C#
• LAB 270 – Defending Against Deserialization of Untrusted Data C#
• LAB 278 – Defending C# Applications Against Command Injection
• LAB 282 – Defending C# Applications Against Dangerous File Upload
• LAB 286 – Defending C# Applications Against RegEx DoS

Overview

Learning paths may include elective course content that is not required to complete SI-CSC certification exams successfully. These additional courses are suggested based on alignment with the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework. To understand how courses map to this framework, please contact us.

Courses

• DES 101 – Fundamentals of Secure Architecture
• LAB 102 – Identifying Broken Object-Level Authorization Vulnerabilities
• LAB 104 – Identifying Business Logic Flaw Vulnerabilities
• LAB 105 – Identifying Credential Dumping Vulnerabilities
• LAB 108 – Identifying Reverse Engineering Vulnerabilities
• LAB 111 – Identifying Server-Side Request Forgery
• LAB 114 – Identifying Cookie Tampering
• LAB 116 – Identifying Forceful Browsing
• LAB 117 – Identifying Hidden Form Field
• LAB 118 – Identifying Weak File Upload Validation
• LAB 122 – Identifying Insecure APIs
• LAB 123 – Identifying Vertical Privilege Escalation
• LAB 124 – Identifying Horizontal Privilege Escalation
• LAB 125 – Identifying Buffer Overflow
• LAB 126 – Identifying Information Leakage
• LAB 128 – Identifying Unverified Password Change
• LAB 130 – Identifying Generation of Predictable Numbers or Identifiers
• LAB 131 – Identifying Improper Restriction of XML External Entity Reference
• LAB 132 – Identifying Exposed Services
• LAB 134 – Identifying Plaintext Storage of a Password
• LAB 135 – Identifying URL Redirection to Untrusted Site
• LAB 136 – Identifying Improper Neutralization of Script in Attributes in a Web Page
• LAB 310 – ATT&CK: File and Directory Permissions Modification
• LAB 311 – ATT&CK: File and Directory Discovery
• LAB 315 – ATT&CK: Updating Vulnerable Java Web Application Server Software
• LAB 321 – ATT&CK: Password Cracking
• LAB 322 – ATT&CK: Exploiting Windows File Sharing Server with External Remote Services
• LAB 323 – ATT&CK: Exploiting Vulnerable Java Web Application Server Software
• LAB 324 – ATT&CK: Exploiting Java Web Application Server Misconfiguration
• LAB 330 – ATT&CK: Exploiting Java SQL Injection to Extract Password Hashes
• LAB 331 – ATT&CK: Network Service Discovery
• LAB 332 – ATT&CK: Network Share Discovery
• LAB 334 – ATT&CK: Create Account
• LAB 335 – ATT&CK: Unsecured Credentials
• LAB 336 – ATT&CK Data from Local System
• LAB 337 – ATT&CK Valid Accounts
• SDT 325 – Testing for NULL Pointer Dereference