Most breaches today do not start with a firewall being broken – they start with an application: a login form that trusts user input too much, an API that leaks more than it should, a mobile app storing data in the wrong place. The Securing Software Applications Professional Course, delivered by the Arab British Fellowship Training Academy, is built around that reality, treating the application itself as the front line of defence.

Participants work through secure coding, the OWASP Top 10, and hands-on testing with tools like Burp Suite and OWASP ZAP, then extend the same discipline to web, mobile, and cloud-native applications. The course closes with DevSecOps and the Zero Trust model, so participants leave able to build security into the development lifecycle rather than bolting it on afterward.

Who Should Attend?

• Application developers, engineers, and security professionals responsible for software application security.
• DevSecOps team members integrating security practices into the software development lifecycle.
• Penetration testers, ethical hackers, and security analysts specialising in application vulnerabilities.

Knowledge and Benefits:

By the end of the program, participants will be able to:

• Apply secure coding practices to prevent common vulnerabilities such as SQL injection and cross-site scripting.
• Identify and mitigate security risks in web, mobile, and cloud-based applications.
• Use security testing tools and techniques – DAST, SAST, and penetration testing – to find vulnerabilities before attackers do.
• Integrate security into the development lifecycle through DevSecOps and automation.
• Apply the Zero Trust security model to control access within application environments.

• Module 1: Why Applications Are the Front Line

  • Key principles of application security and current threat trends.
  • How security integrates into each phase of the Software Development Life Cycle (SDLC).
  • The OWASP Top 10 vulnerabilities and threat models for different application types.

• Module 2: Writing and Verifying Secure Code

  • Best practices for secure coding, including preventing SQL injection and cross-site scripting (XSS).
  • Input validation and output encoding to stop injection attacks and data leaks.
  • Secure authentication and authorization: session management, OAuth/OpenID, and role-based access control (RBAC).

• Module 3: Securing Web Applications

  • Common web vulnerabilities and defences against CSRF, XSS, and other web-specific attacks.
  • Secure web development practices: HTTPS, CSP, HSTS, and secure session/cookie management.
  • Configuring and integrating Web Application Firewalls (WAF) into the security testing process.

• Module 4: Securing Mobile Applications

  • Security risks specific to iOS and Android, and mobile penetration testing techniques.
  • Secure coding and data encryption practices for mobile apps and their APIs.
  • Mobile Device Management (MDM), app sandboxing, and app store security compliance.

• Module 5: Testing Applications Like an Attacker Would

  • Dynamic (DAST) versus Static (SAST) application security testing, and manual testing techniques.
  • Penetration testing with tools such as Burp Suite, OWASP ZAP, and Nmap, plus reporting and fixing findings.
  • Threat modeling and risk-based prioritisation of security efforts.

• Module 6: Securing Applications in the Cloud

  • Unique security challenges of cloud-based applications and the shared responsibility model.
  • Identity and Access Management (IAM) and data/API encryption for cloud-native applications.
  • Cloud security frameworks (CSA Cloud Control Matrix) and tools such as AWS Security Hub and Azure Security Center.

• Module 7: Zero Trust, DevSecOps, and What's Next

  • Principles of the Zero Trust security model and how it applies to application access control.
  • Integrating security into DevOps pipelines (DevSecOps) and CI/CD for continuous protection.
  • How blockchain technology affects application security, including smart contracts and decentralized apps (dApps).