Analytics
2/26/2014
07:20 AM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%

SAFECode Releases Free Online Software Security Training Courses

Courses range from preventing SQL injection to avoiding cross site request forgery

SAN FRANCISCO, Feb. 25, 2014 /PRNewswire/ -- RSA Conference -- The Software Assurance Forum for Excellence in Code (SAFECode), a non-profit organization working to increase trust in technology products and services through the advancement of effective software assurance methods, today announced that it has released new software security training courses as part of its online Security Engineering Training by SAFECode program.

Security Engineering Training by SAFECode is an online community resource offering free security training courses delivered via on-demand webcasts. Covering issues from preventing SQL injection to avoiding cross site request forgery, the courses are designed to be used as building blocks for those looking to create an in-house training program for their product development teams, as well as individuals interested in enhancing their skills.

New course available for immediate viewing include:

Product Penetration Testing 101: This course provides a foundation for security penetration testing of products. It reviews the important penetration testing concepts and shares insight into common elements of an attacker's mindset.

Cross Site Scripting (XSS) 101: This course provides viewers with a basic understanding of the core concepts behind XSS. It will help viewers recognize where in a web application they may expect to find XSS and provide guidance on preventing and remediating XSS.

Secure Java Programming 101: This course provides a basic introduction to secure coding in Java. Viewers will be introduced to the most frequent attacks and pitfalls that a Java programmer may encounter, along with techniques to avoid them. It is designed to be a starting point for those new to Java security.

In addition, SAFECode will release the following courses in the next six weeks:

Secure Memory Handling in C 101: This course provides an introduction to basic issues in secure coding in C with a focus on secure memory handling. It specifically focuses on issues associated with traditional string (char*) handling, arrays and format strings.

Using Cryptography The Right Way: This course provides an overview of how to use cryptography in a secure way and covers topics such as the uses of hashing and the differences between symmetric and asymmetric encryption. It provides examples of cryptography in action and reinforces the importance of using well-established and accepted cryptography toolkits.

These new Security Engineering Training by SAFECode courses are based on training materials donated to SAFECode by its member companies. A team of technical experts from across the SAFECode membership has reviewed and supplemented all course materials to ensure their broad applicability across diverse development environments.

Visit https://training.safecode.org today to learn more about the program and participate in its free courses. To learn more about SAFECode and SAFECode membership, as well as additional training benefits available to SAFECode members, please visit www.safecode.org.

About SAFECode The Software Assurance Forum for Excellence in Code (SAFECode) is a non-profit organization exclusively dedicated to increasing trust in information and communications technology products and services through the advancement of effective software assurance methods. SAFECode is a global, industry-led effort to identify and promote best practices for developing and delivering more secure and reliable software, hardware and services.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5700
Published: 2014-09-22
Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/index.php or the (2) username or (3) password parameter in blocks/loginbox/loginbox.template.php to index.php. NOTE: some o...

CVE-2014-0484
Published: 2014-09-22
The Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via vectors related to the "user's environment."

CVE-2014-2942
Published: 2014-09-22
Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, which makes it easier for attackers to obtain a privileged terminal session by calculating the superuser code, and then leveraging physical access or terminal access to enter this code.

CVE-2014-3595
Published: 2014-09-22
Cross-site scripting (XSS) vulnerability in spacewalk-java 1.2.39, 1.7.54, and 2.0.2 in Spacewalk and Red Hat Network (RHN) Satellite 5.4 through 5.6 allows remote attackers to inject arbitrary web script or HTML via a crafted request that is not properly handled when logging.

CVE-2014-3635
Published: 2014-09-22
Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows remote attackers to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one m...

Best of the Web
Dark Reading Radio