User Session Recording Technology for Security and Compliance Training Course

This instructor-led, live training in Italy (online or onsite) is designed for system administrators who wish to use 389 Directory Server to configure and manage LDAP-based authentication and authorization.

Upon completion of this training, participants will be able to:

• Install and configure 389 Directory Server.
• Comprehend the features and architecture of 389 Directory Server.
• Learn how to configure the directory server using both the web console and the CLI.
• Set up and monitor replication to ensure high availability and load balancing.
• Manage LDAP authentication using SSSD for enhanced performance.
• Integrate 389 Directory Server with Microsoft Active Directory.

This instructor-led live training in Italy (online or onsite) is designed for system administrators seeking to use Microsoft Active Directory to manage and secure data access.

By the conclusion of this training, participants will be capable of:

• Setting up and configuring Active Directory.
• Creating a domain and defining access rights for users and devices.
• Managing users and machines through Group Policies.
• Controlling access to file servers.
• Establishing a Certificate Service and managing certificates.
• Implementing and managing services such as encryption, certificates, and authentication.

Building a secure networked application can be challenging, even for developers who have previously utilized various cryptographic primitives like encryption and digital signatures. To help participants grasp the role and application of these cryptographic building blocks, the course begins by establishing a solid understanding of the core requirements for secure communication—namely, secure acknowledgment, integrity, confidentiality, remote identification, and anonymity. It also addresses common threats that can compromise these requirements alongside real-world mitigation strategies.

Given that cryptography is central to network security, the course explores key algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement protocols. Rather than focusing on complex mathematical theories, the material is presented from a developer's perspective, highlighting typical use cases and practical considerations such as Public Key Infrastructure (PKI). The curriculum introduces security protocols used across various domains of secure communication, with a detailed examination of widely adopted protocol families like IPsec and SSL/TLS.

The course also examines common cryptographic vulnerabilities associated with specific algorithms and protocols, including BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and RSA timing attacks. For each issue, the potential consequences and practical implications are explained without delving into deep mathematical details.

Finally, as XML technology is pivotal for data exchange in networked applications, the course covers its security aspects. This includes the use of XML in web services and SOAP messages, along with protective measures like XML Signature and XML Encryption. It also addresses weaknesses in these protections and XML-specific security issues such as XML injection, XML External Entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Grasp fundamental concepts of security, IT security, and secure coding
• Understand the requirements for secure communication
• Learn about network attacks and defenses across different OSI layers
• Develop a practical understanding of cryptography
• Comprehend essential security protocols
• Analyze recent attacks targeting cryptosystems
• Gain insights into recent related vulnerabilities
• Understand the security concepts behind web services
• Access resources and further reading on secure coding practices

Audience

Developers, Professionals

Developing secure C and C++ applications demands rigorous defenses against malicious exploitation, memory corruption, and input validation bypasses. This course explores vulnerability patterns such as buffer overflows, use-after-free errors, integer overflows, and type confusion. Participants will apply secure coding guidelines, utilize static analysis tools, and employ defensive programming techniques to eliminate weaknesses, enforce input sanitization, and deliver hardened software that is resilient against cyberattacks.

Even seasoned Java developers do not always fully grasp the full spectrum of security services provided by Java, nor are they always cognizant of the diverse vulnerabilities pertinent to web applications built with Java.

Beyond introducing the security components of Standard Java Edition, this course addresses security concerns within Java Enterprise Edition (JEE) and web services. The discussion of specific services begins with the fundamental principles of cryptography and secure communication. Through a series of exercises, participants explore declarative and programmatic security techniques in JEE, while also examining both transport-layer and end-to-end security for web services. The practical application of all discussed components is demonstrated through hands-on exercises, allowing participants to experiment with the relevant APIs and tools firsthand.

The course also examines and explains the most common and critical programming flaws associated with the Java language, platform, and web technologies. In addition to typical errors made by Java programmers, the identified security vulnerabilities encompass both language-specific issues and problems arising from the runtime environment. All vulnerabilities and their corresponding attack vectors are illustrated through accessible exercises, followed by recommended coding guidelines and potential mitigation strategies.

Participants attending this course will

• Grasp the fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and understand how to prevent them
• Comprehend the security concepts underlying web services
• Gain proficiency in utilizing various security features of the Java development environment
• Develop a practical understanding of cryptography
• Understand the security solutions available in Java EE
• Learn to identify typical coding mistakes and how to avoid them
• Receive information regarding recent vulnerabilities within the Java framework
• Acquire practical knowledge in using security testing tools
• Access resources and further readings on secure coding practices

Audience

Developers

Today, numerous programming languages are available for compiling code into the .NET and ASP.NET frameworks. While this environment offers robust tools for security development, it is essential for developers to understand how to apply architecture-level and code-level programming techniques. Doing so ensures the implementation of desired security features while preventing vulnerabilities or limiting their potential exploitation.

This course aims to instruct developers through extensive hands-on exercises on how to prevent untrusted code from executing privileged actions, secure resources via strong authentication and authorization, manage remote procedure calls, handle sessions, and implement diverse functionality patterns.

The introduction to various vulnerabilities begins by highlighting typical programming errors common in .NET development. The discussion on ASP.NET vulnerabilities further explores various environment configurations and their impact. Finally, the section on ASP.NET-specific issues addresses general web application security challenges as well as specific concerns and attack vectors, such as ViewState attacks and string termination exploits.

Participants attending this course will

• Grasp the fundamental concepts of security, IT security, and secure coding practices
• Identify web vulnerabilities extending beyond the OWASP Top Ten and learn strategies to avoid them
• Master the use of various security features within the .NET development environment
• Acquire practical expertise in utilizing security testing tools
• Recognize common coding mistakes and understand how to prevent them
• Stay informed about recent vulnerabilities affecting .NET and ASP.NET
• Access resources and additional readings on secure coding practices

Audience

Developers

This course equips PHP developers with the essential skills required to fortify their applications against modern internet-based threats. The curriculum explores web vulnerabilities through practical PHP examples, extending beyond the OWASP Top Ten to cover various injection attacks, script injections, session handling exploits, insecure direct object references, file upload issues, and more. PHP-specific vulnerabilities are categorized into standard types such as inadequate or improper input validation, faulty error and exception handling, misuse of security features, and time- and state-related problems. For the latter category, we examine attacks like open_basedir circumvention, denial-of-service via magic float, and hash table collision attacks. In each scenario, participants will master the key techniques and functions needed to mitigate these risks.

Special emphasis is placed on client-side security, addressing JavaScript, Ajax, and HTML5 vulnerabilities. The course introduces critical PHP extensions for cryptography (hash, mcrypt, OpenSSL) and input validation (Ctype, ext/filter, HTML Purifier). Best practices for hardening are provided in the context of PHP configuration (php.ini), Apache settings, and general server security. Additionally, an overview of security testing tools and techniques available to developers and testers is offered, including security scanners, penetration testing methodologies, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.

Both the introduction of vulnerabilities and the configuration best practices are reinforced through hands-on exercises. These sessions demonstrate the impact of successful attacks, guide participants in applying mitigation techniques, and introduce the utilization of various extensions and tools.

Participants attending this course will

• Grasp fundamental concepts of security, IT security, and secure coding
• Identify web vulnerabilities beyond the OWASP Top Ten and learn how to prevent them
• Understand client-side vulnerabilities and adopt secure coding practices
• Gain a practical understanding of cryptography
• Learn to utilize various PHP security features
• Awareness of typical coding mistakes and strategies to avoid them
• Stay informed about recent PHP framework vulnerabilities
• Acquire practical skills in using security testing tools
• Access sources and further reading on secure coding practices

Audience

Developers

The Combined SDL Core training provides an in-depth look at secure software design, development, and testing, guided by the Microsoft Secure Development Lifecycle (SDL). This course offers a Level 100 overview of the fundamental building blocks of the SDL, followed by design techniques to identify and rectify vulnerabilities during the early stages of the development process.

During the development phase, the course covers typical security-related programming bugs found in both managed and native code. Attack vectors associated with these vulnerabilities are presented alongside mitigation strategies, all illustrated through practical, hands-on exercises that provide participants with live hacking experience. The introduction to various security testing methods is followed by a demonstration of the effectiveness of different testing tools. Participants gain insight into how these tools operate by applying them to previously discussed vulnerable code through several practical exercises.

Participants attending this course will

Understand the fundamental concepts of security, IT security, and secure coding

Become familiar with the essential steps of the Microsoft Secure Development Lifecycle

Learn secure design and development practices

Learn about secure implementation principles

Understand security testing methodology

• Access sources and further readings on secure coding practices

Audience

Developers, Managers

In this instructor-led live course held in Italy, participants will acquire the skills to formulate a comprehensive security strategy to tackle the challenges of DevOps security.

The EC-Council Certified DevSecOps Engineer (ECDE) is a practical course designed to provide professionals with the skills necessary to embed security throughout the DevOps lifecycle, facilitating secure software development from the planning phase through to deployment.

This instructor-led, live training (available online or onsite) targets intermediate-level software and DevOps professionals who aim to integrate security practices into CI/CD pipelines, ensuring that code delivery is both secure and compliant.

Upon completion of this training, participants will be capable of:

• Grasping the core principles and practices of DevSecOps.
• Securing every stage of the CI/CD pipeline through the use of automated tools.
• Applying secure coding practices and conducting vulnerability scans.
• Preparing for the ECDE certification via practical labs and review sessions.

Course Format

• Interactive lectures and discussions.
• Hands-on experience with DevSecOps tools within simulated pipelines.
• Guided exercises centered on secure development and deployment processes.

Course Customization Options

• For customized training tailored to your team’s specific workflows or toolchains, please contact us to make arrangements.

This instructor-led live training in Italy (online or onsite) is designed for system administrators who wish to use FreeIPA to centralize the authentication, authorization, and account information for their organization's users, groups, and machines.

By the end of this training, participants will be able to:

• Install and configure FreeIPA.
• Manage Linux users and clients from a single central location.
• Use FreeIPA's CLI, Web UI and RPC interface to set up and manage permissions.
• Enable Single Sign On authentication across all systems, services and applications.
• Integrate FreeIPA with Windows Active Directory.
• Backup, replicate and migrate an FreeIPA server.

This instructor-led, live training in Italy (online or onsite) is designed for system administrators who wish to utilize Okta for identity and access management.

By the conclusion of this training, participants will be able to:

• Configure, integrate, and manage Okta.
• Integrate Okta into existing applications.
• Implement security using multi-factor authentication.

OpenLDAP is an open-source software implementation of the LDAP (Lightweight Directory Access Protocol), enabling the management and access to information directories. It is a popular directory server that can be used to store and share data about users, groups, network resources, and other objects within a network.