The story of our novel online training began a few years ago with a customer inquiry about an OWASP developer training on secure software development. As a PCI-DSS-certified company, our customer had to demonstrate annually that its software developers kept their skills current with regard to modern secure programming techniques. As proof, a certificate stating that one had read a book or (passively) attended a talk would actually have sufficed... But that can be neither in the spirit of the PCI DSS nor in the spirit of the software developers.
So it came about that we at binsec designed a two-day workshop built from equal parts theory and hands-on elements. While the first day covered the PCI DSS requirements for software developers and the OWASP Top 10, on the second day every training participant had to harden a vulnerable web application and then try to exploit the vulnerabilities remaining in their colleagues' applications. With every successful attack, the participants collected points, bringing them step by step closer to winning the prize - an Amazon voucher. All in all, the first part of the training went quite successfully, but the positive feedback on the second section stood out clearly. The participants were focused and engaged in trying to "outplay" each other, so their feedback came as no surprise to us: "Less theory, more practice, please."
In parallel with this developer training, we began holding various courses at universities, in which we gradually brought the hands-on portion to the forefront. As with our penetration testing lecture, from which our certification course "Binsec Academy Certified Pentest Professional (BACPP)" emerged, we at binsec also decided for our developer training "Secure Software Development Training" to make it the basis of something new: the hour of birth of the "Secure Coding Training" of the binsec academy:
In this online training on secure coding, the participant slips into the role of a team leader who is tasked with identifying the most widespread vulnerabilities (OWASP TOP 10) in a vulnerable REST API and fixing them in the source code. The clever part: as a programming language, the participant can choose PHP, Java, Python, Perl, Go, Ruby or Node.js, and is rewarded with our BACSCP certificate (Binsec Academy Certified Secure Coding Professional) once at least eight of the ten security flaws have been successfully removed. Certified BACSCP holders can
- identify the most widespread vulnerabilities in web applications and design security solutions,
- securely develop web applications in accordance with OWASP and PCI DSS, as well as
- conduct a secure code review in a structured manner.
After the first beta tests, we expanded our cooperation with universities in order to teach computer science students the fundamentals of secure software development. We hope that this allows us to make a significant contribution to application-oriented IT security.