Cyber Security Training Courses in the United Arab Emirates

Course goal:

To ensure that an individual has the core understanding of GRC processes and capabilities, and the skills to integrate governance, performance management, risk management, internal control, and compliance activities.

Overview:

• GRC Basic terms and definitions
• Principles of GRC
• Core components, practices and activities
• Relationship of GRC to other disciplines

Learning Objectives

This COBIT 2019 Foundation course is designed as an introduction to COBIT 2019 and enables you to understand how an integrated business framework for the governance and management of enterprise IT can be utilized to achieve IT business integration, cost reductions and increased productivity. The syllabus areas that this course is designed to cover are:

• New framework introduction
• Key concepts and terminology
• Governance and Framework Principles
• Governance system and components
• Governance and management objectives
• Performance management
• Designing a tailored governance system

Audiance

All staff who need a working knowledge of Compliance and the Management of Risk

Format of the course

A combination of:

• Facilitated Discussions
• Slide Presentations
• Case Studies
• Examples

Course Objectives

By the end of this course, delegates will be able to:

• Understand the major facets of Compliance and the national and international efforts being made to manage the risk related to it
• Define the ways in which a company and its staff might set up a Compliance Risk Management Framework
• Detail the roles of Compliance Officer and Money Laundering Reporting Officer and how they should be integrated into a business
• Understand some other “hot spots” in Financial Crime – especially as they relate to International Business, Offshore Centres and High-Net-Worth Clients

There is an international emphasis in tackling money laundering. Compliance officers, AML Officers, MLRO’s, KYC analysts, Auditors and Managers need to understand how to ensure compliance with the Subsidiary 373.01, Prevention of Money Laundering and Funding of Terrorism Regulations (PMLFTR).

Under the PMLFTR all Subject Persons, including those within the regulated financial services sector, are required to appoint a Money Laundering Reporting Officer (MLRO).

This is a practical course that gives you knowledge and necessary guidance in how to approach AML compliance at your organisation, with special attention to the regulatory environment in Malta.

This instructor-led, live training in UAE (online or onsite) is aimed at developers and administrators who wish to produce software and products that are HiTRUST compliant.

By the end of this training, participants will be able to:

• Understand the key concepts of the HiTrust CSF (Common Security Framework).
• Identify the HITRUST CSF administrative and security control domains.
• Learn about the different types of HiTrust assessments and scoring.
• Understand the certification process and requirements for HiTrust compliance.
• Know the best practices and tips for adopting the HiTrust approach.

Description:

Basel III is a global regulatory standard on bank capital adequacy, stress testing and market liquidity risk. Having initially been agreed upon by the Basel Committee on Banking Supervision in 2010–11, changes to The Accord have extended implementation to 31st March 2019. Basel III strengthens bank capital requirements by increasing bank liquidity and decreasing bank leverage.
Basel III differs from Basel I & II in that it requires different levels of reserves for different forms of deposits and other types of borrowings, so it does not supersede them so much as it does work alongside Basel I and Basel II.
This complex and constantly changing landscape can be hard to keep up with, our course and training will help you manage likely changes and their impact on your institution. We are accredited with and a training partner to the Basel Certification Institute and as such the quality and suitability of our training and material is guaranteed to be up to date and effective

Objectives:

• Preparation for the Certified Basel Professional Examination.
• Define hands-on strategies and techniques for the definition, measurement, analysis, improvement, and control of operational risk within a banking organization.

Target Audience:

• Board members with risk responsibilities
• CROs and Heads of Risk Management
• Members of the Risk Management team
• Compliance, legal and IT support staff
• Equity and Credit Analysts
• Portfolio Managers
• Rating Agency Analysts

Overview:

• Introduction to Basel norms and amendments to the Basel Accord (III)
• Regulations for market, credit, counterparty and liquidity risk
• Stress testing for various risk measures including how to formulate and deliver stress tests
• The likely effects of Basel III on the international banking industry, including demonstrations of its practical application
• Need For The New Basel Norms
• The Basel III Norms
• Objectives of The Basel III Norms
• Basel III – Timeline

Description:

This four day event (CGEIT training) is the ultimate preparation for exam time and is designed to ensure that you pass the challenging CGEIT exam on your first attempt.
The CGEIT qualification is an internationally recognised symbol of excellence in IT governance awarded by ISACA. It is designed for professionals responsible for managing IT governance or with significant advisory or assurance responsibility for IT governance.
Achieving CGEIT status will provide you with wider recognition in the marketplace, as well as increased influence at executive level.

Objectives:

This seminar has been designed to prepare Delegates for the CGEIT examination by enabling them to supplement their existing knowledge and understanding to be better prepared to pass the exam, as defined by ISACA.

Target Audience:

Our training course is for IT and business professionals, with significant IT governance experience who are undertaking the CGEIT exam.

This instructor-led, live training in UAE (online or onsite) is aimed at payment services compliance professionals who wish to create, implement, and enforce a compliance program within an organization.

By the end of this training, participants will be able to:

• Understand the rules set forth by government regulators for payment service providers.
• Create the internal policies and procedures needed to satisfy government regulations.
• Implement a compliance program that adheres to relevant laws.
• Ensures that all corporate processes and procedures comply with the compliance program.
• Uphold the business's reputation while protecting it from lawsuits.

A CISSP is an information assurance professional who defines the architecture, design, management and/or controls that assure the security of business environments. The vast breadth of knowledge and the experience it takes to pass the exam is what sets a CISSP apart. The credential demonstrates a globally recognized level of competence provided by the (ISC)2® CBK®, which covers critical topics in security today, including cloud computing, mobile security, application development security, risk management and more.

This course helps you review the 10 domains of the information security practices. It also serves as a strong learning tool for mastering concepts and topics related to all aspects of information systems security.

Objectives:

• To review of the main topics of CISSP CBK (Common Body of Knowledge).
• To prepare for a CISSP examination

Overview:

Certified Information Systems Security Professional certification is recognised as a key qualification for developing a senior career in information security, audit and IT governance management. Held by over 30,000 qualified professionals worldwide, the Certified Information Systems Security Professional qualification shows proven knowledge and is the key to a higher earning potential in roles that include CISO, CSO and senior security manager.

You will learn to:

• Use the knowledge gained in a practical manner beneficial to your organisation
• Protect your organisational assets using access control techniques and strengthen confidentiality and integrity controls from the world of cryptography
• Secure your network architecture and design (implement Cyber security)
• Achieve your organisational objectives such as legal & compliance, Information assurance, security and data governance
• Enhance IT services secure delivery via Security operations, architecture and design principles
• Implement business resiliency via Business Continuity Plan
• You will gain a thorough understanding of the 8 domains as prescribed by (ISC)2®.

The Main Goal:

• To pass your CISSP examination first time.

Target Audience:

This training is intended for individuals preparing for the CISSP certification exam.

Description:

This course is the non-certifcation version of the "CISA - Certified Information Systems Auditor" course. CISA® is the world-renowned and most popular certification for professionals working in the field of IS audit and IT risk consulting.

Objectives:

• Use the knowledge gained to benefit your organisation
• Provide audit services in accordance with IT audit standards
• Provide assurance on leadership and organizational structure and processes
• Provide assurance on acquisition/ development, testing and implementation of IT assets
• Provide assurance on IT operations including service operations and third party
• Provide assurance on organization’s security policies, standards, procedures, and controls to ensure confidentiality, integrity, and availability of information assets.

Target Audience:

Finance/CPA professionals, I.T. professionals, Internal & External auditors, Information security, and risk consulting professionals.

This instructor-led, live training in UAE (online or onsite) is aimed at engineers who wish to learn the methods and tools needed to protect their organization's information systems against attack.

By the end of this training, participants will be able to:

• Understand information security at both the computer level, as well as the communications level.
• Prevent physical and digital access to private information systems.
• Prevent the modification of information that is stored, being processed, or being transmitted.
• Protect against denial of service to authorized users.
• Take the necessary measures to detect, document, and counter security threats.
• Ensure that organizational information is kept confidential.

The training takes the form of a workshop supplemented with substantive knowledge. Classes are based on the official CISA certificate framework. During the workshop, case studies will be discussed in discussing specific issues. Classes will be conducted in English (on request in Polish) based on the ISACA handbook in English.
An exam voucher of US $ 760 is included in the training. (ISACA Member: US $575).

CISA Exam Material Scope:

• Information System Auditing Process (21%)
• Governance and Management of IT (17%) 
• Information Systems Acquisition, Development and implementation (12%)
• Information Systems Operation and Business Resilience (23%)
• Protection of Information Assets (27%)

Duration of the exam: 4 hours
Type: multiple choice test
Volume: 200 questions

List of the requirements that you must meet in order to be able to claim the CISA qualification: 

1. Pass the CISA exam. The CISA passing score is a mark of 450 or higher on the exam.
2. Abide by the ISACA Code of Professional Ethics 
3. Promise to obey the CISA Continuing Professional Education Policy
4. Gain at least 5 years of professional information systems auditing, control or security work experience.
5. Comply with Information Systems Auditing Standards

If you’ve passed the exam and believe that you meet those requirements, then you can begin the application for certification: here
There is a fee of $50 for this application.

There’s also a yearly fee that you must pay to maintain this certification after you’ve been granted it. The fee is $40 per annum for ISACA members, and $75 for non-members.

A thorough, practical, 3 day course designed to provide the knowledge and skills required to manage information security, information assurance or information risk based processes. The CISMP course is aligned with the latest national information assurance frameworks (IAMM), as well as ISO/IEC 27002 & 27001; the code of practice and standard for information security. This course is a CESG Certified Training (CCT) course.

The course follows the latest BCS syllabus and prepares delegates for the 2 hour multiple choice BCS examination.

This qualification provides delegates with detailed knowledge of the concepts relating to information security; (confidentiality, integrity, availability, vulnerability, threats, risks and countermeasures), along with an understanding of current legislation and regulations which impact information security management. Award holders will be able to apply the practical principles covered throughout the course ensuring normal business processes become robust and more secure.

The training is directed to all operating systems administrators, who plan to implement a public key infrastructure based on MS Windows Server 2012 R2 and plan to use qualified electronic signature certificates. 

The participants will learn about the basic issues related to the implementation of public key infrastructure, and also with the idea of ​​applying the latest cryptographic solutions for securing information systems. 

On the basis of MS Windows Server 2012 R2 are discussed possibilities of using certification services for the enterprise.During the training in a virtual environment is installed complete certification center and discuss the most important issues related to the management and administration of public key infrastructure in an Active Directory domain.

The training includes theoretical and practical knowledge on the use of electronic signatures issued by certification centers in Poland under the "Act on Electronic Signatures." These are legal issues, legal requirements, as well as examples of the use of certificates of electronic signatures in Poland.

The participants will gain the knowledge needed to create electronic correspondence relating to communication with the public authorities and other services that allow or require the use of a type of ID.

This class will help the attendees to scan, test, hack and secure their own systems. To gain an in-depth knowledge and practical experience with the current essential security systems. The attendees will get to know how perimeter defences work and then be led into scanning and attacking their own networks, no real network is harmed. The attendees then will learn how intruders escalate privileges and what steps can be taken to secure a system, Intrusion Detection, Policy Creation, Social Engineering, DDoS Attacks, Buffer Overflows and Virus Creation.

Description:

Disclaimer: Please be advised that this updated CISM exam content outline is applicable to exams starting 1 June 2022.

CISM® is the most prestigious and demanding qualification for Information Security Managers around the globe today. This qualification provides you with a platform to become part of an elite peer network who have the ability to constantly learn and relearn the growing opportunities/ challenges in Information Security Management.

Our CISM training methodology provides an in-depth coverage of contents across the Four CISM domains with a clear focus on building concepts and solving ISACA released CISM exam questions. The course is an intense training and hard-core exam preparation for ISACA’s Certified Information Security Manager (CISM®) Examination.

Our instructors encourage all attending delegates to go through the ISACA released CISM QA&E (Questions, Answers and Explanations) as exam preparation - you get this FREE as part of our course. The QA&E is exceptional in helping delegates understand the ISACA style of questions, approach to solving these questions and it helps rapid memory assimilation of the CISM concepts during live classroom sessions.
All our trainers have extensive experience in delivering CISM training. We will thoroughly prepare you for the CISM examination.

Goal:

The ultimate goal is to pass your CISM examination first time.

Objectives:

• Use the knowledge gained in a practical manner beneficial to your organisation
• Establish and maintain an Information security governance framework to achieve your organization goals and objectives
• Manage Information risk to an acceptable level to meet the business and compliance requirements
• Establish and maintain information security architectures (people, process, technology)
• Integrate information security requirements into contracts and activities of third parties/ suppliers
• Plan, establish and manage the capability to detect, investigate, respond to and recover from information security incidents to minimize business impact

Target Audience:

• Security professionals with 3-5 years of front-line experience
• Information security managers or those with management responsibilities
• Information security staff, information security assurance providers who require an in-depth understanding of information security management including: CISO’s, CIO’s, CSO’s, privacy officers, risk managers, security auditors and compliance personnel, BCP / DR personnel, executive and operational managers responsible for assurance functions

Description:

Cybersecurity skills are in high demand, as threats continue to plague enterprises around the world. An overwhelming majority of professionals surveyed by ISACA recognise this and plan to work in a position that requires cybersecurity knowledge.
To fill this gap, ISACA has developed the Cybersecurity Fundamentals Certificate, which provides education and verification of skills in this area.

Objectives:

With cybersecurity threats continuing to rise and the shortage of appropriately-equipped security professionals growing worldwide, ISACA's Cybersecurity Fundamentals Certificate programme is the perfect way to quickly train entry-level employees and ensure they have the skills and knowledge they need to successfully operate in the Cyber arena.

Target Audience:

The certificate program is also one of the best ways to gain foundational knowledge in cybersecurity and begin to build your skills and knowledge in this crucial area.

Network security begins at the physical level. In this instructor-led, live training in UAE, participants will learn the security risks related to computer server rooms and how to tighten security through smart practices, planning and technology implementation.

By the end of this training, participants will be able to:

• Assess their organization's security risk, as it relates to computer server rooms.
• Set up control and monitoring systems to restrict physical access to infrastructure.
• Design access policies for different members.
• Effectively communicate security policies with team members.

This instructor-led, live training in UAE (online or onsite) is aimed at IT administrators, security coordinators, and compliance managers who wish to identify, evaluate, and implement security policy management methods for their organization.

By the end of this training, participants will be able to develop, manage, and monitor security policies to protect their organization's information, network, and physical and software assets.

Description:

CISA® is the world-renowned and most popular certification for professionals working in the field of IS audit and IT risk consulting.

Our CISA course is an intense, very competitive and exam focused training course. With experience of delivering more than 150+ CISA trainings in Europe and around the world and training more than 1200+ CISA delegates, the Net Security CISA training material has been developed in house with the top priority of ensuring CISA delegates pass the ISACA CISA® Exam. The training methodology focuses on understanding the CISA IS auditing concepts and practicing large number of ISACA released question banks from the last three years. Over a period, CISA holders have been in huge demand with renowned accountings firms, global banks, advisory, assurance, and internal audit departments.

Delegates may have years of experience in IT auditing but perspective towards solving CISA questionnaires will solely depend on their understanding to globally accepted IT assurance practices. CISA exam is very challenging because the chance of a very tight clash between two possible answers exists and that is where ISACA tests you on your understanding in global IT auditing practices. To address these exam challenges, we always provide the best trainers who have extensive experience in delivering CISA training around the world.

The Net Security CISA manual covers all exam-relevant concepts, case studies, Q&A's across CISA five domains. Further, the Trainer shares the key CISA supporting material like relevant CISA notes, question banks, CISA glossary, videos, revision documents, exam tips, and CISA mind maps during the course.

Goal:

The ultimate goal is to pass your CISA examination first time.

Objectives:

• Use the knowledge gained in a practical manner beneficial to your organisation
• Provide audit services in accordance with IT audit standards
• Provide assurance on leadership and organizational structure and processes
• Provide assurance on acquisition/ development, testing and implementation of IT assets
• Provide assurance on IT operations including service operations and third party
• Provide assurance on organization’s security policies, standards, procedures, and controls to ensure confidentiality, integrity, and availability of information assets.

Target Audience:

Finance/CPA professionals, I.T. professionals, Internal & External auditors, Information security, and risk consulting professionals.

This course will give you the skills to build up information security according to ISO 27005, which is dedicated to information security risk management based on ISO 27001.

This instructor-led, live training in UAE (online or onsite) focuses on analyzing the risks of Open Data while reducing vulnerability to disaster or data loss.

By the end of this training, participants will be able to:

• Understand the concepts and benefits of Open Data.
• Identify the different types of data.
• Understand the risks of Open Data and how to mitigate them.
• Learn how to manage Open Data risks and create a contingency plan.
• Implement Open Data risk mitigation strategies to reduce disaster risk.

Description:

This is a 'Practitioner' course and leans heavily on practical exercises designed to reinforce the concepts being taught and to build the delegates' confidence in implementing business continuity management. The course is also designed to encourage debate, and the sharing of knowledge and experience between students.
Delegates will benefit from the practical and extensive experiences of ours trainers who are practicing business continuity management and ISO 22301:2012 specialists.

Delegates will learn how to:

• Explain the need for business continuity management (BCM) in all organisations
• Define the business continuity lifecycle
• Conducting business continuity programme management
• Understand their organisation sufficiently to identify mission-critical impact areas
• Determine their organisation's business continuity strategy
• Establish a business continuity response
• Exercise, maintain and review plans
• Embed business continuity in an organisation
• Define terms and definitions appropriate to business continuity

By the end of the course, delegates will have a detailed understanding of all the key components of business continuity management and be able to return to their work, making a significant contribution to the business continuity management process.

This is a one day Introduction to ISO27001

Why should you attend?

ISO/IEC 27005 training course enables you to comprehend the basic concepts of Information Security Risk Management by using the standard ISO/IEC 27005 as a reference framework.

By attending the ISO/IEC 27005 Introduction training course, you will understand the importance of Information Security Risk Management and the benefits that businesses, society and governments can obtain. 

Who should attend?

• Individuals interested in Information Security Risk Management
• Individuals seeking to gain knowledge about the main processes of Information Security Risk Management

ISO/IEC 27005 Foundation training enables you to learn the basic elements to manage Information Security Risks as specified in ISO/IEC 27005. During this training course, you will be able to understand the concepts and models of Information Security Risk Management.

After completing this course, you can sit for the exam and apply for the “PECB Certified ISO/IEC 27005 Foundation” credential. A PECB Foundation Certificate shows that you have understood the fundamental methodologies, processes and management approach.

Who should attend?

• Individuals interested in Information Security Risk Management
• Individuals seeking to gain knowledge about the main processes of Information Security Risk Management
• Individuals interested to pursue a career in Information Security Risk Management

The “PECB Certified ISO/IEC 27005 Foundation” exam fully meets the requirements of the PECB Examination and Certification Programme (ECP). The exam covers the following competency domains:

Domain 1: Fundamental principles and concepts of Risk Management in Information Security

Domain 2: Information Security Risk Management approaches and processes

After successfully completing the exam, you can apply for the “PECB Certified ISO/IEC 27005 Foundation” credential.

General Information

Certification fees are included in the exam price

• Training material containing over 200 pages of information and practical examples will be distributed
• A participation certificate of 14 CPD (Continuing Professional Development) credits will be issued
• In case of exam failure, you can retake the exam within 12 months for free

ISO/IEC 27005 Risk Manager training enables you to develop the competence to master the risk management process related to all assets of relevance for Information Security using the ISO/IEC 27005 standard as a reference framework.

During this training course, you will also gain a thorough understanding of best practices of risk assessment methods such as OCTAVE, EBIOS, MEHARI and harmonized TRA. This training course corresponds with the implementation process of the ISMS framework presented in the ISO/IEC 27001 standard.

After understanding all the necessary concepts of Information Security Risk Management based on ISO/IEC 27005, you can sit for the exam and apply for a “PECB Certified ISO/IEC 27005 Risk Manager” credential. By holding a PECB Risk Manager Certificate, you will be able to demonstrate that you have the necessary skills and knowledge to perform an optimal Information Security Risk Assessment and timely manage Information Security risks.

Who should attend?

• Information Security risk managers
• Information Security team members
• Individuals responsible for Information Security, compliance, and risk within an organization
• Individuals implementing ISO/IEC 27001, seeking to comply with ISO/IEC 27001 or involved in a risk management program
• IT consultants
• IT professionals
• Information Security officers
• Privacy officers

Examination - Duration: 2 hours

The “PECB Certified ISO/IEC 27005 Risk Manager” exam fully meets the requirements of the PECB Examination and Certification Programme (ECP). The exam covers the following competency domains:

• Domain 1 Fundamental principles and concepts of Information Security Risk Management
• Domain 2 Implementation of an Information Security Risk Management program
• Domain 3 Information Security risk management framework and process based on ISO/IEC 27005
• Domain 4 Other Information Security risk assessment methods

General information

• Certification fees are included on the exam price
• Training material containing over 350 pages of information and practical examples will be distributed
• A participation certificate of 21 CPD (Continuing Professional Development) credits will be issued
• In case of exam failure, you can retake the exam within 12 months for free

ISO/IEC 27005 Lead Risk Manager training enables you to acquire the necessary expertise to support an organization in the risk management process related to all assets of relevance for Information Security using the ISO/IEC 27005 standard as a reference framework. During this training course, you will gain a comprehensive knowledge of a process model for designing and developing an Information Security Risk Management program. The training will also contain a thorough understanding of best practices of risk assessment methods such as OCTAVE, EBIOS, MEHARI and harmonized TRA. This training course supports the implementation process of the ISMS framework presented in the ISO/IEC 27001 standard.

After mastering all the necessary concepts of Information Security Risk Management based on ISO/IEC 27005, you can sit for the exam and apply for a “PECB Certified ISO/IEC 27005 Lead Risk Manager” credential. By holding a PECB Lead Risk Manager Certificate, you will be able to demonstrate that you have the practical knowledge and professional capabilities to support and lead a team in managing Information Security Risks.

Who should attend?

• Information Security risk managers
• Information Security team members
• Individuals responsible for Information Security, compliance, and risk within an organization
• Individuals implementing ISO/IEC 27001, seeking to comply with ISO/IEC 27001 or individuals who are involved in a risk management program
• IT consultants
• IT professionals
• Information Security officers
• Privacy officers

Examination - Duration: 3 hours

The “PECB Certified ISO/IEC 27005 Lead Risk Manager” exam fully meets the requirements of the PECB Examination and Certification Programme (ECP). The exam covers the following competency domains:

• Domain 1 Fundamental principles and concepts of Information Security Risk Management
• Domain 2 Implementation of an Information Security Risk Management program
• Domain 3 Information security risk assessment
• Domain 4 Information security risk treatment
• Domain 5 Information security risk communication, monitoring and improvement
• Domain 6 Information security risk assessment methodologies

General Information

• Certification fees are included on the exam price
• Training material containing over 350 pages of information and practical examples will be distributed
• A participation certificate of 21 CPD (Continuing Professional Development) credits will be issued
• In case of exam failure, you can retake the exam within 12 months for free

ISO/IEC 27035 Introduction training course enables you to comprehend the basic concepts of managing Information Security Incidents.

By attending the ISO/IEC 27035 Introduction course, you will understand the importance of an Information Security Incident Management and the benefits that businesses, society and governments can obtain.

Who should attend?

• Individuals interested in Information Security Incident Management
• Individuals seeking to gain knowledge about the main processes of Information Security Incident Management

Learning objectives

• Understand the concepts, approaches, methods, and techniques used to manage Information Security Incidents
• Understand the Information Security Incident Management practices 

General Information

• Training material containing over 100 pages of information and practical examples will be distributed
• A participation certificate of 7 CPD (Continuing Professional Development) credits will be issued

ISO/IEC 27035 Foundation training enables you to learn the basic elements to implement an Incident Management Plan and manage Information Security Incidents. During this training course, you will be able to understand Information Security Incident Management processes.

After completing this course, you can sit for the exam and apply for the “PECB Certified ISO/IEC 27035 Foundation” credential. A PECB Foundation Certificate shows that you have understood the fundamental methodologies, requirements, and management approach.

Who should attend?

• Individuals interested in Information Security Incident Management process approaches
• Individuals seeking to gain knowledge about the main principles and concepts of Information Security Incident Management
• Individuals interested to pursue a career in Information Security Incident Management 

Learning objectives

• Understand the basic concepts of Information Security Incident Management
• Acknowledge the correlation between ISO/IEC 27035 and other standards and regulatory frameworks
• Understand the process approaches used to effectively manage Information Security Incidents

Educational approach

• Lecture sessions are illustrated with practical questions and examples
• Practical exercises include examples and discussions
• Practice tests are similar to the Certification Exam

General Information

• Certification fees are included on the exam price
• Training material containing over 200 pages of information and practical examples will be distributed
• A participation certificate of 14 CPD (Continuing Professional Development) credits will be issued
• In case of exam failure, you can retake the exam within 12 months for free

ISO/IEC 27035 Lead Incident Manager training enables you to acquire the necessary expertise to support an organization in implementing an Information Security Incident Management plan based on ISO/IEC 27035. During this training course, you will gain a comprehensive knowledge of a process model for designing and developing an organizational incident management plan. The compatibility of this training course with ISO/IEC 27035 also supports the ISO/IEC 27001 by providing guidance for Information Security Incident Management.

After mastering all the necessary concepts of Information Security Incident Management, you can sit for the exam and apply for a “PECB Certified ISO/IEC 27035 Lead Incident Manager” credential. By holding a PECB Lead Incident Manager Certificate, you will be able to demonstrate that you have the practical knowledge and professional capabilities to support and lead a team in managing Information Security Incidents.

Who should attend?

• Information Security Incident managers
• IT Managers
• IT Auditors
• Managers seeking to establish an Incident Response Team (IRT)
• Managers seeking to learn more about operating effective IRTs
• Information Security risk managers
• IT system administration professionals
• IT network administration professionals
• Members of Incident Response Teams
• Individuals responsible for Information Security within an organization

Learning objectives

• Master the concepts, approaches, methods, tools and techniques that enable an effective Information Security Incident Management according to ISO/IEC 27035
• Acknowledge the correlation between ISO/IEC 27035 and other standards and regulatory frameworks
• Acquire the expertise to support an organization to effectively implement, manage and maintain an Information Security Incident Response plan
• Acquire the competence to effectively advise organizations on the best practices of Information Security Incident Management
• Understand the importance of establishing well-structured procedures and policies for Incident Management processes
• Develop the expertise to manage an effective Incident Response Team

Educational approach

• This training is based on both theory and best practices used in the implementation of an Information Security Incident Management plan 
• Lecture sessions are illustrated with examples based on case studies
• Practical exercises are based on a case study which includes role playing and discussions
• Practice tests are similar to the Certification Exam

General Information

• Certification fees are included on the exam price
• Training material containing over 450 pages of information and practical examples will be distributed 
• A participation certificate of 31 CPD (Continuing Professional Development) credits will be issued 
• In case of exam failure, you can retake the exam within 12 months for free

The ISO/IEC 27701 Foundation training course is designed to help participants understand the basic concepts and principles of a Privacy Information Management System (PIMS) based on ISO/IEC 27701. Moreover, during this training course, students will learn more on the structure of the standard including its requirements, guidance and controls on the protection of the privacy of Personally Identifiable Information (PII) principals and the relationship of the standard with ISO/IEC 27001 and ISO/IEC 27002.

After completing this training course, you can sit for the exam and, if you successfully pass it, you can apply for the “PECB Certified ISO/IEC 27701 Foundation” credential. A PECB Foundation certificate proves that you have comprehended the fundamental methodologies, requirements, guidelines, framework and managerial approach.

Who should attend?

• Individuals involved in information security and privacy management
• Individuals seeking to gain knowledge on the main processes of a privacy information management system
• Individuals interested in pursuing a career in privacy information management
• Individuals responsible for personally identifiable information (PII) within organizations
• Information security team members

Learning objectives

• Understand the fundamental concepts and principles of a privacy information management system (PIMS) based on ISO/IEC 27701 
• Identify the relationship between ISO/IEC 27701, ISO/IEC 27001, ISO/IEC 27002, and other standards and regulatory frameworks 
• Understand the approaches, standards, methods, and techniques used for the implementation and management of a PIMS 

Educational approach

• Lecture sessions are complemented by discussions questions and examples
• The exercises include multiple-choice quizzes and essay-type exercises
• Exercise questions and quizzes are similar to the certification exam

General Information

• Participants will be provided with the training material containing over 200 pages of explanatory information, discussion topics, examples and exercises.
• An attendance record certificate of 14 CPD (Continuing Professional Development) credits will be issued to the participants who have attended the training course. 

The ISO/IEC 27701 Lead Implementer training course enables you to develop the necessary expertise to assist an organization to establish, implement, maintain and continually improve a Privacy Information Management System (PIMS) based on ISO/IEC 27701 by enhancing an existing ISMS based on ISO/IEC 27001 and the guidance of ISO/IEC 27002.

Why should you attend?

This training course is designed to prepare its participants implement a Privacy Information Management System (PIMS) in compliance with the requirements and guidance of the ISO/IEC 27701. Moreover, you will gain a comprehensive understanding of the best practices of privacy information management and learn how to manage and process data while complying with various data privacy regimes.

After mastering the implementation and management of a Privacy Information Management System (PIMS), you can sit for the exam and apply for a “PECB Certified ISO/IEC 27701 Lead Implementer” credential. The internationally recognized PECB Lead Implementer Certificate proves that you have the practical knowledge and professional capabilities to implement the ISO/IEC 27701 requirements in an organization.

Who should attend?

• Managers and consultants involved in privacy and data management 
• Expert advisors seeking to master the implementation of a Privacy Information Management System
• Individuals responsible and accountable for Personally Identifiable Information (PII) within organizations
• Individuals responsible for maintaining conformance with data privacy regimes requirements
• PIMS team members

Learning objectives

• Master the concepts, approaches, methods and techniques used for the implementation and effective management of a PIMS.
• Learn about the correlation between ISO/IEC 27701, ISO/IEC 27001, ISO/IEC 27002 and other standards and regulatory frameworks.
• Understand the operation of a PIMS based on ISO/IEC 27701 and its principal processes.
• Learn how to interpret the requirements of ISO/IEC 27701 in the specific context of an organization.
• Develop the expertise to support an organization in effectively planning, implementing, managing, monitoring and maintaining a PIMS.

Education approach

• This training course is based on both theory and best practices used in the implementation of PIMS.
• Lecture sessions are illustrated with examples based on case studies.
• Practical exercises are based on a case study which includes role playing and discussions.
• Practice tests are similar to the Certification Exam

General information

• Certification fees are included on the exam price.
• Training materials and practical examples will be distributed.
• A participation certificate of 31 CPD (Continuing Professional Development) credits will be issued.
• In case of exam failure, you can retake the exam within 12 months for free.

The ISO/IEC 27701 Lead Auditor training course enables you to develop the necessary skills to perform a Privacy Information Management System (PIMS) audit by applying widely recognized audit principles, procedures and techniques.

Why should you attend?

During this training course, you will obtain the knowledge and skills to plan and carry out audits in compliance with ISO 19011 and ISO/IEC 17021-1 certification process.

Based on practical exercises, you will be able to acquire knowledge on the protection of privacy in the context of processing personally identifiable information (PII), as well as master audit techniques and become competent to manage an audit program, audit team, establish communication with customers and resolve potential conflicts.

After completing this training course, you can sit for the exam and, if you successfully pass the exam, you can apply for the “PECB Certified ISO/IEC 27701 Lead Auditor” credential. The internationally recognized PECB Lead Auditor certificate proves that you have the capabilities and competences to audit organizations based on best practices.

Who should attend?

• Auditors seeking to perform and lead Privacy Information Management System (PIMS) certification audits
• Managers or consultants seeking to master a PIMS audit process
• Individuals responsible for maintaining conformance with PIMS requirements
• Technical experts seeking to prepare for a PIMS audit
• Expert advisors in the protection of Personally Identifiable Information (PII) 

Learning objectives

• Understand a Privacy Information Management System (PIMS) and its processes based on ISO/IEC 27701
• Identify the relationship between ISO/IEC 27701, ISO/IEC 27001, ISO/IEC 27002, and other standards and regulatory frameworks
• Acquire the competences of the auditor’s role in planning, leading, and following up on a management system audit in accordance with ISO 19011.
• Learn how to interpret the requirements of ISO/IEC 27701 in the context of a PIMS audit

Education approach

• This training is based on both theory and best practices used in PIMS audits
• Lecture sessions are illustrated with examples based on case studies
• Practical exercises are based on a case study which includes role-playing and discussions
• Practice tests are similar to the Certification Exam

General information

• Participants will be provided with the training material containing over 400 pages of explanatory information, discussion topics, examples and exercises.
• An attendance record certificate of 31 CPD (Continuing Professional Development) credits will be issued to the participants who have attended the training course.

Why should you attend?

ISO/IEC 27001 Foundation training allows you to learn the basic elements to implement and manage an Information Security Management System as specified in ISO/IEC 27001. During this training course, you will be able to understand the different modules of ISMS, including ISMS policy, procedures, performance measurements, management commitment, internal audit, management review and continual improvement.

After completing this course, you can sit for the exam and apply for the “PECB Certified ISO/IEC 27001 Foundation” credential. A PECB Foundation Certificate shows that you have understood the fundamental methodologies, requirements, framework and management approach.

Who should attend?

• Individuals involved in Information Security Management 
• Individuals seeking to gain knowledge about the main processes of Information Security Management Systems (ISMS)
• Individuals interested to pursue a career in Information Security Management

Educational approach

• Lecture sessions are illustrated with practical questions and examples
• Practical exercises include examples and discussions
• Practice tests are similar to the Certification Exam

Why should you attend?

ISO/IEC 27002 Introduction training course enables you to comprehend the Information Security Management Systems and Information Security Controls as specified in ISO/IEC 27002.

By attending the ISO/IEC 27002 Introduction training course, you will understand the importance of ISMS and Information Security Controls and the benefits that businesses, society and governments can obtain. 

Who should attend?

• Individuals interested in Information Security Management and Information Security Controls
• Individuals seeking to gain knowledge about the main processes of Information Security Management Systems and Information Security Controls

Learning objectives

• Understand the Information Security standards and Information Security Management practices used to implement and manage Information Security Controls
• Understand the controls necessary to manage Information Security risks

ISO/IEC 27001 Lead Auditor 

ISO/IEC 27001 Lead Auditor training enables you to develop the necessary expertise to perform an Information Security Management System (ISMS) audit by applying widely recognized audit principles, procedures and techniques.

Why should you attend?

During this training course, you will acquire the knowledge and skills to plan and carry out internal and external audits in compliance with ISO 19011 and ISO/IEC 17021-1 certification process.

Based on practical exercises, you will be able to master audit techniques and become competent to manage an audit program, audit team, communication with customers, and conflict resolution.

After acquiring the necessary expertise to perform this audit, you can sit for the exam and apply for a “PECB Certified ISO/IEC 27001 Lead Auditor” credential. By holding a PECB Lead Auditor Certificate, you will demonstrate that you have the capabilities and competencies to audit organizations based on best practices.

 Who should attend?

• Auditors seeking to perform and lead Information Security Management System (ISMS) certification audits
• Managers or consultants seeking to master an Information Security Management System audit process
• Individuals responsible for maintaining conformance with Information Security Management System requirements
• Technical experts seeking to prepare for an Information Security Management System audit 
• Expert advisors in Information Security Management

Learning objectives

• Understand the operations of an Information Security Management System based on ISO/IEC 27001 
• Acknowledge the correlation between ISO/IEC 27001, ISO/IEC 27002 and other standards and regulatory frameworks
• Understand an auditor’s role to: plan, lead and follow-up on a management system audit in accordance with ISO 19011
• Learn how to lead an audit and audit team
• Learn how to interpret the requirements of ISO/IEC 27001 in the context of an ISMS audit
• Acquire the competencies of an auditor to: plan an audit, lead an audit, draft reports, and follow-up on an audit in compliance with ISO 19011

Educational approach

• This training is based on both theory and best practices used in ISMS audits
• Lecture sessions are illustrated with examples based on case studies
• Practical exercises are based on a case study which includes role playing and discussions
• Practice tests are similar to the Certification Exam

ISO/IEC 27002 Lead Manager training enables you to develop the necessary expertise and knowledge to support an organization in implementing and managing Information Security controls as specified in ISO/IEC 27002. 

After completing this course, you can sit for the exam and apply for the “PECB Certified ISO/IEC 27002 Lead Manager” credential.  A PECB Lead Manager Certification, proves that you have mastered the principles and techniques for the implementation and management of Information Security Controls based on ISO/IEC 27002.

Who should attend?

• Managers or consultants seeking to implement an Information Security Management System (ISMS) based on ISO/IEC 27001 and ISO/IEC 27002
• Project managers or consultants seeking to master the Information Security Management System implementation process
• Individuals responsible for the information security, compliance, risk, and governance, in an organization
• Members of information security teams
• Expert advisors in information technology
• Information Security officers
• Privacy officers
• IT professionals
• CTOs, CIOs and CISOs

Learning objectives

• Master the implementation of Information Security controls by adhering to the framework and principles of ISO/IEC 27002
• Gain a comprehensive understanding of the concepts, approaches, standards, methods and techniques required for the effective implementation and management of Information Security controls
• Comprehend the relationship between the components of Information Security controls, including responsibility, strategy, acquisition, performance, conformance, and human behavior
• Understand the importance of information security for the strategy of the organization
• Master the implementation of information security management processes
• Master the formulation and implementation of security requirements and objectives

Educational approach

• This training is based on both theory and practice
• Sessions of lectures illustrated with examples based on real cases
• Practical exercises based on case studies
• Review exercises to assist the exam preparation
• Practice test similar to the certification exam

General Information

• Certification fees are included on the exam price
• Training material containing over 500 pages of information and practical examples will be distributed to the participants
• A participation certificate of 31 CPD (Continuing Professional Development) credits will be issued to the participants
• In case of exam failure, you can retake the exam within 12 months for free

ISO 27799 Foundation training enables you to learn the basic elements of Information security management and Information Security Controls in healthcare organizations as specified in ISO 27799 and ISO/IEC 27002. During this training course, you will be able to understand how ISO 27799 is related to ISO/IEC 27001 and ISO/IEC 27002.

After completing this course, you can sit for the exam and apply for the “PECB Certified ISO 27799 Foundation” credential. A PECB Foundation Certificate shows that you have understood the fundamental methodologies and management approach.

Who should attend?

• Individuals interested in Information Security Management applicable to the healthcare industry
• Individuals seeking to gain knowledge about the main processes of an Information Security Management System and Information Security Controls relevant to healthcare organizations
• Individuals interested to pursue a career in Information Security Management 

Learning objectives

• Understand the implementation of Information Security Controls in accordance with ISO 27799 and ISO/IEC 27002
• Acknowledge the correlation between ISO ISO/IEC 27001, ISO 27799, ISO/IEC 27002 and other standards and regulatory frameworks
• Understand the approaches, methods and techniques used for the implementation of Information Security Controls in healthcare organizations

Educational Approach

• Lecture sessions are illustrated with practical questions and examples
• Practical exercises include examples and discussions
• Practice tests are similar to the Certification Exam

General Information

• Certification fees are included on the exam price
• Training material containing over 200 pages of information and practical examples will be distributed
• A participation certificate of 14 CPD (Continuing Professional Development) credits will be issued
• In case of exam failure, you can retake the exam within 12 months for free

ISO 27799 Lead Manager training enables you to acquire the necessary expertise to support an organization in implementing and managing Information Security controls based on ISO 27799 and ISO/IEC 27002. During this training course, you will also gain a comprehensive knowledge of the best practices of Information Security Controls and how to improve Information Security within a healthcare organization. Additionally, this training enables you to develop the necessary expertise to support healthcare organizations in establishing, implementing, managing and maintaining an Information Security Management System (ISMS). Furthermore, during this training you will learn the complex and different factors that should be taken into account when dealing with information security issues within a healthcare organization.

After mastering all the necessary concepts of Information Security Controls, you can sit for the exam and apply for a “PECB Certified ISO 27799 Lead Manager” credential. By holding a PECB Lead Manager Certificate, you will be able to demonstrate that you have the practical knowledge and professional capabilities to support and lead a team in implementing and managing Information Security Controls in healthcare organizations based on ISO 27799 and ISO/IEC 27002.

Who should attend?

• Managers or consultants seeking to implement an Information Security Management System (ISMS) based on ISO/IEC 27001, ISO/IEC 27002 and ISO 27799
• Project managers or consultants seeking to master the Information Security Management System implementation process in healthcare organizations
• Individuals responsible for Information Security, compliance, risk, and governance in a healthcare organization
• Information Security team members
• Expert advisors in information technology
• Information Security officers
• Information Security managers
• Privacy officers
• IT professionals
• CTOs, CIOs and CISOs

Learning objectives

• Master the implementation of Information Security controls in healthcare organizations by adhering to the framework and principles of ISO 27799 and ISO/IEC 27002
• Master the concepts, approaches, standards, methods and techniques required for the implementation  and effective management of Information Security controls in healthcare organizations
• Comprehend the relationship between the components of Information Security controls, including responsibility, strategy, acquisition, performance, conformance, and human behavior
• Understand the importance of Information Security for the strategy of a healthcare organization
• Master the implementation of Information Security management processes
• Master the expertise to support a healthcare organization to effectively implement, manage and maintain Information Security Controls
• Master the formulation and implementation of Information Security requirements and objectives
• Master the development and administration of a health information security program, including: policies, procedures, risk assessment, security architectures etc. 

Information security threats and attacks increase and improve constantly. The best form of defense against them is the proper implementation and management of information security controls and best practices. Information security is also a key expectation and requirement of customers, legislators, and other interested parties.

This training course is designed to prepare participants in implementing an information security management system (ISMS) based on ISO/IEC 27001. It aims to provide a comprehensive understanding of the best practices of an ISMS and a framework for its continual management and improvement.

After attending the training course, you can take the exam. If you successfully pass it, you can apply for a “PECB Certified ISO/IEC 27001 Lead Implementer” credential, which demonstrates your ability and practical knowledge to implement an ISMS based on the requirements of ISO/IEC 27001.

Who Can Attend?

• Project managers and consultants involved in and concerned with the implementation of an ISMS 
• Expert advisors seeking to master the implementation of an ISMS
• Individuals responsible for ensuring conformity to information security requirements within an organization
• Members of an ISMS implementation team

General information

• Certification fees are included in the exam price
• Training material containing over 450 pages of information and practical examples will be distributed
• A participation certificate of 31 CPD (Continuing Professional Development) credits will be issued
• In case of exam failure, you can retake the exam within 12 months free of charge

Educational approach

• This training course contains essay-type exercises, multiple-choice quizzes, examples, and best practices used in the implementation of an ISMS.
• The participants are encouraged to communicate with each other and engage in discussions when completing quizzes and exercises. 
• The exercises are based on a case study. 
• The structure of the quizzes is similar to that of the certification exam.

Learning objectives

This training course will help you:

• Gain a comprehensive understanding of the concepts, approaches, methods, and techniques used for the implementation and effective management of an ISMS
• Acknowledge the correlation between ISO/IEC 27001, ISO/IEC 27002, and other standards and regulatory frameworks
• Understand the operation of an information security management system and its processes based on ISO/IEC 27001
• Learn how to interpret and implement the requirements of ISO/IEC 27001 in the specific context of an organization
• Acquire the necessary knowledge to support an organization in effectively planning, implementing, managing, monitoring, and maintaining an ISMS

This instructor-led, live training in UAE is aimed at engineers in telecommunication companies who wish to set up an end-to-end digital identity management system.

By the end of this training, participants will be able to:

• Understand, evaluate and adopt different approaches to managing usernames and passwords.
• Setup a single login system that works across all applications used in a telecom environment.
• Use identity technology to get a clear understanding of their customers and their needs. 
• Implement an authentication system that works across different platforms (laptop, mobile, etc.).

Who is it for:

Anyone with an interest in information security, whether as a career or for general business knowledge.

This certificate is relevant to anyone requiring an understanding of Information Security Management Principles as well as those with an interest in information security either as a potential career or as an additional part of their general business knowledge. It is very much a firm foundation on which other qualifications can be built or which provides a thorough general understanding to enable organisations to begin to ensure their information is protected appropriately.

What will I learn:

Candidates should be able to demonstrate: 

• Knowledge of the concepts relating to information security management. 
• Understanding of current national legislation and regulations which impact upon information security management. 
• Awareness of current national and international standards, frameworks and organisations which facilitate the management of information security.  
• Understanding of the current business and common technical environments in which information security management must operate. 
• Knowledge of the categorisation, operation and effectiveness of controls of different types and characteristics. 

Note: This is the four day course which adds one additional day to the standard delivery to provide more time for exam preparation and practice exercises.

Who is it for:

Anyone with an interest in information security, whether as a career or for general business knowledge.

This certificate is relevant to anyone requiring an understanding of Information Security Management Principles as well as those with an interest in information security either as a potential career or as an additional part of their general business knowledge. It is very much a firm foundation on which other qualifications can be built or which provides a thorough general understanding to enable organisations to begin to ensure their information is protected appropriately.

What will I learn:

Candidates should be able to demonstrate: 

• Knowledge of the concepts relating to information security management. 
• Understanding of current national legislation and regulations which impact upon information security management. 
• Awareness of current national and international standards, frameworks and organisations which facilitate the management of information security.  
• Understanding of the current business and common technical environments in which information security management must operate. 
• Knowledge of the categorisation, operation and effectiveness of controls of different types and characteristics.

Who is it for:

Security professionals looking to understand the technical and business aspects of the profession or anyone looking to work in the field of security architecture.

• System Administrators who wish to become security architects
• Technical architects looking to move into the field of security architecture 

This certificate also offers a complimentary certification for those awarded or looking to achieve CCP status in IA.

What will I learn:

Candidates should be able to:

• Describe the business environment and the information risks that apply to the systems.
• Describe and apply security design principles.
• Identify information risks that arise from potential solution architectures.
• Design alternate architectures or countermeasures to mitigate identified information risks.
• Ensure that proposed architectures and countermeasures adequately mitigate identified information risks.
• Apply ‘standard’ security techniques and architectures to mitigate security risks.
• Develop new architectures that mitigate the risks posed by new technologies and business practices.
• Provide consultancy and advice to explain Information Assurance and architectural problems.
• Security configure ICT systems in compliance with their approved security architectures.

Who is it for:

Anyone who is involved in the areas of information security and information assurance. 

The certificate is relevant to anyone requiring an understanding of Business Continuity Management as well as those who are involved in the areas of information security and information assurance.

What will I learn:

Candidates should be able to demonstrate: 

• The function of and need for business continuity management within an organisation
• The business continuity management life cycle
• The main components of a business continuity management programme
• The need for risk assessment within business continuity management
• The options for development of a business continuity management strategy
• How to prepare and develop plans for business continuity management response  
• The need for exercising, maintenance and review of plans 
• The need for embedding business continuity management awareness within the organisation 

Who is it for:

Anyone who is involved in the areas of information security and information assurance.

What will I learn:

Candidates should be able to demonstrate:

• How the management of information risk will bring about significant business benefits.
• How to explain and make full use of information risk management terminology.
• How to conduct threat and vulnerability assessments, business impact analyses and risk assessments.
• The principles of controls and risk treatment.
• How to present the results in a format which will form the basis of a risk treatment plan.
• The use of information classification schemes.

Learn how to investigate, respond to, and hunt for threats using Microsoft Azure Sentinel, Azure Defender, and Microsoft 365 Defender. In this course you will learn how to mitigate cyberthreats using these technologies. Specifically, you will configure and use Azure Sentinel as well as utilize Kusto Query Language (KQL) to perform detection, analysis, and reporting. The course was designed for people who work in a Security Operations job role and helps learners prepare for the exam SC-200: Microsoft Security Operations Analyst.

Audience Profile

The Microsoft Security Operations Analyst collaborates with organizational stakeholders to secure information technology systems for the organization. Their goal is to reduce organizational risk by rapidly remediating active attacks in the environment, advising on improvements to threat protection practices, and referring violations of organizational policies to appropriate stakeholders. Responsibilities include threat management, monitoring, and response by using a variety of security solutions across their environment. The role primarily investigates, responds to, and hunts for threats using Microsoft Azure Sentinel, Azure Defender, Microsoft 365 Defender, and third-party security products. Since the Security Operations Analyst consumes the operational output of these tools, they are also a critical stakeholder in the configuration and deployment of these technologies.

Job role: Security Engineer

Preparation for exam: SC-200

Features: none

Skills gained

• Explain how Microsoft Defender for Endpoint can remediate risks in your environment
• Create a Microsoft Defender for Endpoint environment
• Configure Attack Surface Reduction rules on Windows 10 devices
• Perform actions on a device using Microsoft Defender for Endpoint
• Investigate domains and IP addresses in Microsoft Defender for Endpoint
• Investigate user accounts in Microsoft Defender for Endpoint
• Configure alert settings in Microsoft Defender for Endpoint
• Explain how the threat landscape is evolving
• Conduct advanced hunting in Microsoft 365 Defender
• Manage incidents in Microsoft 365 Defender
• Explain how Microsoft Defender for Identity can remediate risks in your environment
• Investigate DLP alerts in Microsoft Cloud App Security
• Explain the types of actions you can take on an insider risk management case
• Configure auto-provisioning in Azure Defender
• Remediate alerts in Azure Defender
• Construct KQL statements
• Filter searches based on event time, severity, domain, and other relevant data using KQL
• Extract data from unstructured string fields using KQL
• Manage an Azure Sentinel workspace
• Use KQL to access the watchlist in Azure Sentinel
• Manage threat indicators in Azure Sentinel
• Explain the Common Event Format and Syslog connector differences in Azure Sentinel
• Connect Azure Windows Virtual Machines to Azure Sentinel
• Configure Log Analytics agent to collect Sysmon events
• Create new analytics rules and queries using the analytics rule wizard
• Create a playbook to automate an incident response
• Use queries to hunt for threats
• Observe threats over time with livestream

Audience:

System Administrators and Network Administrators as well as anyone who is interested in defensive network security technologies.

NetNORAD is a system built by Facebook to troubleshoot network problems via end-to-end probing, independent of device polling.

In this instructor-led, live training, participants will learn how NetNORAD and active path testing can help them improve their network troubleshooting methods.

By the end of this training, participants will be able to:

• Understand how NetNORAD works
• Learn the design principles behind NetNORAD
• Use open-source NetNORAD tools with their own code to implement a fault detection system

Audience

• Network engineers
• Developers
• System engineers

Format of the course

• Part lecture, part discussion, exercises and heavy hands-on practice

BeyondCorp is an open source Zero Trust security framework that allows employees to work securely from any location without the need for a traditional VPN.

In this instructor-led, live training, participants will learn hands-on how to set up a Zero Security system as they set up and deploy BeyondCorop in a live-lab environment.

By the end of this training, participants will be able to:

• Assess their organization's existing security model.
• Shift access controls from the perimeter to individual devices and users.
• Deploy applications using a user and device-centric authentication and authorization workflow.
• Understand, plan and implement a Zero Trust network within their organization.

Audience

• Network engineers
• Cyber security professionals
• System architects
• IT managers

Format of the Course

• Part lecture, part discussion, exercises and heavy hands-on practice

Note

• To request a customized training for this course, please contact us to arrange.

Why should you attend?

The Certified Lead Ethical Hacker training course enables you to develop the necessary expertise to perform information system penetration tests by applying recognized principles, procedures and penetration testing techniques, in order to identify potential threats on a computer network. During this training course, you will gain the knowledge and skills to manage a penetration testing project or team, as well as plan and perform internal and external pentests, in accordance with various standards such as the Penetration Testing Execution Standard (PTES) and the Open Source Security Testing Methodology Manual (OSSTMM). Moreover, you will also gain a thorough understanding on how to draft reports and countermeasure proposals. Additionally, through practical exercises, you will be able to master penetration testing techniques and acquire the skills needed to manage a pentest team, as well as customer communication and conflict resolution.  

The Certified Lead Ethical Hacking training course provides a technical vision of information security through ethical hacking, using common techniques such as information gathering and vulnerability detection, both inside and outside of a business network.

The training is also compatible with the NICE (The National Initiative for Cybersecurity Education) Protect and Defend framework. 

After mastering the necessary knowledge and skills in ethical hacking, you can take the exam and apply for the "PECB Certified Lead Ethical Hacker" credential. By holding a PECB Lead Ethical Hacker certificate, you will be able to demonstrate that you have acquired the practical skills for performing and managing penetration tests according to best practices. 

Who should attend?

• Individuals interested in IT Security, and particularly in Ethical Hacking, to either learn more about the topic or to start a process of professional reorientation.
• Information security officers and professionals seeking to master ethical hacking and penetration testing techniques.
• Managers or consultants wishing to learn how to control the penetration testing process.
• Auditors wishing to perform and conduct professional penetration tests.
• Persons responsible for maintaining the security of information systems in an organization.
• Technical experts who want to learn how to prepare a pentest.
• Cybersecurity professionals and information security team members.

Advanced PHP and Secure Coding Course

This instructor-led, live training in UAE (online or onsite) is aimed at security engineers and system administrators who wish to integrate more security into their Ubuntu Linux distribution and protect their system from threats.

By the end of this training, participants will be able to:

• Install and configure Ubuntu operating system.
• Reinforce the physical security of Ubuntu Linux distribution.
• Embed encrypted server features to protect the administration system.
• Secure device interactions within the Ubuntu System.
• Recognize general security threats to Ubuntu environment and execute the proper solutions.

The course is providing practical knowledge on OpenStack and private cloud security. It starts from the introduction to the system, then the participants are getting practical knowledge on security in private clouds and securing OpenStack installation.

This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems. The lab intensive environment gives each student in-depth knowledge and practical experience with the current essential security systems. Students will begin by understanding how perimeter defenses work and then be lead into scanning and attacking their own networks, no real network is harmed. Students then learn how intruders escalate privileges and what steps can be taken to secure a system. Students will also learn about Intrusion Detection, Policy Creation, Social Engineering, DDoS Attacks, Buffer Overflows and Virus Creation. When a student leaves this intensive 5 day class they will have hands on understanding and experience in Ethical Hacking.

The purpose of the Ethical Hacking Training is to:

• Establish and govern minimum standards for credentialing professional information security specialists in ethical hacking measures.
• Inform the public that credentialed individuals meet or exceed the minimum standards.
• Reinforce ethical hacking as a unique and self-regulating profession.

Audience:

The Course is ideal for those working in positions such as, but not limited to:

• Security Engineers
• Security Consultants
• Security Managers
• IT Director/Managers
• Security Auditors
• IT Systems Administrators
• IT Network Administrators
• Network Architects
• Developers

This course covers the basic concepts of security and IT Security, with an emphasis on defending against network attacks. Participants will gain an understanding of essential security protocols and security concepts of web services. Recent attacks against cryptosystems and some recent related vulnerabilities will be referrenced

This course discusses how to manage an incident response team, how the first responder act, given the frequency and complexity of today's cyber attacks, incident response is a critical function for organizations. Incident response is the last line of defense, detecting and efficiently responding to incidents requires strong management processes, and managing an incident response team requires special skills and knowledge
 

Objectives:

To prepare the student for the Ethical Hacking and Countermeasures examination. On passing this examination you will be awarded the Certified Ethical Hacker certification

Target Audience:

This course will significantly benefit security officers, auditors, security professionals, site administrators, and anyone who is concerned about the integrity of the network infrastructure.

Format of the Course

• Interactive lecture and discussion.
• Lots of exercises and practice.
• Hands-on implementation in a live-lab environment.

Course Customization Options

• To request a customized training for this course, please contact us to arrange

• After this one day seminar the attendee will be able to demonstrate knowledge and understanding of Cloud Computing.

The RESILIA  course starts with the purpose, key terms, the distinction between resilience and security, and the benefits of implementing cyber resilience. It introduces risk management and the key activities needed to address risks and opportunities. Further, it explains the relevance of common management standards and best practice frameworks to achieve cyber resilience. Subsequently, it identifies the cyber resilience processes, the associated control objectives, interactions and activities that should be aligned with corresponding ITSM activities. In the final part of the course, it describes the segregation of duties and dual controls related to cyber resilience roles and responsibilities.    
 

This course explore the technical skills to implement, monitor and administer IT infrastructure using information security policies and procedures. And how to protecting the confidentiality, integrity and availability of data.    
 

This course provides leaders and managers an overview of issues and activities associated with cybersecurity.

Leaders will receive information in various topics that will build their knowledge and hone executive decision-making in regard to the cybersecurity threat.    
 

This course cover the basics of PKI, the basics of encryption, the Encrypting File System currently used by Windows 7 and Windows 8, the creation of a PKI using a variety of software and looking at tools which can exploit flaws in the implementation of a PKI.     
 

This course cover the considertion of security and Privacy in the architecture, and how to design the security in the preperation of the design phase, the course also cover many technical controls to be designed in the architecture.

This two days course s designed for those with some data protection responsibilities in an
organization or who, for other reasons, wish to achieve and demonstrate a broad
understanding of the law, including the EU General Data Protection Regulation (GDPR) and
the UK Data Protection Bill and their practical application. It is recognized that those with
overall responsibility for data protection within an organization will need to develop a detailed
understanding of the law"    

The Payment Card Industry Professional training course provides an individual qualification
for industry practitioners who wish to demonstrate their professional expertise and
understanding of the PCI Data Security Standard (PCI DSS).
 

This course discusses how to manage an incident response team. how the first responder act, given the frequency and complexity of today's cyber attacks, incident response is a critical function for organizations.

Incident response is the last line of defense, detecting and efficiently responding to incidents requires strong management processes, and managing an incident response team requires special skills and knowledge

The course is intended for those requiring intelligence or evidence from the Dark Web. This will usually be those working in government or law enforcement though may also be in the private sector.

This course help you to understand what is special about Bitcoin, we need to understand how it works at a technical level. We’ll address the important questions about Bitcoin, such as:
How does Bitcoin work?

What makes Bitcoin different?

How secure are your Bitcoins?

How anonymous are Bitcoin users?

What determines the price of Bitcoins?

Can cryptocurrencies be regulated?

What might the future hold?   
 

This course is designed to show delegates how easy it can be for others to obtain data about ourselves through various means, but also how much of this can be stopped with a few tweaks to our machines and our online behavior.    

This one day course show the cyber crime impact on the business and how the hackers can effect the business through the cyber crimes, the course discuss the history of cyber crime and security terminologies of the hacking and cyber security, finally it will discuss how to stop this risk on the business    
    
 

This course was put together focusing on what today’s Mobile Forensics practitioner requires, Basics of Android and iOS areas this course will be cover & the analysis using reverse engineering understanding how the popular Mobile OSs are hardened to defend against common attacks and exploits.

This course will introduce the scientific principles and practical techniques that are used in crime scenes , in addition to cover the basics of Biometric Forensic  and what is related approaches in the technological landscape.

Digital Forensics and Investigations is a comprehensive entry level course to teach the basic theoretical concepts of digital forensics as well as the practical side of digital forensics, i.e. how to conduct digital forensic investigations.

This course is designed for a wide range of people such as law enforcers, crime investigators, managers in larger organizations, technical personnel in larger organizations, and anyone else interested in a general background of digital forensics.    
 

In this course, you will learn the principles and techniques for digital forensics investigation and the spectrum of available computer forensics tools. You will learn about core forensics procedures to ensure court admissibility of evidence, as well as the legal and ethical implications.

You will learn how to perform a forensic investigation on both Unix/Linux and Windows systems with different file systems. with many advanced topics like wireless, network, web, DB and Mobile crimes investigation    
 

This class will help the attendees to scan, test, hack on secure their own systems, get in-depth knowledge and practical experience with the current essential security systems. the attendees know how perimeter defenses work and then be lead into scanning and attacking their own networks, no real network is harmed, the attendees then will learn how intruders escalate privileges and what steps can be taken to secure a system, Intrusion Detection, Policy Creation, Social Engineering, DDoS Attacks, Buffer Overflows and Virus Creation.    
 

This instructor-led, live training in UAE (online or onsite) is aimed at information system analysts who wish to use MITRE ATT&CK to decrease the risk of a security compromise.

By the end of this training, participants will be able to:

• Set up the necessary development environment to start implementing MITRE ATT&CK.
• Classify how attackers interact with systems.
• Document adversary behaviors within systems.
• Track attacks, decipher patterns, and rate defense tools already in place.

This instructor-led, live training in UAE (online or onsite) is aimed at information analysts who wish to learn the techniques and processes behind social engineering so as to protect sensitive company information.

By the end of this training, participants will be able to:

• Set up the necessary development environment to start creating custom malware.
• Backdoor legitimate web applications undetected.
• Deliver evil files as normal file types.
• Use social engineering techniques to lead targets into a fake website.

Lead SCADA Security Manager training enables you to develop the necessary expertise to plan, design, and implement an effective program to protect SCADA systems. In addition, you will be able to understand common Industrial Control System (ICS) threats, vulnerabilities, risks related to the Industrial Control Systems (ICS) and techniques used to manage these risks. This training focuses on several aspects of security management and skills related to SCADA/ICS security.  

Lead SCADA Security Manager training course is designed by industry experts with in-depth experience in SCADA and Industrial Control Systems Security. Unlike other trainings, this training course concentrates specifically on the knowledge and skills needed by a professional seeking to advice on, or manage risks related to SCADA environments and systems. Given the high profile nature and the significant impacts associated with such environments, a holistic professional approach to security is needed and that is exactly what this course is designed to provide.

In addition, to acquire the theoretical knowledge needed by a SCADA Security Manager, a comprehensive methodology for the implementation of a SCADA Security program is presented. Thus, at the end of this course, you will gain knowledge on how to effectively implement a security program for SCADA/ICS systems.

After mastering all the necessary concepts of SCADA Security, you can sit for the exam and apply for a “PECB Certified Lead SCADA Security Manager” credential. By holding a PECB Lead SCADA Security Manager Certificate, you will be able to demonstrate that you have the practical knowledge and professional capabilities to support and lead a team in managing SCADA Security.

Who should attend?

• Security professionals interested in acquiring  SCADA security professional skills
• IT professionals looking to enhance their technical skills and knowledge
• IT and Risk Managers seeking a more detailed understanding of ICS and SCADA systems
• SCADA system developers
• SCADA engineers and operators
• SCADA IT professionals

Learning objectives

• Understand and explain the purpose and risks to SCADA systems, Distributed Control Systems and Programmable Logic Controllers
• Understand the risks faced by these environments and the appropriate approaches to manage such risks
• Develop the expertise to support a pro-active SCADA Security program, including policies and vulnerability management
• Define and design network architecture incorporating defense in advanced security controls for SCADA
• Explain the relationship between management, operational and technical controls in a SCADA Security program
• Improve the ability to design resilient and high availability SCADA systems
• Learn how to manage a program of effective security testing activities

Educational approach

• This training is based on both theory and best practices used in SCADA Security
• Lecture sessions are illustrated with examples based on case studies 
• Practical exercises are based on a case study which includes role playing and discussions
• Practical tests are similar to the Certification Exam

General Information

• Certification fees are included on the exam price
• Training material containing over 450 pages of information and practical examples will be distributed
• A participation certificate of 31 CPD (Continuing Professional Development) credits will be issued
• In case of exam failure , you can retake the exam within 12 months for free

The Certified Ethical Hacker certification is a sought-after cybersecurity certification around the world. 

This program incorporates instruction and practice to get students ready to take the CEH certification exam as well as the CEH Practical Exam. Candidates who successfully pass both exams earn the CEH Master credential as well as their CEH certification.

Students are given the choice to add either the CPENT or the CHFI course to their package.

Training for either the Certified Penetration Testing Professional (CPENT) course or the Computer Hacking Forensic Investigator (CHFI) course will be given to each student via EC-Council’s online, self-paced, streaming video program. 

CPENT (Pen-test):
Teaches students how to apply the concepts and tools taught in the CEH program to a pen-test methodology in a live cyber range.

CHFI (Computer Forensics):
Teaches students a methodological approach to computer forensics including searching and seizing, chain-of-custody, acquisition, preservation, analysis and reporting of digital evidence.

Course Description

CEH provides an in-depth understanding of ethical hacking phases, various attack vectors, and preventative countermeasures. It will teach you how hackers think and act maliciously so you will be better positioned to setup your security infrastructure and defend against future attacks. An understanding of system weaknesses and vulnerabilities helps organizations strengthen their system security controls to minimize the risk of an incident.

CEH was built to incorporate a hands-on environment and systematic process across each ethical hacking domain and methodology, giving you the opportunity to work towards proving the required knowledge and skills needed to achieve the CEH credential. You will be exposed to an entirely different posture toward the responsibilities and measures required to be secure.

Who Should Attend

• Law enforcement personnel
• System administrators
• Security officers
• Defense and military personnel
• Legal professionals
• Bankers
• Security professionals

About the Certified Ethical Hacker Master

To earn the CEH Master certification, you must pass the CEH Practical exam. The CEH Practical Exam was designed to give students a chance to prove they can execute the principals taught in the CEH course. The practical exam requires you to demonstrate the application of ethical hacking techniques such as threat vector identification, network scanning, OS detection, vulnerability analysis, system hacking, and more.

The CEH Practical does not contain simulations. Rather, you will be challenging a live range which was designed to mimic a corporate network through the use of live virtual machines, networks, and applications.

Successfully completing the challenges found in the CEH Practical Exam is the next step after attaining the Certified Ethical Hacker (CEH) certification. Successfully passing both the CEH exam and the CEH Practical will earn you the additional certification of CEH Master.

About the Certified Ethical Hacker Practical

To prove that you are skilled in ethical hacking, we test your abilities with real-world challenges in a real-world environment, using labs and tools requiring you to complete specific ethical hacking challenges within a time limit, just as you would face in the real world.

The EC-Council CEH (Practical) exam is comprised of a complex network that replicates a large organization’s real-life network and consists of various network systems (including DMZ, Firewalls, etc.). You must apply your ethical hacking skills to discover and exploit real-time vulnerabilities while also auditing the systems.

About CPENT

EC-Council’s Certified Penetration Tester (CPENT) program is all about the pen test and will teach you to perform in an enterprise network environment that must be attacked, exploited, evaded, and defended. If you have only been working in flat networks, CPENT’s live practice range will teach you to take your skills to the next level by teaching you to pen test IoT systems, OT systems, as well as how to write your own exploits, build your own tools, conduct advanced binaries exploitation, double pivot to access hidden networks, and customization of scripts and exploits to get into the innermost segments of the network.

About CHFI

The Computer Hacking Forensic Investigator (CHFI) course delivers the security discipline of digital forensics from a vendor-neutral perspective. CHFI is a comprehensive course covering major forensic investigation scenarios and enabling students to acquire necessary hands-on experience with various forensic investigation techniques and standard forensic tools necessary to successfully carry out a computer forensic investigation.

This instructor-led, live training in UAE (online or onsite) is aimed at computer users who wish to understand malware and take appropriate measures to minimize its threat.

By the end of this training, participants will be able to:

• Understand the concept of malware.
• Identify the different types of malware.
• Take necessary steps to mitigate malware (procedural, technological, awareness, etc).

By the end of this training, participants will be able to:

• Explain application security and vulnerabilities
• Describe ABAP programming best practices and handling of SY-SUBRC
• Understand injection vulnerabilities
• Describe security testing tools
• Explain ATC and CVA

Format of the Course

• Interactive lecture and discussion.
• Lots of exercises and practice.
• Hands-on implementation in a live-lab environment.

This instructor-led, live training in UAE (online or onsite) is aimed at IT professionals who wish to learn and apply the fundamentals of Cybersecurity practices, processes, and tools in their organization.

By the end of this training, participants will be able to:

• Understand the Cybersecurity concepts, definitions, architecture, and principles.
• Learn how to secure and protect digital assets (networks, systems, applications, and data).
• Implement security models, frameworks, operational techniques, and incident handling.
• Evaluate and mitigate the impact of cyber attacks, risks, threats, and vulnerabilities.
• Gain insights on cybersecurity challenges with emerging technologies.

This instructor-led, live training in UAE (online or onsite) is aimed at software engineers and IT professionals who wish to gain a deeper knowledge on CyBOK and strengthen theoretical and applied skills in cyber security.

By the end of this training, participants will be able to:

• Understand the fundamental concepts, definitions, and principles of cyber security.
• Acquire in-depth expertise in cyber security by implementing the CyBOK knowledge areas.
• Gain extensive and foundational knowledge to operationalize the CyBOK framework.
• Facilitate community and organization enablement to increase focus on data security and privacy.
• Expand opportunities to earn specialization and credentials for cyber security professions.

Description

The Java language and the Runtime Environment (JRE) was designed to be free from the most problematic common security vulnerabilities experienced in other languages, like C/C++. Yet, software developers and architects should not only know how to use the various security features of the Java environment (positive security), but should also be aware of the numerous vulnerabilities that are still relevant for Java development (negative security).

The introduction of security services is preceded with a brief overview of the foundations of cryptography, providing a common baseline for understanding the purpose and the operation of the applicable components. The use of these components is presented through several practical exercises, where participants can try out the discussed APIs for themselves.

The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform, covering both the typical bugs committed by Java programmers and the language- and environment-specific issues. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn to use various security features of the Java development environment
• Have a practical understanding of cryptography
• Learn about typical coding mistakes and how to avoid them
• Get information about some recent vulnerabilities in the Java framework
• Get sources and further readings on secure coding practices

Audience

Developers

Description

Beyond solid knowledge in using Java components, even for experienced Java programmers it is essential to have a deep knowledge in web-related vulnerabilities both on server and client side, the different vulnerabilities that are relevant for web applications written in Java, and the consequences of the various risks.

General web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained in the context of Java with the most important aim to avoid the associated problems. In addition, a special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5.

The course introduces security components of Standard Java Edition, which is preceded with the foundations of cryptography, providing a common baseline for understanding the purpose and the operation of the applicable components. The use of all components is presented through practical exercises, where participants can try out the discussed APIs and tools for themselves.

Finally, the course explains the most frequent and severe programming flaws of the Java language and platform. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Learn to use various security features of the Java development environment
• Have a practical understanding of cryptography
• Learn about typical coding mistakes and how to avoid them
• Get information about some recent vulnerabilities in the Java framework
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers

Even experienced Java programmers are not mastering by all means the various security services offered by Java, and are likewise not aware of the different vulnerabilities that are relevant for web applications written in Java.

The course – besides introducing security components of Standard Java Edition – deals with security issues of Java Enterprise Edition (JEE) and web services. Discussion of specific services is preceded with the foundations of cryptography and secure communication. Various exercises deal with declarative and programmatic security techniques in JEE, while both transport-layer and end-to-end security of web services is discussed. The use of all components is presented through several practical exercises, where participants can try out the discussed APIs and tools for themselves.

The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform and web-related vulnerabilities. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Understand security concepts of Web services
• Learn to use various security features of the Java development environment
• Have a practical understanding of cryptography
• Understand security solutions of Java EE
• Learn about typical coding mistakes and how to avoid them
• Get information about some recent vulnerabilities in the Java framework
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers

Beyond solid knowledge in using Java components, even for experienced Java programmers it is essential to have a deep knowledge in web-related vulnerabilities both on server and client side, the different vulnerabilities that are relevant for web applications written in Java, and the consequences of the various risks.

General web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained in the context of Java with the most important aim to avoid the associated problems. In addition, a special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5.

The course introduces security components of Standard Java Edition, which is preceded with the foundations of cryptography, providing a common baseline for understanding the purpose and the operation of the applicable components. Security issues of Java Enterprise Edition are presented through various exercises explaining both declarative and programmatic security techniques in JEE.

Finally, the course explains the most frequent and severe programming flaws of the Java language and platform. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Learn to use various security features of the Java development environment
• Have a practical understanding of cryptography
• Understand security concepts of Web services
• Understand security solutions of Java EE
• Learn about typical coding mistakes and how to avoid them
• Get information about some recent vulnerabilities in the Java framework
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers

To serve in the best way heterogeneous development groups that are using various platforms simultaneously during their everyday work, we have merged various topics into a combined course that presents diverse secure coding subjects in didactic manner on a single training event. This course combines C/C++ and Java platform security to provide an extensive, cross-platform secure coding expertise.

Concerning C/C++, common security vulnerabilities are discussed, backed by practical exercises about the attacking methods that exploit these vulnerabilities, with the focus on the mitigation techniques that can be applied to prevent the occurrences of these dangerous bugs, detect them before market launch or prevent their exploitation.

Security components and service of Java are discussed by presenting the different APIs and tools through a number of practical exercises where participants can gain hands-on experience in using them. The course also covers security issues of web services and the related Java services that can be applied to prevent the most aching threats of the Internet based services. Finally, web- and Java-related security vulnerabilities are demonstrated by easy-to-understand exercises, which not only show the root cause of the problems, but also demonstrate the attack methods along with the recommended mitigation and coding techniques in order to avoid the associated security problems.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Learn to use various security features of the Java development environment
• Have a practical understanding of cryptography
• Realize the severe consequences of unsecure buffer handling
• Understand the architectural protection techniques and their weaknesses
• Learn about typical coding mistakes and how to avoid them
• Be informed about recent vulnerabilities in various platforms, frameworks and libraries
• Get sources and further readings on secure coding practices

Audience

Developers

Even experienced programmers do not master by all means the various security services offered by their development platforms, and are likewise not aware of the different vulnerabilities that are relevant for their developments. This course targets developers using both Java and PHP, providing them essential skills necessary to make their applications resistant to contemporary attacks through the Internet.

Levels of Java security architecture are walked through by tackling access control, authentication and authorization, secure communication and various cryptographic functions. Various APIs are also introduced that can be used to secure your code in PHP, like OpenSSL for cryptography or HTML Purifier for input validation. On server side, the best practices are given for hardening and configuring the operating system, the web container, the file system, the SQL server and the PHP itself, while a special focus is given to client-side security through security issues of JavaScript, Ajax and HTML5.

General web vulnerabilities are discussed by examples aligned to the OWASP Top Ten, showing various injection attacks, script injections, attacks against session handling, insecure direct object references, issues with file uploads, and many others. The various Java- and PHP-specific language problems and issues stemming from the runtime environment are introduced grouped into the standard vulnerability types of missing or improper input validation, improper use of security features, incorrect error and exception handling, time- and state-related problems, code quality issues and mobile code-related vulnerabilities.

Participants can try out the discussed APIs, tools and the effects of configurations for themselves, while the introduction of vulnerabilities are all supported by a number of hands-on exercises demonstrating the consequences of successful attacks, showing how to correct the bugs and apply mitigation techniques, and introducing the use of various extensions and tools.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Learn to use various security features of the Java development environment
• Have a practical understanding of cryptography
• Learn to use various security features of PHP
• Understand security concepts of Web services
• Get practical knowledge in using security testing tools
• Learn about typical coding mistakes and how to avoid them
• Be informed about recent vulnerabilities in Java and PHP frameworks and libraries
• Get sources and further readings on secure coding practices

Audience

Developers

Apache Shiro is a powerful Java security framework that performs authentication, authorization, cryptography, and session management.

In this instructor-led, live training, participants will learn how to secure a web application with Apache Shiro.

By the end of this training, participants will be able to:

• Use Shiro's API to secure various types of applications, including mobile, web and enterprise
• Enable logins from various data sources, including LDAP, JDBC, Active Directory, etc.

Audience

• Developers
• Security engineers

Format of the course

• Part lecture, part discussion, exercises and heavy hands-on practice

This course covers the secure coding concepts and principals with Java through Open Web Application Security Project (OWASP) methodology of testing. The Open Web Application Security Project is an online community which creates freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security.

The course provides essential skills for PHP developers necessary to make their applications resistant to contemporary attacks through the Internet. Web vulnerabilities are discussed through PHP-based examples going beyond the OWASP top ten, tackling various injection attacks, script injections, attacks against session handling of PHP, insecure direct object references, issues with file upload, and many others. PHP-related vulnerabilities are introduced grouped into the standard vulnerability types of missing or improper input validation, incorrect error and exception handling, improper use of security features and time- and state-related problems. For this latter we discuss attacks like the open_basedir circumvention, denial-of-service through magic float or the hash table collision attack. In all cases participants will get familiar with the most important techniques and functions to be used to mitigate the enlisted risks.

A special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5. A number of security-related extensions to PHP are introduced like hash, mcrypt and OpenSSL for cryptography, or Ctype, ext/filter and HTML Purifier for input validation. The best hardening practices are given in connection with PHP configuration (setting php.ini), Apache and the server in general. Finally, an overview is given to various security testing tools and techniques which developers and testers can use, including security scanners, penetration testing and exploit packs, sniffers, proxy servers, fuzzing tools and static source code analyzers.

Both the introduction of vulnerabilities and the configuration practices are supported by a number of hands-on exercises demonstrating the consequences of successful attacks, showing how to apply mitigation techniques and introducing the use of various extensions and tools.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Have a practical understanding of cryptography
• Learn to use various security features of PHP
• Learn about typical coding mistakes and how to avoid them
• Be informed about recent vulnerabilities of the PHP framework
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers

This three day course covers the basics of securing the C/C++ code against the malicious users who may exploit many vulnerabilities in the code with memory management and input handling, the course cover the principals of writing secure code.

In this instructor-led, live course in UAE, participants will learn how to formulate the proper security strategy to face the DevOps security challenge.

As a developer, your duty is to write bulletproof code.

What if we told you that despite all of your efforts, the code you have been writing your entire career is full of weaknesses you never knew existed? What if, as you are reading this, hackers were trying to break into your code? How likely would they be to succeed? What if they could steal away your database and sell it on the black market?

This Web application security course will change the way you look at code. A hands-on training during which we will teach you all the attackers’ tricks and how to mitigate them, leaving you with no other feeling than the desire to know more.

It is your choice to be ahead of the pack, and be seen as a game changer in the fight against cybercrime.

Delegates attending will:

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Learn about Node.js security
• Learn about MongoDB security
• Have a practical understanding of cryptography
• Understand essential security protocols
• Understand security concepts of Web services
• Learn about JSON security
• Get practical knowledge in using security testing techniques and tools
• Learn how to handle vulnerabilities in the used platforms, frameworks and libraries
• Get sources and further readings on secure coding practices

This instructor-led, live training in UAE introduces the system architectures, operating systems, networking, storage, and cryptographic issues that should be considered when designing secure embedded systems.

By the end of this course, participants will have a solid understanding of security principles, concerns, and technologies. More importantly, participants will be equipped with the techniques needed for developing safe and secure embedded software.

Interactive Application Security Testing (IAST) is a form of application security testing that combines Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) or Runtime Application Self-protection (RASP) techniques. IAST is able to report the specific lines of code responsible for a security exploit and replay the behaviors leading to and following such an exploit.

In this instructor-led, live training, participants will learn how to secure an application by instrumenting runtime agents and attack inducers to simulate application behavior during an attack.  

By the end of this training, participants will be able to:

• Simulate attacks against applications and validate their detection and protection capabilities
• Use RASP and DAST to gain code-level visibility into the data path taken by an application under different runtime scenarios
• Quickly and accurately fix the application code responsible for detected vulnerabilities
• Prioritize the vulnerability findings from dynamic scans
• Use RASP real-time alerts to protect applications in production against attacks.
• Reduce application vulnerability risks while maintaining production schedule targets
• Devise an integrated strategy for overall vulnerability detection and protection

Audience

• DevOps engineers
• Security engineers
• Developers

Format of the course

• Part lecture, part discussion, exercises and heavy hands-on practice

This course covers the secure coding concepts and principals with ASP.net through the Open Web Application Security Project (OWASP) methodology of testing , OWASP is an online community which creates freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security. 

This Course explores the Dot Net Framework Security features and how to secure web applications.   
    
    
    
    
    

The Combined SDL core training gives an insight into secure software design, development and testing through Microsoft Secure Development Lifecycle (SDL). It provides a level 100 overview of the fundamental building blocks of SDL, followed by design techniques to apply to detect and fix flaws in early stages of the development process.

Dealing with the development phase, the course gives an overview of the typical security relevant programming bugs of both managed and native code. Attack methods are presented for the discussed vulnerabilities along with the associated mitigation techniques, all explained through a number of hands-on exercises providing live hacking fun for the participants. Introduction of different security testing methods is followed by demonstrating the effectiveness of various testing tools. Participants can understand the operation of these tools through a number of practical exercises by applying the tools to the already discussed vulnerable code.

Participants attending this course will 

• Understand basic concepts of security, IT security and secure coding

• Get known to the essential steps of Microsoft Secure Development Lifecycle

• Learn secure design and development practices

• Learn about secure implementation principles

• Understand security testing methodology

• Get sources and further readings on secure coding practices

Audience

Developers, Managers

A number of programming languages are available today to compile code to .NET and ASP.NET frameworks. The environment provides powerful means for security development, but developers should know how to apply the architecture- and coding-level programming techniques in order to implement the desired security functionality and avoid vulnerabilities or limit their exploitation.

The aim of this course is to teach developers through numerous hands-on exercises how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization, provide remote procedure calls, handle sessions, introduce different implementations for certain functionality, and many more.

Introduction of different vulnerabilities starts with presenting some typical programming problems committed when using .NET, while the discussion of vulnerabilities of the ASP.NET also deals with various environment settings and their effects. Finally, the topic of ASP.NET-specific vulnerabilities not only deals with some general web application security challenges, but also with special issues and attack methods like attacking the ViewState, or the string termination attacks.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn to use various security features of the .NET development environment
• Get practical knowledge in using security testing tools
• Learn about typical coding mistakes and how to avoid them
• Get information about some recent vulnerabilities in .NET and ASP.NET
• Get sources and further readings on secure coding practices

Audience

Developers

A number of programming languages are available today to compile code to .NET and ASP.NET frameworks. The environment provides powerful means for security development, but developers should know how to apply the architecture- and coding-level programming techniques in order to implement the desired security functionality and avoid vulnerabilities or limit their exploitation.

The aim of this course is to teach developers through numerous hands-on exercises how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization, provide remote procedure calls, handle sessions, introduce different implementations for certain functionality, and many more. A special section is devoted to configuration and hardening of the .NET and ASP.NET environment for security.

A brief introduction to the foundations of cryptography provides a common practical baseline for understanding the purpose and the operation of various algorithms, based on which the course presents the cryptographic features that can be used in .NET. This is followed by the introduction of some recent crypto vulnerabilities both related to certain crypto algorithms and cryptographic protocols, as well as side-channel attacks.

Introduction of different vulnerabilities starts with presenting some typical programming problems committed when using .NET, including bug categories of input validation, error handling or race conditions. A special focus is given to XML security, while the topic of ASP.NET-specific vulnerabilities tackles some special issues and attack methods: like attacking the ViewState, or the string termination attacks.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn to use various security features of the .NET development environment
• Have a practical understanding of cryptography
• Understand some recent attacks against cryptosystems
• Get information about some recent vulnerabilities in .NET and ASP.NET
• Learn about typical coding mistakes and how to avoid them
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers

Beyond solid knowledge in using various security features of .NET and ASP.NET, even for experienced programmers it is essential to have a deep knowledge in web-related vulnerabilities both on server and client side along with the consequences of the various risks.

In this course the general web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained in the context of ASP.NET. A special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5.

The course also deals with the security architecture and components of the .NET framework, including code- and role based access control, permission declaration and checking mechanisms and the transparency model. A brief introduction to the foundations of cryptography provides a common practical baseline for understanding the purpose and the operation of various algorithms, based on which the course presents the cryptographic features that can be used in .NET.

Introduction of different security bugs follows the well-established vulnerability categories, tackling input validation, security features, error handling, time- and state-related problems, the group of general code quality issues, and a special section on ASP.NET-specific vulnerabilities. These topics are concluded with an overview on testing tools that can be used to automatically reveal some of the learnt bugs.

Topics are presented through practical exercises where participants can try out the consequences of certain vulnerabilities, the mitigations, as well as the discussed APIs and tools for themselves.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Learn to use various security features of the .NET development environment
• Have a practical understanding of cryptography
• Get information about some recent vulnerabilities in .NET and ASP.NET
• Get practical knowledge in using security testing tools
• Learn about typical coding mistakes and how to avoid them
• Get sources and further readings on secure coding practices

Audience

Developers

Protecting applications that are accessible via the web requires well-prepared security professional who are at all time aware of current attack methods and trends. Plethora of technologies and environments exist that allow comfortable development of web applications (like Java, ASP.NET or PHP, as well as Javascript or Ajax on the client side). One should not only be aware of the security issues relevant to these platforms, but also of all general vulnerabilities that apply regardless of the used development tools.

The course gives an overview of the applicable security solutions in web applications, focusing on the most important technologies like secure communication and web services, tackling both transport-layer security and end-to-end security solutions and standards like Web Services Security and XML. It also gives a brief overview of the typical programming mistakes, above all connected to missing or improper input validation.

The web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained to avoid the associated problems. Exercises can be easily followed by programmers using different programming languages, thus the web application-related topics can be easily combined with other secure coding subjects, and can thus effectively satisfy the needs of corporate development groups, who typically deal with various languages and development platforms to develop web applications.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Have a practical understanding of cryptography
• Understand security concepts of Web services
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers

After getting familiar with the vulnerabilities and the attack methods, participants learn about the general approach and the methodology for security testing, and the techniques that can be applied to reveal specific vulnerabilities. Security testing should start with information gathering about the system (ToC, i.e. Target of Evaluation), then a thorough threat modeling should reveal and rate all threats, arriving to the most appropriate risk analysis-driven test plan.

Security evaluations can happen at various steps of the SDLC, and so we discuss design review, code review, reconnaissance and information gathering about the system, testing the implementation and the testing and hardening the environment for secure deployment. Many security testing techniques are introduced in details, like taint analysis and heuristics-based code review, static code analysis, dynamic web vulnerability testing or fuzzing. Various types of tools are introduced that can be applied in order to automate security evaluation of software products, which is also supported by a number of exercises, where we execute these tools to analyze the already discussed vulnerable code. Many real life case studies support better understanding of various vulnerabilities.

This course prepares testers and QA staff to adequately plan and precisely execute security tests, select and use the most appropriate tools and techniques to find even hidden security flaws, and thus gives essential practical skills that can be applied on the next day working day.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Understand security testing approaches and methodologies
• Get practical knowledge in using security testing techniques and tools
• Get sources and further readings on secure coding practices

Audience

Developers, Testers

Protecting applications that are accessible via the web requires well-prepared security professional who are at all time aware of current attack methods and trends. Plethora of technologies and environments exist that allow comfortable development of web applications. One should not only be aware of the security issues relevant to these platforms, but also of all general vulnerabilities that apply regardless of the used development tools.

The course gives an overview of the applicable security solutions in web applications, with a special focus on understanding the most important cryptographic solutions to be applied. The various web application vulnerabilities are presented both on the server side (following the OWASP Top Ten) and the client side, demonstrated through the relevant attacks, and followed by the recommended coding techniques and mitigation methods to avoid the associated problems. The subject of secure coding is wrapped up by discussing some typical security-relevant programming mistakes in the domain of input validation, improper use of security features and code quality.

Testing plays a very important role in ensuring security and robustness of web applications. Various approaches – from high level auditing through penetration testing to ethical hacking – can be applied to find vulnerabilities of different types. However, if you want to go beyond the easy-to-find low-hanging fruits, security testing should be well planned and properly executed. Remember: security testers should ideally find all bugs to protect a system, while for adversaries it is enough to find one exploitable vulnerability to penetrate into it.

Practical exercises will help understanding web application vulnerabilities, programming mistakes and most importantly the mitigation techniques, together with hands-on trials of various testing tools from security scanners, through sniffers, proxy servers, fuzzing tools to static source code analyzers, this course gives the essential practical skills that can be applied on the next day at the workplace.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Have a practical understanding of cryptography
• Understand security testing approaches and methodologies
• Get practical knowledge in using security testing techniques and tools
• Be informed about recent vulnerabilities in various platforms, frameworks and libraries
• Get sources and further readings on secure coding practices

Audience

Developers, Testers

Serving teams that use managed code (.NET and ASP.NET typically written in C#) together with native code development (typically C/C++), this training gives a comprehensive overview of the security issues in both environments.

Concerning C/C++, common security vulnerabilities are discussed, backed by practical exercises about the attacking methods that exploit these vulnerabilities, with the focus on the mitigation techniques that can be applied to prevent the occurrences of these dangerous bugs, detect them before market launch or prevent their exploitation.

The course also covers both the various general (like web services) and specific security solutions and tools, and the most frequent and severe security flaws of managed code, dealing with both language-specific issues and the problems stemming from the runtime environment. The vulnerabilities relevant to the ASP.NET platform are detailed along with the general web-related vulnerabilities following the OWASP Top Ten list. The course consists of a number of exercises through which attendees can easily understand and execute attacks and protection methods.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Learn to use various security features of the .NET development environment
• Have a practical understanding of cryptography
• Get information about some recent vulnerabilities in .NET and ASP.NET
• Realize the severe consequences of unsecure buffer handling in native code
• Understand the architectural protection techniques and their weaknesses
• Learn about typical coding mistakes and how to avoid them
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers

Beyond solid knowledge in using security solutions of the applied technologies, even for experienced programmers it is essential to have a deep understanding of the typical attack techniques that are possible due the various vulnerabilities, i.e. security-relevant programming mistakes. This course approaches secure coding from the stand point of the attack techniques, but with the same purpose as any other course of SCADEMY Secure Coding Academy: to learn software security best practices.

General web-based vulnerabilities are demonstrated through presenting the relevant attacks, while the recommended coding techniques and mitigation methods are explained with the most important aim to avoid the associated problems. Besides server side issues (basically following the OWASP Top Ten), a special focus is given to client-side security tackling security issues of JavaScript, Ajax and HTML5, which is followed by discussing web services and XML security. A brief introduction to the foundations of cryptography provides a common practical baseline for understanding the purpose and the operation of various algorithms.

Specifically for C and C++, we go into more details regarding the exploitation of buffer overflows on the stack and on the heap. After showing the attack techniques, we give an overview of practical protection methods that can be applied at different levels (hardware components, the operating system, programming languages, the compiler, the source code or in production) to prevent the occurrence of the various bugs, to detect them during development and before market launch, or to prevent their exploitation during system operation. Finally, we discuss counter attacks, and then counter-protection measures, highlighting the cat-and-mouse nature of hacking and protection.

Finally, the course explains the most frequent and severe programming flaws in general, by bringing examples in Java, .NET, C and C++ languages and platforms. Besides the typical bugs committed by the programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment or the used libraries. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques.

Finally, we present security testing techniques and tools that can be applied to reveal the discussed vulnerabilities, along with the various techniques for reconnaissance, configuration and hardening of the environment.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Understand security concepts of Web services
• Have a practical understanding of cryptography
• Realize the severe consequences of unsecure buffer handling
• Understand the architectural protection techniques and their weaknesses
• Learn about typical coding mistakes and how to exploit them
• Be informed about recent vulnerabilities in various platforms, frameworks and libraries
• Learn essential vulnerability analysis and testing techniques and tools
• Get sources and further readings on secure coding practices

Audience

Developers

Android is an open platform for mobile devices such as handsets and tablets. It has a large variety of security features to make developing secure software easier; however, it is also missing certain security aspects that are present in other hand-held platforms. The course gives a comprehensive overview of these features, and points out the most critical shortcomings to be aware of related to the underlying Linux, the file system and the environment in general, as well as regarding using permissions and other Android software development components.

Typical security pitfalls and vulnerabilities are described both for native code and Java applications, along with recommendations and best practices to avoid and mitigate them. In many cases discussed issues are supported with real-life examples and case studies. Finally, we give a brief overview on how to use security testing tools to reveal any security relevant programming bugs.

Participants attending this course will 

• Understand basic concepts of security, IT security and secure coding
• Learn the security solutions on Android
• Learn to use various security features of the Android platform
• Get information about some recent vulnerabilities in Java on Android
• Learn about typical coding mistakes and how to avoid them
• Get understanding on native code vulnerabilities on Android
• Realize the severe consequences of unsecure buffer handling in native code
• Understand the architectural protection techniques and their weaknesses
• Get sources and further readings on secure coding practices

Audience

Professionals

Migrating to the cloud introduces immense benefits for companies and individuals in terms of efficiency and costs. With respect to security, the effects are quite diverse, but it is a common perception that using cloud services impacts security in a positive manner. Opinions, however, diverge many times even on defining who is responsible for ensuring the security of cloud resources.

Covering IaaS, PaaS and SaaS, first the security of the infrastructure is discussed: hardening and configuration issues as well as various solutions for authentication and authorization alongside identity management that should be at the core of all security architecture. This is followed by some basics regarding legal and contractual issues, namely how trust is established and governed in the cloud.

The journey through cloud security continues with understanding cloud-specific threats and the attackers’ goals and motivations as well as typical attack steps taken against cloud solutions. Special focus is also given to auditing the cloud and providing security evaluation of cloud solutions on all levels, including penetration testing and vulnerability analysis.

The focus of the course is on application security issues, dealing both with data security and the security of the applications themselves. From the standpoint of application security, cloud computing security is not substantially different from general software security, and therefore basically all OWASP-enlisted vulnerabilities are relevant in this domain as well. It is the set of threats and risks that makes the difference, and thus the training is concluded with the enumeration of various cloud-specific attack vectors connected to the weaknesses discussed beforehand.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Understand major threats and risks in the cloud domain
• Learn about elementary cloud security solutions
• Get information about the trust and the governance regarding the cloud
• Have a practical understanding of cryptography
• Get extensive knowledge in application security in the cloud
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Understand the challenges of auditing and evaluating cloud systems for security
• Learn how to secure the cloud environment and infrastructure
• Get sources and further readings on secure coding practices

Audience

Developers, Managers, Professionals

Implementing a secure networked application can be difficult, even for developers who may have used various cryptographic building blocks (such as encryption and digital signatures) beforehand. In order to make the participants understand the role and usage of these cryptographic primitives, first a solid foundation on the main requirements of secure communication – secure acknowledgement, integrity, confidentiality, remote identification and anonymity – is given, while also presenting the typical problems that may damage these requirements along with real-world solutions.

As a critical aspect of network security is cryptography, the most important cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement are also discussed. Instead of presenting an in-depth mathematical background, these elements are discussed from a developer's perspective, showing typical use-case examples and practical considerations related to the use of crypto, such as public key infrastructures. Security protocols in many areas of secure communication are introduced, with an in-depth discussion on the most widely-used protocol families such as IPSEC and SSL/TLS.

Typical crypto vulnerabilities are discussed both related to certain crypto algorithms and cryptographic protocols, such as BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE and similar, as well as the RSA timing attack. In each case, the practical considerations and potential consequences are described for each problem, again, without going into deep mathematical details.

Finally, as XML technology is central for data exchange by networked applications, the security aspects of XML are described. This includes the usage of XML within web services and SOAP messages alongside protection measures such as XML signature and XML encryption – as well as weaknesses in those protection measures and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Understand basic concepts of security, IT security and secure coding
• Understand the requirements of secure communication
• Learn about network attacks and defenses at different OSI layers
• Have a practical understanding of cryptography
• Understand essential security protocols
• Understand some recent attacks against cryptosystems
• Get information about some recent related vulnerabilities
• Understand security concepts of Web services
• Get sources and further readings on secure coding practices

Audience

Developers, Professionals

The course introduces some common security concepts, gives an overview about the nature of the vulnerabilities regardless of the used programming languages and platforms, and explains how to handle the risks that apply regarding software security in the various phases of the software development lifecycle. Without going deeply into technical details, it highlights some of the most interesting and most aching vulnerabilities in various software development technologies, and presents the challenges of security testing, along with some techniques and tools that one can apply to find any existing problems in their code.

Participants attending this course will 

• Understand basic concepts of security, IT security and secure coding
• Understand Web vulnerabilities both on server and client side
• Realize the severe consequences of unsecure buffer handling
• Be informated about some recent vulnerabilities in development environments and frameworks
• Learn about typical coding mistakes and how to avoid them
• Understand security testing approaches and methodologies

Audience

Managers

After the major attacks against national infrastructures, Security Professionals found that the majority of the vulnerabilities that caused the attacks came from poor and vulnerable code that the developers write. 

Developers now need to master the techniques of how to write Secure Code, because we are in a situation where anyone can use availble tools to write a script that can effectivly disable a large organization's systems because the developers have written poor code.

This Course aims to help in the following:

1. Help Developers to master the techniques of writing Secure Code
2. Help Software Testers to test the security of the application before publishing to the production environment
3. Help Software Architects to understand the risks surrounding the applications
4. Help Team Leaders to set the security base lines for the developers
5. Help Web Masters to configure the Servers to avoid miss-configurations

In this course you will also see details of the latest cyber attacks that have been used and the countermeasures used to stop and prevent these attacks.

You will see for yourself how developers mistakes led to catastrophic attacks, and by participatig in the labs during the course you will be able to put into practise the security controls and gain the experience and knowledge to produce secure coding.

Who should Attend this Course? 

This Secure Code Training is ideal for those working in positions such as, but not limited to:

• Web Developers
• Mobile Developers
• Java Developers
• Dot Net Developers
• Software Architects
• Software Tester
• Security Professionals
• Web Masters

This course will help professionals understand the value and limits of Application Security. While the Application Security Principals provides valuable awareness around some of the major risks in applications today, this course will highlight both the good and not so good.

This course is crucial because of the increasing need for developers to code in a secure manner. It is critical to introduce security as a quality component into the development cycle. This course aims at educating developers about various security vulnerabilities through hands-on practice using our purposely developed insecure web application.

This instructor-led, live training in UAE (online or onsite) is aimed at developers, engineers, and architects seeking to secure their web apps and services.

By the end of this training, participants will be able to integrate, test, protect, and analyze their web apps and services using the OWASP testing framework and tools.

Shadowsocks is an open-source, secure socks5 proxy.

In this instructor-led, live training, participants will learn how to secure an internet connection through a Shadowsocks proxy.

By the end of this training, participants will be able to:

• Install and configure Shadowsocks on any of a number of supported platforms, including Windows, Linux, Mac, Android, iOS, and OpenWrt.
• Deploy Shadosocks with package manager systems, such as pip, aur, freshports and others.
• Run Shadowsocks on mobile devices and wireless networks.
• Understand how Shadowsocks encrypts messages and ensures integrity and authenticity.
• Optimize a Shadowsocks server

Audience

• Network engineers
• System Administrators
• Computer technicians

Format of the course

• Part lecture, part discussion, exercises and heavy hands-on practice

HIPAA (Health Insurance Portability and Accountability Act of 1996) is a legislation in the United States that provides provisions for data privacy and security for handling and storing medical information. These guidelines are a good standard to follow in developing health applications, regardless of territory. HIPAA compliant applications are recognized and more trusted globally.

In this instructor-led, live training (remote), participants will learn the fundamentals of HIPAA as they step through a series of hands-on live-lab exercises.

By the end of this training, participants will be able to:

• Understand the basics of HIPAA
• Develop health applications that are compliant with HIPAA
• Use developer tools for HIPAA compliance

Audience

• Developers
• Product Managers
• Data Privacy Officers

Format of the Course

• Part lecture, part discussion, exercises and heavy hands-on practice.

Note

• To request a customized training for this course, please contact us to arrange.

In this instructor-led, live training UAE (online or onsite), we discuss CAS's architecture and features and practice installing and configuring a CAS server.

By the end of this training, participants will be able to:

• Have an understanding of CAS's implementation of SSO (Single-Sign-On Authentication).
• Have the necessary practice to deploy and manage their own authentication server.

In this instructor-led, live training in UAE, participants will understand Internet of Things (IoT) architectures and learn the different IoT security solutions applicable to their organization.

By the end of this training, participants will be able to:

• Understand IoT architectures.
• Understand emerging IoT security threats and solutions.
• Implement technologies for IoT security in their organization.

This course is designed to help the attendee to build organizational resilience against a range of threats so that organizations can respond effectively to incidents, maintain the availability of business operations and safeguard its interests. 

This instructor-led, live training in UAE (online or onsite) is aimed at engineers who wish to safeguard connected vehicles from cyber attacks.

By the end of this training, participants will be able to:

• Implement cybersecurity in automotive systems.
• Choose the most suitable technologies, tools, and approaches.

This instructor-led, live training in UAE (online or onsite) is aimed at supply chain professionals who wish to establish effective control and oversight of their supply chain, especially as it relates to cybersecurity.

By the end of this training, participants will be able to:

• Understand the security oversights that can bring about significant damage and disruption to a supply chain.
• Break down a complex security problem into manageable and actionable parts.
• Address common supply chain vulnerabilities by analyzing high risk areas and engaging with stakeholders.
• Adopt best practices in securing a supply chain.
• Noticeably reduce or eliminate the biggest risks to an organization's supply chain.

This five-day, instructor-led course teaches IT professionals how they can enhance the security of the IT infrastructure that they administer. This course begins by emphasizing the importance of assuming that network breaches have occurred already, and then teaches you how to protect administrative credentials and rights to help ensure that administrators can perform only the tasks that they need to, when they need to.

In this instructor-led, live training in UAE, participants will learn about the various aspects of NB-IoT (also known as LTE Cat NB1) as they develop and deploy a sample NB-IoT based application.

By the end of this training, participants will be able to:

• Identify the different components of NB-IoT and how to fit together to form an ecosystem.
• Understand and explain the security features built into NB-IoT devices.
• Develop a simple application to track NB-IoT devices.

Overview

This Public Key Infrastructure – Implement and Manage course helps any individual to gain knowledge in managing robust PKI and having better understanding of topics surrounding public key infrastructure. Moreover, the PKI course is a preparation for the increasingly critical component – which ensures confidentiality, integrity, and authentication in an enterprise. Our PKI course provides the knowledge and skills necessary to select, design and deploy PKI, to secure existing and future applications within your organization. It also gives a deeper look into the foundations of cryptography and the working principles of the algorithms being used.

Throughout the whole course, participants will gain in-depth knowledge on the following topics:

• Legal aspects of a PKI
• Elements of a PKI
• PKI management
• Trust in a digital world
• Digital signature implementation
• Trust models

After completing the PKI course, each individual will be able to successfully design, setup, deploy, and manage a public key infrastructure (PKI).

This is a 3-day course is considered essential for anyone who needs to understand Public Key Infrastructure (PKI) and the issues surrounding its implementation. It covers the issues and technologies involved in PKI in-depth and gives hands-on practical experience of setting up and maintaining a variety of PKI solutions. Detailed knowledge of issues surrounding PKI helps to put recent attacks which have appeared in the news headlines into context and enable valid decisions to be made about their relevance to your organisation.

Objectives

To introduce the student to the theoretical aspects of the foundations and benefits of Public Key Infrastructure (PKI), including different types of encryption, digital signatures, digital certificates and Certificate Authorities.

To give students hands on experience of implementing and using PKI solutions with a variety of applications.

To give students an understanding of the concepts of evaluating and selecting PKI technologies

Audience

Anyone involved in Public Key Infrastructure | PKI decision-making, implementing and securing e-commerce and other Internet applications, including CIOs, Chief Security Officers, MIS Directors, Security Managers and Internal Auditors.

The Certified Digital Forensics Examiner vendor neutral certification is designed to train Cyber Crime and Fraud Investigators whereby students are taught electronic discovery and advanced investigation techniques. This course is essential to anyone encountering digital evidence while conducting an investigation.

The Certified Digital Forensics Examiner training teaches the methodology for conducting a computer forensic examination.  Students will learn to use forensically sound investigative techniques in order to evaluate the scene, collect and document all relevant information, interview appropriate personnel, maintain chain-of-custody, and write a findings report.

The Certified Digital Forensics Examiner course will benefit organizations, individuals, government offices, and law enforcement agencies interested in pursuing litigation, proof of guilt, or corrective action based on digital evidence.

Description:

This course will give the participants thorough understanding about security concepts, web application concepts and frameworks used by developers in order to be able to exploit and protect targeted application. In today’s world, that is changing rapidly and thus all the technologies used are also changed at a fast pace, web applications are exposed to hackers attacks 24/7. In order to protect the applications from external attackers one has to know all the bits and pieces that makes the web application, like frameworks, languages and technologies used in web application development, and much more than that. The problem is that attacker has to know only one way to break into the application and developer (or systems administrator) has to know all the possible exploits in order to prevent this from happening. Because of that it is really difficult to have a bullet proof secured web application, and in most of the cases web application is vulnerable to something. This is regularly exploited by cyber criminals and casual hackers, and it can be minimized by correct planning, development, web application testing and configuration.

Objectives:

To give you the skill and knowledge needed to understand and identify possible exploits in live web applications, and to exploit identified vulnerabilities. Because of the knowledge gained through the identification and exploitation phase, you should be able to protect the web application against similar attacks. After this course the participant will be able to understand and identify OWASP top 10 vulnerabilities and to incorporate that knowledge in web application protection scheme.

Audience:

Developers, Police and other law enforcement personnel, Defense and Military personnel, e-Business Security professionals, Systems administrators, Banking, Insurance and other professionals, Government agencies, IT managers, CISO’s, CTO’s.

Target Audience would be - Network server administrators, firewall administrators, information security analysts, system administrators, and risk assessment professionals 

Description:

This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems. The lab intensive environment gives each student in-depth knowledge and practical experience with the current essential security systems. Students will begin by understanding how perimeter defences work and then be lead into scanning and attacking their own networks, no real network is harmed. Students then learn how Intruders escalate privileges and what steps can be taken to secure a system. Students will also learn about Intrusion Detection, Policy Creation, Social Engineering, DDoS Attacks, Buffer Overflows and Virus Creation.

Target Audience:

This course will significantly benefit security officers, auditors, security professionals, site administrators, and anyone who is concerned about the integrity of the network infrastructure.

This instructor-led, live training in UAE (online or onsite) is aimed at SysAdmins, systems engineers, security architects, and security analysts who wish to write, execute, and deploy PowerShell scripts and commands to automate Windows security management in their organization.

By the end of this training, participants will be able to:

• Write and execute PowerShell commands to streamline Windows security tasks.
• Use PowerShell for remote command execution to run scripts on thousands of systems across an organization.
• Configure and harden Windows Server and Windows Firewall to protect systems from malware and attacks.
• Manage certificates and authentication to control user access and activity.

The governance of any enterprise is only as good as its board of directors… and that board is only as effective as its chairman.  Yet the board leadership role is not only the most crucial for board effectiveness – it’s also the one with the least training and support.  Board leaders and chief executives too often battle over power.  Here are the secrets of the world’s best board leaders, the “in the boardroom” leadership tricks of long-time board pros.

Description:

This 2-day CCSK Plus course includes all content from the CCSK Foundation course, and expands on it with extensive hands-on labs in a second day of training. Students will learn to apply their knowledge by performing a series of exercises involving a scenario that brings a fictional organization securely into the cloud. After completing this training, students will be well prepared for the CCSK certification exam, sponsored by Cloud Security Alliance. This second day of training includes additional lecture, although students will spend most of their time assessing, building, and securing a cloud infrastructure during the exercises.

Objectives:

This is a two day class that begins with the CCSK- Basic training, followed by a second day of additional content and hands-on activities

Target Audience:

This class is geared towards security professionals, but is also useful for anyone looking to expand their knowledge of cloud security.

Cloud Computing Security Knowledge (CCSK) Preparation Course

The CCSK course is intended to provide understanding of security issues and best practices over a broad range of cloud computing domains. As cloud computing is becoming the dominant IT system, CCSK is applicable to a wide variety of IT and information security jobs in virtually every organization. The CCSK is strongly recommended for IT auditors, system administrators, security professionals with at least 5 years of experience

After completing this course, the student will be able to:

• Validate their competence gained through experience in cloud security
• Prepare for the CCSK exam.
• Demonstrate their technical knowledge, skills, and abilities to effectively develop a holistic cloud security program relative to globally accepted standards
• Differentiate themselves from other candidates for desirable employment in the fast-growing cloud security market
• Gain access to valuable career resources, such as tools, networking and ideas exchange with peers
• Protect against threats with qualified professionals who have the expertise to competently design, build, and maintain a secure cloud business environmen

Format of the Course

• Interactive lecture and discussion.
• Lots of exercises and practice.
• Hands-on implementation in a live-lab environment.

Course Customization Options

• To request a customized training for this course, please contact us to arrange.

The CCSK Foundation course starts with the fundamentals, then increases in complexity as it works through all 16 domains of the CSA Security Guidance, recommendations from the European Union Agency for Network & Information Security (ENISA), and an overview of the Cloud Controls Matrix.

This is a Cloud Security Alliance (CSA) authorized course and NobleProg is an official CSA Training Partner.

This course is delivered by CSA Authorized CCSK Instructors.
All attendees receive:

• official CSA CCSK Foundation course certificates
• official CCSK Foundation Student Handbooks
• 1 CCSK exam voucher and 1 re-attempt exam voucher

This course covers the most current version of the CCSK exam - currently version 4.1.

The CCSK Plus builds on the foundation class with expanded material and offers extensive hands-on activities that reinforce classroom instruction. Students engage in a scenario of bringing a fictional organization securely into the cloud, which gives them the opportunity to apply their knowledge by performing a series of activities that would be required in a real-world environment.

The CCSK Plus Course includes all the modules in the CCSK Foundation course with additional material.

This is a Cloud Security Alliance (CSA) authorized course and NobleProg is an official CSA Training Partner.

This course is delivered by CSA Authorized CCSK Instructors. 

All attendees receive:

• official CSA CCSK Plus course certificates
• official CCSK Foundation Student Handbooks
• 1 CCSK exam voucher and 1 re-attempt exam voucher

This course covers the most current version of the CCSK exam - currently version 4.1.

Description:

This class is intended as intense and hard core exam preparation for ISACA’s Certified Information Systems Auditor (CRISC) Examination. The five (5) domains of ISACA’s CRISC syllabus will be covered with a big focus on the Examination. The Official ISACA CIRSC Review Manual and Question, Answer and Explanation, (Q,A&E), supplements will ALSO be provided when attending. The Q,A&E is exceptional in helping delegates understand the ISACA style of questions, the type of answers ISACA are looking for and it helps rapid memory assimilation of the material.

The technical skills and practices that ISACA promotes and evaluates within the CRISC certification are the building blocks of success in the field. Possessing the CRISC certification demonstrates your skill within the profession. With a growing demand for professionals holding risk and control expertise, ISACA’s CRISC has positioned itself to be the preferred certification program by individuals and enterprises around the world. The CRISC certification signifies commitment to serving an enterprise and the chosen profession with distinction.

Objectives:

• To help you pass the CRISC examination first time
• possessing this certification will signify your commitment to serving an enterprise with distinction
• the growing demand for professionals with risk and control skills will allow holders of this certification to command better
  positions and salary

You will learn:

• To help enterprises accomplish business objectives by designing, implementing, monitoring and maintaining risk-based,
  efficient and effective IS controls.
• The technical skills and practices that CRISC promotes, these are the building blocks of success in the field

This instructor-led, live training in UAE (online or onsite) covers the different aspects of enterprise security, from AI to database security. It also includes coverage of the latest tools, processes and mindset needed to protect from attacks. 

This instructor-led, live training in UAE (online or onsite) is aimed at security engineers who wish to use IBM Qradar SIEM to address pressing security use cases.

By the end of this training, participants will be able to:

• Gain visibility into enterprise data across on-premise and cloud environments.
• Automate security intelligence to hunt threats and to contain risks.
• Detect, identify, and prioritize threats.

This Introduction to Open Source Intelligence (OSINT) course will provide delegates with skills to become more efficient and effective at finding those key pieces of intelligence on the Internet and World Wide Web. The course is highly practical allowing delegates the time to explore and understand some of the hundreds of tools and websites available.
The next level with in-depth use of advanced tools that are vital for covert internet investigations and intelligence gathering. The course is highly practical allowing delegates the time to explore and understand the tools and resources covered."    
 

This instructor-led, live training in UAE (online or onsite) is aimed at persons who wish to carry out research on third parties while protecting themselves from the like.

By the end of this training, participants will be able to:

• Install and configure advanced tools for carrying out OSINT.
• Use advanced techniques to collect publicly available data relevant to an investigation.
• Analyze large amounts of data efficiently.
• Generate intelligence reports on findings.
• Leverage AI tools for facial recognition and sentiment analysis.
• Map out a strategy for defining the objective and directing efforts to the most relevant and actionable data.