Secure Web Application Development training course

Learn to build secure web applications using current OWASP standards, secure coding practices and modern web security techniques to protect applications against today's evolving cyber threats.

JBI training course London UK

" We tried to cover a lot of bases here from people who had no experience of SQL injection to people who had very specific questions and Tim balanced that really well in the timeframe." RK, Developer, Secure Web Development,  Dec 2022

Public Courses

14/09/26 - 2 days
£1500 +VAT
Enrol 
26/10/26 - 2 days
£1500 +VAT
Enrol 
07/12/26 - 2 days
£1500 +VAT
Enrol 

Customised Courses

* Train a team
* Tailor content
* Flex dates
From £1200 / day
EDF logo Capita logo Sky logo NHS logo RBS logo BBC logo CISCO logo
JBI training course London UK
  • Understanding Web Applications                
  • Information Security & Cybersecurity Fundamentals        
  • Remediating Common Web Application Vulnerabilities    
  • Introducing WebAppSec Good Practices                
  • Secure Web App Development Lifecycles & Supporting Tools    
  • A04 Insecure Design & A02 Cryptographic Failures            
  • A03 Injection & A10 Server-Side Request Forgery            
  • A07 ID & Authentication Failures & A01 Broken Access Control    
  • A05 Security Misconfiguration & A06 Outdated Components        
  • A08 Integrity Failures & A09 Logging & Monitoring Failures        
  • Supporting continuous Web Application Security improvements

Course Details

Module 1:    Introductions, course overview & starting surveys         

- targeted WebAppSec quizzes with instant feedback to activate delegates’ learning  
- connecting to & getting familiar with the course’s hands-on Linux lab environment
- previews of Day 1 & Day 2 content to prepare delegates to engage with WebAppSec
Practicals: each delegate will access an individual cloud-hosted Linux VM via RDP or HTTPS

Module 2:    Understanding Web Applications               
- exploring HTML, Cascading Style Sheets & JavaScript using Modern Web Browsers  
- understanding legal, ethical & data protection considerations related to WebAppSec
- inspecting HTTP verbs, Headers, Cookies & data using ZED Attack Proxy (ZAP)
Practicals: delegates will perform all of this module’s activities in their Linux VM labs

Module 3:    Information Security & Cybersecurity Fundamentals        
- appreciating the significance of availability, confidentiality & integrity for Web Apps
- performing simulated phishing attacks using SE Toolkit & BEEF Project
- understanding the meaning of threats, vulnerabilities, exploits, incidents & controls
Practicals: delegates will perform the simulated phishing activities in their Linux VM labs  

Module 4:    Remediating Common Web Application Vulnerabilities    
- identifying & remediating the “Click Jacking” (missing X-OPTIONS-HEADER) weakness
- identifying & remediating the Cross-Site Request Forgery (XSRF) vulnerability
- Securing Cookies with HttpOnly & Secure Flags
Practicals: delegates will perform all of this module’s activities in their Linux VM labs

Module 5:    Introducing WebAppSec Good Practices                
- introducing OWASP & the OWASP Top 10 Web Application Threat model
- performing Threat Modelling of a Web Application using STRIDE  
- understanding relationships between OWASP, CWEs, CVEs, CVSS & MITRE ATT&CK
 Practicals: important Threat Modelling group practicals will not rely on the Linux VM labs   

Module 6:    Secure Web App Development Lifecycles & Supporting Tools    
- reviewing 4 leading SSDLC models: Microsoft SDL, OpenSAMM, BSIMM, SafeCode
- understanding the value of OWASP’s Application Security Verification Standard (ASVS)
- considering how IAST tools (like ZAP & Burp Suite) differ from SAST & DAST tools
 Practicals: SSDLC activities not Lab-based but Linux VM labs will be used for ZAP & BurpSuite

Module 7:     A04 Insecure Design & A02 Cryptographic Failures            
        - reinforcing need for Threat Model driven WebAppSec lifecycle (as per Modules 5 & 6)
- breaking TLS security by installing untrusted Root Certificates in Firefox lab environment
- understanding the WebAppSec design challenges of secure cryptographic key management
Practicals: delegates will perform cryptographic security activities in their Linux VM labs  

Module 8:    A03 Injection & A10 Server-Side Request Forgery            
- appreciating how injection attacks occur from poor data/code separation & input validation  
- experiencing the significance of Cross-Site Scripting (XSS) attacks with hands-on examples
- how to identify & mitigate SQL Injection & SSRF vulnerabilities
Practicals: delegates will perform XSS, SQL Injection & SSRF activities in their Linux VM labs  

Module 9:     A07 ID & Authentication Failures & A01 Broken Access Control    
- understanding the nature of Identification, Authentication & Access Control
- performing attacks on authentication using spoofing, cookie stealing & hash cracking
- how to design secure Web Apps based on proven Identity & Access Control methods
Practicals: delegates will perform authentication attack activities in their Linux VM labs   


Module 10:    A05 Security Misconfiguration & A06 Outdated Components        
- using legal Open Source Intelligence (OSINT) methods to identify exposed vulnerabilities
- showing how DNS, Shodan & Certificate Transparency records can expose internal assets
- exploring good practices for hardening & patching Web Applications
Practicals: OSINT activities may be performed either using Linux VM labs or own computer


Module 11:    A08 Integrity Failures & A09 Logging & Monitoring Failures        
- examining the meaning & impacts of software integrity failures
- performing simulated attack using malicious file upload & insecure de-serialisation
- understanding the causes & impacts of the Log4J vulnerability
Practicals: delegates will Log4J & Syslog monitoring activities in their Linux VM


Module 12:    Supporting continuous Web Application Security improvements
- reflecting on learnings from this course & how to improve WebAppSec within the BBC
- signposting trusted sources of further relevant information about WebAppSec
- completing end-of-course feedback to improve future runs of this course
Practicals: delegates will access online surveys & quizzes to reinforce their learning

 

Resources:
•    Cloud Hosted Ubuntu Linux Virtual Machines – 1 per delegate (up to 10 delegates)
•    Selected Kali Linux tools e.g. SE Toolkit, HashCat, BEEF Project, ZAP Proxy
•    Selected elements of vulnerable apps e.g. OWASP Juice Shop, DVWA, Google XSS-Game & Gruyere.
•    Selected Websites & OSINT sources e.g. OWASP, MITRE, NIST CVE, FIRST CVSS, SafeCode, Shodan

 

JBI training course London UK
Developers from various language backgrounds who wish to know how to develop secure web applications that follow the OWASP standards
5 star

4.8 out of 5 average

" We tried to cover a lot of bases here from people who had no experience of SQL injection to people who had very specific questions and Tim balanced that really well in the timeframe." RK, Developer, Secure Web Development,  Dec 2022



“JBI  did a great job of customizing their syllabus to suit our business  needs and also bringing our team up to speed on the current best practices. Our teams varied widely in terms of experience and  the Instructor handled this particularly well - very impressive”

Brian F, Team Lead, RBS, Data Analysis Course, April 2022

 

 

JBI training course London UK

Certification


Every delegate will be entitled to a certificate of achievement on completion of the course.

If you are missing your certificate - please use the link below to apply - you can also use this link to sign up for the JBI Training newsletter to receive technology tips directly from our instructors - Analytics, AI, ML, DevOps, Web, Backend and Security.
 



More about this course

OWASP 2017 standards - this Java secure coding training course is led by an Application Security expert instructor and delivers focused and customised guidance on how to secure Applications (from code to cloud), covering the technology stack currently used by the delegates (web, mobile, cloud, java, Javascript, AngularJS android, node, etc...).

A highly popular course with plenty of discussion, demos and interactive Labs to demonstrate the issues faced by modern software development teams.

An optional threat modelling session can also precede the course delivery.

FAQs

JBI Training offers a broad range of cyber security and application security courses covering both technical and managerial disciplines. Available courses include Threat Modelling for Developers, Secure Web Application Development, OWASP Top 10 Practical Web Application Security, TLS and PKI in Practice, Secure Coding for Java and JavaScript, Secure Coding in ASP.NET, Secure Coding in PHP, Security for Python, Secure by Design, Post Quantum Cryptography, Social Engineering, Information Security, Cyber Attack Simulation, PCI DSS Compliance, CISSP, CISM, CISA, Certificate of Cloud Security Knowledge (CCSK), and Certificate of Cloud Auditing Knowledge (CCAK). All courses are available as scheduled classroom sessions in London, as live online instructor-led training, or as customised onsite programmes for development and security teams.
Threat modelling is a structured process used to identify security weaknesses in software design and architecture before any code is written. It involves creating an abstraction of the system, profiling potential attackers and their methods, and producing a catalogue of threats so that countermeasures can be defined and prioritised early in the development lifecycle. It is particularly important for developers and architects because it identifies design flaws that code reviews and testing alone may miss, reduces the cost of remediation by detecting issues before deployment, and integrates naturally into Agile and DevOps workflows. JBI's Threat Modelling for Developers course is language-agnostic and suitable for teams working with any modern development process.
The OWASP Top 10 is a widely recognised list of the most critical security risks to web applications, published by the Open Web Application Security Project. It covers vulnerabilities such as injection attacks, broken authentication, insecure design, security misconfigurations, vulnerable components, and others that are commonly exploited in real-world attacks. JBI offers a dedicated OWASP Top 10 Practical Web Application Security course, and OWASP principles are also embedded in the Secure Web Application Development and Threat Modelling courses. These courses are suitable for developers, security engineers, and QA professionals who need to understand and address common web application vulnerabilities.
Yes. A significant part of JBI's security curriculum is specifically designed for developers and software engineers rather than for dedicated security professionals. Courses such as Threat Modelling for Developers, Secure Web Application Development, Secure Coding for Java and JavaScript, Secure Coding in ASP.NET, Secure Coding in PHP, and Security for Python are aimed at development teams who need to build security into their code and architecture from the outset. These courses can be delivered as customised onsite programmes for software teams, tailored to the languages, frameworks, and development processes the team already uses.
JBI offers preparation courses for several internationally recognised security certifications. These include CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager), CISA (Certified Information Systems Auditor), Certificate of Cloud Security Knowledge (CCSK), and Certificate of Cloud Auditing Knowledge (CCAK). These courses are designed to prepare candidates for their respective examinations and are suitable for information security managers, auditors, risk professionals, and senior technical staff who want to demonstrate formal competence in information security management and cloud security.
Post Quantum Cryptography (PQC) refers to cryptographic algorithms designed to be resistant to attacks from quantum computers, which are expected to eventually break many of the encryption standards currently in use — including RSA and elliptic curve cryptography. Organisations in finance, government, defence, and critical infrastructure are beginning to assess and plan their migration to quantum-resistant algorithms in response to guidance from standards bodies including NIST. JBI's Post Quantum Cryptography course covers the threat landscape, the current state of quantum computing, the new PQC standards, and practical approaches to transitioning cryptographic infrastructure.
The Secure by Design course covers the principles and practices of building security into software and systems from the earliest stages of design, rather than adding it as an afterthought after development. Topics include security architecture patterns, design principles such as least privilege and defence in depth, risk-based design decisions, integrating security requirements into user stories and system specifications, and applying secure design thinking within Agile and DevOps environments. The course is aligned with current guidance from bodies including NCSC (National Cyber Security Centre) and is relevant for architects, senior developers, and technical leads.
Yes. All of JBI's security courses can be delivered as customised onsite or online programmes for corporate teams. Content can be tailored to the organisation's technology stack, development language, industry sector, compliance requirements, and security maturity level. JBI has delivered security training for organisations across financial services, healthcare, government, media, and technology, including clients such as the BBC, NHS, Cisco, RBS, and Capita. Organisations with specific regulatory or compliance obligations — such as PCI DSS, GDPR, or sector-specific frameworks — can request content that addresses those requirements directly.
TLS (Transport Layer Security) is the protocol used to encrypt data in transit across networks, and is the technology behind HTTPS and secure communications in modern applications. PKI (Public Key Infrastructure) is the framework of certificates, certificate authorities, and key management processes that underpin TLS and other certificate-based security mechanisms. JBI's TLS and PKI in Practice course covers how these technologies work in real deployment scenarios, common misconfigurations and vulnerabilities, certificate lifecycle management, and practical implementation for developers and infrastructure teams. This is particularly relevant for organisations managing APIs, microservices, internal networks, or customer-facing web applications.
Yes. JBI's security training content is continuously reviewed and updated to reflect the latest threat landscape, newly published vulnerabilities, updated standards, and current regulatory guidance. This includes updates to OWASP guidance, changes to cryptographic standards, emerging attack techniques such as AI-assisted social engineering and supply chain attacks, and the latest PQC standards from NIST. Delegates learn skills and concepts that are directly applicable to the security challenges organisations face today.

CONTACT
+44 (0)20 8446 7555

[email protected]

 

Copyright © 2026 JBI Training. All Rights Reserved.
JB International Training Ltd  -  Company Registration Number: 08458005
Registered Address: Wohl Enterprise Hub, 2B Redbourne Avenue, London, N3 2BS

Modern Slavery Statement & Corporate Policies | Terms & Conditions | Contact Us

POPULAR

AI training courses                                                                        CoPilot training course

Threat modelling training course   Python for data analysts training course

Power BI training course                                   Machine Learning training course

Spring Boot Microservices training course              Terraform training course

Data Storytelling training course                                               C++ training course

Power Automate training course                               Clean Code training course