Information technology and security networks demand complex algorithms and cryptographic systems. This course covers cryptographic components such as policy, cryptography implementation, key management and security issues.

• Identify accurate cryptography solutions for organization
• Advise organization on cryptography’s risk, vulnerabilities and security issues

• Individuals with Information Security qualifications

• INTRODUCTION CRYPTOGRAPHY AND SECURITY MECHANISM
• Introduction
• Classical Cryptography
• Symmetric Algorithm
• Block Cipher
• Stream Cipher
• Asymmetric Algorithm
• Cryptanalysis


• PUBLIC KEY INFRASTRUCTURES AND CRYPTOGRAPHIC KEY MANAGEMENT
• Public Key Infrastructure (PKI)
• Introduction to Certificate
• Certificate Process
• Introduction to Key Managemen
• Introduction
• Key Management
• Hashing/Checksum
• Unkeyed Cryptosystems
• Secret-Key Cryptosystems
• Digital Signature


• CRYPTOGRAPHIC SERVICES
• Security Services
• Authentication Services
• Access Control Services
• Data Integrity Services
• Non-repudiation Services
• Specific Security Mechanisms
• Digital Signature Mechanisms
• Access Control Mechanisms
• Data Integrity Mechanisms
• Entity Authentication
• Attacks
• PGP
• Secure Email
• Data Encryption

• This training is specially conducted for the participating agencies and Sector Leads to equip them with the intermediate knowledge in Incident handling and Network Security.
• Participants will be exposed to the security environment through practitioners’ experience sharing, case studies and hands on exercises by doing relevant analysis with the related tools. Participants will be exposed to the actual drill environment where the previous drill scenario will be simulated.

• Recognize the importance of following well-defined processes, policies, and procedures
• Understand technical, communication, and coordination issues involved
• Analyze and assess the impact of computer security incidents
• Build and coordinate response strategies for various types of computer security incidents
• Gain practical understanding of various methods for analyzing artefacts left on a compromised system
• Obtain practical experience in the analysis of vulnerabilities and the coordination of vulnerability handling tasks

• Computer network incident handling and incident responder professionals
• Computer security incident response team members and technical staff
• System and network administrators with incident handling experience
• X-Maya participants
• NC4 players

• INTRODUCTION TO SECURITY INCIDENTS AND INCIDENT HANDLING
• Incident Handling: Objective, Definition, Importance
• Incidents: Types, Categories, Priorities
• Six Steps of Incident Handling
• Incident Handling: Sample Incidents
• Incident Handling Exercise


• MALWARE ANALYSIS LABORATORY
• What is Malware and Malware Analysis?
• What is Malicious Behaviour?
• Creating a Safe Analysis Environment
• Why Conduct Malware Analysis
• Behavioural Analysis Tools and Techniques
• Malware Analysis
• Hands-on


• WEB SECURITY AN INTRODUCTION
• Web Architecture
• Web Application Security
• OWASP Top 10
• Case Study


• PHP: AN INTRODUCTION
• Introdcution
• Getting Started
• Activities


• RFI: REMOTE FILE INCLUSION
• Introduction
• How Does it Work
• Securing the Code


• SQL INJECTION
• Introduction
• How Does SQLi Work
• Causes
• Effects
• Revolution in SQLi
• Discussion and Demo


• XSS CROSS SITE SCRIPTING
• What is XXS
• Understanding XXS
• Prevention of XSS Attacks

• Organizations are increasingly aware of the value of their business-critical information and the need to protect their information related assets. An Information Security Management System (ISMS) is based on risk management approach to maintain the confidentiality, integrity and availability of the organization’s information.
• ISO/IEC 27001:2013 Information Security Management System (ISMS) - Requirements - specifies requirements for the establishment, implementation, monitoring, review, maintenance and improvement of a management system for managing an organization’s information security risks.
• This three-day course leads you through the requirements specified in ISO/IEC 27001:2013 for implementing ISMS. These include modules from understanding your organization, scoping your ISMS, assessing and evaluating risks and building security awareness program for your organization. You will also learn practical risk assessment guided by case study example in conducting a risk assessment.

• This program defines the requirements to implement the ISO/IEC 27001:2013 Information Security Management System (ISMS). The course is designed to ensure information security management within your organization and the right way to review, monitor, operate, and improve information security. This helps you to protect organization's information and give confidence to any interested parties, especially your customers.

• ISMS Implementors
• ISMS Consultants
• IT Managers/Personnel
• Information Security Practicioners
• Individual who needs to acquire and develop specific knowledge and skills in implementing the ISMS based on ISO/IEC 27001:2013

• INTRODUCTION TO ISMS
• What is Information Security
• What is Information Security Management Systems (ISMS)
• ISMS Family of Standards
• ISO/IEC 27001:2013
• ISO/IEC 27002:2013
• Critical Success Factor


• ISMS ESTABLISHMENT
• Standards Relevant to ISMS
• Trainings Relevant to ISMS
• Gap Analysis
• Context of the organization
• ISMS Scope
• Information Security Objectives


• LEADERSHIP
• Management Commitment
• Information Security Policy
• Roles and Responsibilities


• ISMS RISK ASSESSMENT
• Introduction to Information Security Risk Management
• Standards Relevant for Risk Management
• Risk Assessment Process
• Risk Treatment Process
• Controls Determination
• Risk Treatment Plan (RTP)
• Residual Risk


• SUPPORT
• Resources
• Competence
• Awareness
• Communication


• DOCUMENTED INFORMATION
• What is Documented Information
• Control of Documented Information
• Mandatory Documented Information
• Other Required Documented Information


• PERFORMANCE EVALUATION
• Monitoring, Measurement, Analysis and Evaluation
• Internal Audit
• Management review


• ISMS IMPROVEMENT
• Nonconformity
• Corrective Action
• Continual Improvement
• GROUP ACTIVITIES AND CASE STUDIES

• Attackers often take advantage of vulnerabilities in routers, wireless access point, firewalls, DNS, web and database servers, and other systems to gain access to the internal network of organization. Therefore, organization must secure their network infrastructure to mitigate risk from within and outside the network by conducting network security assessment.

• Understand the methodology and components in building secured network architecture
• Learn network data flow
• Identify industry best practices on secured network architecture
• Understand the methodology used in conducting network security assessment and wireless network security
• Identify common vulnerabilities found under network infrastructure and ways to mitigate these vulnerabilities.
• Identify hands-on network security assessment using mostly open source distributions tools

• Management, Administrator, IT Security personnel who are in charge of security in their organization
• Related personnel or indivisuals who are interested to understand and learn with technical hands-on about network security assessment

• SECURITY POSTURE ASSESSMENT
• Introduction to Network Security
• Overview of Network Security Assessment Methodologies
• Vulnerability Investigation and Exploitation
• Common Vulnerabilities Found in Network Infrastructure and Mitigation
• Hands-on Activity
• WIRESHARK INTRODUCTION
• Introduction to Wireshark
• Wireshark Functions
• Wireshark GUI
• Packet Capture
• EXPLOITATION
• Exploitation Fundamentals
• Client-Side Exploits
• Service-Side Exploits
• Local Exploits
• Attacks and Defenses
• Exploiting System
• Password Attacks
• WIRELESS NETWORK ASSESSMENT
• Introduction
• Information Gathering
• Active/Passive Scanning
• Wardriving
• Penetration TestingEncryption Cracking
• Vulnerabilities Testing
• Attacks Execution
• Sniffing
• Data/Traffics Analyzing Packets Analyzing

• This course provides working level competency for personnel who will be employed as MySEF Evaluator/MyCC Certifier. It is also applicable for IT security consultants who have potential interest in understanding Common Criteria Evaluation and Certification processes.

• Increase awareness on the benefits of the product/IT system security evaluation plus certification processes and IT evaluation concepts
• Learn more about MyCC Scheme that includes MyCC Scheme policy framework, roles and responsibilities, and MyCC Scheme services
• Provide a working level competency in Common Criteria (CC), Common Evaluation Methodology (CEM), Security Target (ST) and Protection Profile (PP)

• MySEF Evaluators, MySEF Lab Managers and MyCC Certifiers
• Potential Common Criteria/IT Product Consultants.
• Technical Writer interested in learning Common Criteria and MyCC Scheme.
• Developers
• Any interested parties

• IT SECURITY EVALUATION
• This module provides a background to IT security concepts and evaluation. The topics covered include:
• The benefits of IT Security Evaluation
• The value of Information
• The importance of Information Technology
• The need for Information Security
• The concept of Assurance


• MYCC SCHEME
• This module provides an overview of the MyCB functions, roles and responsibilities, Recognition Arrangements, and policy framework.
  The topics covered include:
• MyCC Scheme background and history
• Common Criteria Recognition Arrangement
• What is a certification and evaluation scheme
• MyCC Scheme services
• MyCC Scheme roles and responsibilities
• MyCC Scheme documentation


• INTRODUCTION TO ST, PP AND THE CC
• This module provides a high level overview of Common Criteria (CC) and Methodology, as well as detailing the Security Target (ST)/ Protection Profile (PP)
  and how they form the foundation of evaluations. The following topics are included:
• The history, purpose, paradigm, terminology and structure of the Common Criteria
• How the Common Criteria defines assurance
• The purpose and components of a Security Target
• The purpose and components of a Protection Profile
• The differences between Assurance packages


• SECURITY TARGETS AND PROTECTION PROFILES
• Each component of a Security Target and Protection Profile (CC Part 3)
• The Securty Functional Requirement families (CC Part 2)
• How to evaluate a TOE


• EVALUATING THE TOE
• The Security Assurance Requirements families (CC Part 3)
• How to evaluate a TOE
• Apply the Common Evaluation Methodology (CEM) to :
• Evaluation of the TOE
• Planning a development site visit
• Planning testing
• Conducting vulnerability assessment

• Web applications are listed in the top ten security issues for years. Web application assessment plays an important role to secure web applications from attacks. This course covers web applications security and its technologies.
• The course will examine web architectures from penetration tester perspective. Participants will learn to start actual process of penetration testing, starting with the reconnaissance and mapping phases and end by vulnerabilities discovery and exploitation.
• Then, participants will identify and discuss ten (10) common web application vulnerabilities and recommendations as well as related mitigations and testing strategies that include secure coding methods. This course concludes by launching actual exploits against ten (10) common web application vulnerabilities found on testing applications. Participants are able to explore multiple exploit attacks.

• Understand and learn the vulnerabilities and threats faced
• Identify methods of exploiting these vulnerabilities
• Identify methods of protecting and mitigating these threats and attacks
• Identify secure coding practices to address these weaknesses
• Secure the web server in the organization infrastructure

• Management, Administrator, IT Security personnel who are in charged of security in their organizations
• Also applicable to individual who wants to learn about web application security and experience some hands-on penetration testing exercises
• This training requires some experience and this is not a programming class

• Principles of Web Application Security Assessment
• Web Application Basic
• Web Application Security Assessment Methodology
• Reconnaissance & Mapping
• Vulnerabilities Discovery
• Exploitation


• Common Threats and Defend
• SQL Injection & Blind SQL Injection
• Cross Site Scripting (XSS)
• Information Leakage and Improper Error Handling
• Sensitive Data Exposure
• Cross Site Request Forgery
• Failure to Restrict URL Access
• Remote File Include (RFI)
• Broken Authentication & Session Management


• Web Application Cyber Attacks

• Servers and desktops are found in all organizations and they are crucial to business operations. Servers typically host business data that if lost, may cost the business it’s customer trust. Desktops (and laptops) are the tools used by the organization’s employees to do their work. In order to achieve the organization’s mission, it is important to prevent security incidents such as hacking or ransomware from disrupting the servers and desktops operations.
• A key component of the defense-in-depth philosophy in security is to know your vulnerabilities and fix them before they are discovered and exploited by hackers. This course will introduce the participants to techniques of conducting vulnerability assessment thoroughly and in a safe manner.
• Participants will learn about the security role operating systems play and how they can be compromised. The course will cover common vulnerabilities found on servers and desktops and how to conduct assessment to discover them. After vulnerabilities are discovered it is important to fix them and this course will discuss some mitigation techniques.
• The course format will be a combination of lecture and hands-on exercise to solidify understanding. At the end of the course the participant will understand and will be able to conduct server and security assessment for their organization.

• Understand the methodology used in conducting server and desktop security assessment.
• Understand common vulnerabilities for servers and desktops
• Learn the ways to mitigate the vulnerabilities
• Have hands-on experience doing server and desktop security assessment

• Management, Administrator, IT Security personnel who are in charge of operating system security in their organization
• Anyone interested to learn server and desktop security assessment

• Operating system role in security
• Hacking Windows operating system
• Hacking Unix operating system
• Host security assessment
• Common vulnerabilities in Windows and Unix operating systems
• Mitigation strategies
• Hands-on exercise
• Conclusion and suggestion for further exploration

• This training is a practical qualification for those that work in the fields of data protection and privacy. It is fully up to date with the requirements of the Personal Data Protection Act (PDPA) as well as giving an understanding to the General Data Protection Regulation (GDPR).
• Successful completion of the program demonstrates to employers and others that the candidate possesses a solid knowledge of requirements of data protection law, able to identify all components of data control process, translate the rules set out in PDPA to their own work environment, apply the translated concept in their own work practices and implement data security technologies to protect the data within the organization.

• Data Security is the means of ensuring that data is kept safe from corruption and that access to it is suitably controlled. Data Security helps to ensure privacy to protect business and personal data.
• This course provides the candidate with the following objectives:
• Able to understand the importance of Data Security
• Able to design and implement data protection policy for the organization to manage the data risk exposures
• Able to translate the regulatory requirements to be part of the data protection policy
• Able to understand, identify and implement the latest data security technologies
• Able to audit database activities
• Able to assess database system vulnerabilities and provide remediation
• Able to understand and implement data encryption on personal and sensitive dataarn the ways to mitigate the vulnerabilities
• Have hands-on experience doing server and desktop security assessment

---

Target Participants

• Working professional who wishes to acquire and enhance their knowledge and skills in data security, implement data protection policy, conducting audits to ensure compliance and address potential issues proactively.

---

Module Synopsis

• Data Protection Essential Knowledge
• Understanding Data Protection Regulations
• Personal Identifiable Information
• Data Protection Program
• Data Access Control
• Data Security Technologies
• Cryptography
• Key Management Lifecycle
Register

• This training expose participants with skills in Industrial Control System (ICS) Security. Participants will be able to apply the concepts of ICS Cybersecurity and provide technical instruction on the protection of ICS using offensive and defensive methods. Participants will be able to recognize how cyber-attacks are launched, why they work, how to perform ICS security assessment and mitigation strategies to increase the cybersecurity posture of their control system networks.

• To identify security vulnerabilities of ICS and their exposures to cyber threats
• To perform reconnaissance and information gathering on ICS sites
• Define ICS security assessment scope and activities
• Conduct ICS security assessment using the appropriate methods and tools
• Identify various strategies to defend an ICS network
• Apply the knowledge of ICS security governance

• ICS practitioner and IT practitioner who works in ICS field.

• Module 1: Introduction to ICS
• Industrial Control System Overview
• ICS Components & Data Flow
• ICS Architecture Overview
• Common ICS Ports and Protocols
• Module 2: ICS Security
• Cyber Security and ICS
• Case Study
• ICS Security Trends
• ICS Vulnerability Database
• Conference, Training and Certification, News and Blogs
• Security Assessment
• Module 3: ICS Security Assessment
• Basic ICS Security Assessment Methodology
• Hands- On and Lab Assessment
• Module 4: ICS Security Governance
• Defense- in-Depth
• Security Documents
• Incident Handling
• Incident Mitigation

• This training exposes participants with skills to assess IoT environment which includes robotic technology, web application, wireless network, and cloud. Participants will be able to identify, perform and mitigate security issues as part of securing IoT environment.

• To analyse the main components in IoT environment and technology
• To understand the capabilities of components in IoT environment
• To conduct Network Security Assessment involving assessing the security protocol
• To identify possible mitigation processes
• To defend the communication in IoT environment
• To perform application security assessment
• To provide remediation strategies
• To defend the applications in IoT environment
• To determine security risk and incident management plan of IoT environment

• IT developer, security analyst, engineer, and cloud security analyst.

• Module 1: Introduction to IoT
  • Module 1.1: Introduction to IoT Security
    • Component of IoT Security
      • Robotic
      • Wireless
      • Web Application
      • Cloud Computing
      • IoT Security Guideline
      • Outcome from IoT Security
  • Module 1.2: IoT Technology
    • History of IoT Technology
    • Current IoT Technology
    • IoT In Security
    • Previous Incident in IoT
• Module 2: Robotic Technology
  • Module 2.1: Introduction to Robotic Technology
    • Introduction to robotic components
    • Introduction to robotic communications
  • Module 2.2: Case Study
    • Case Study 1: Manufacturing
    • Case Study 2: Autonomous System
  • Module 2.3: Introduction to type of robotics
    • Collaborative Robot
    • Industrial Robot
• Module 3: Wireless Network Assessment
• Module 3.1: Introduction to Wireless Network
  • Wi-Fi network fundamentals
  • Wireless network standard and organization
  • Wireless threats and attacks
• Module 3.2: Information Gathering
  • Active and Passive Scanning
  • Using tool: Kismet
• Module 3.3: Penetration Testing
  • Wired equivalent privacy (WEP)
  • Wi-Fi Protected Access (WPA)
  • Wi-Fi Protected Access 2 (WPA2)
  • Cracking WEP & WPA
  • Wi-Fi protected setup (WPS)
• Module 3.4: Wireless Network Defense
  • Mitigation process
• Module 4: Web Application Security
  • Module 4.1: Introduction to Web Application Security
    • Use of web applications
    • Importance of web applications in IoT
  • Module 4.2: Web Application Threat in IoT
    • OWASP Top 10 2019
    • SQL Injection
    • Cross Site Scripting (XSS)
  • Module 4.3: Penetration Testing
    • SQL Injection on Vulnerable Web Site
    • Cross Site Scripting on Vulnerable Web Site
  • Module 4.4: Web Application Defense
    • Mitigation process
• Module 5: Cloud
  • Module 5.1 Introduction to Cloud
    • Introduction to Cloud
    • Type of Cloud Computing
    • Public, Private vs Hybrid Cloud
  • Module 5.2 Cloud as a Services
    • Infrastructure as a Services
    • Platform as a Services
    • Software as a Services
  • Module 5.3 Concept and Architecture
    • Importance of Cloud Computing in IoT
    • Secure Cloud Architecture
    • Secure Cloud Implementation
• Module 6: Security in IoT
  • Module 6.1 Introduction to IoT Security Guideline
    • The importance of IoT Security
  • Module 6.2 Introduction to IoT Security Infrastructure
  • Module 6.3 Introduction to IoT Security layer/li>
  • Module 6.4 IoT Security Requirement
    • Guideline on IoT Security Requirement

• This course explores on the application of secure software development life cycle framework focusing in PHP programming specifically in developing, testing, managing, or securing PHP based applications. Participants will be able to identify possible security issues, perform code reviews, and review application logs.

• To define the framework of Secure Software Development Life Cycle (SSDLC).
• To identify application security component required in each phase of Software Development Life Cycle (SDLC), Requirement, Design, Development, Testing, Deployment and Maintenance.
• To conduct the hands-on for threat modelling and the interpretations of the result.
• To conduct hands-on for PHP source code review to ensure that methodologies are covered, and recommended solutions are implemented based on industry’s best practice.
• To conduct hands-on for application development self-validation.
• To define the secure deployment mechanisms, process that includes using relevant tools, standard or best practices (e.g. OWASP, CWE, CIS, & etc).
• To determine countermeasures and mitigations against potential exploitations of application frameworks and software vulnerabilities based on threat modelling results.
• To identify and plan the application patches or the extent of releases that are compatible to the application to sustain application’s integrity and availability.

• Developer, security architects, software engineer/designer.

• Module 1: The need for S.S.D.L.C
  • The concept of Secure Software Development Life Cycle (S.S.D.L.C)
  • Software Development Life Cycle (SDLC) as of today and its frameworks
  • The difference between SDLC and S.S.D.L.C
  • The phases of S.S.D.L.C and security activities
  • Run PoC
  • The concept of Web Application Vulnerabilities (OWASP Top 10 vs. ASVS)
• Module 2: Security Requirement & Design
  • The Concept of Security Requirement
  • Define Security Requirement
  • Use Case: Misuse Case & Security Use Case
  • Tools & Hands-on Exercises
  • Concept of Secure Design
  • Common Security Activities in Secure Design (Design Principles, Architecture Review, Threat Modelling)
  • Tools & Hands-on Exercises
• Module 3: Securing the PHP Source Code
  • Secure Coding Implementation based on OWASP Top 10 and ASVS v4.0
  • Tools & Hands-on Exercises based on
    • A1: Injection
    • A2: Broken Authentication
    • A3: Sensitive Data Exposure
    • A4: XML External Entities (XXE)
    • A5: Broken Access Control
    • A6: Security Misconfiguration
    • A7: Cross-Site Scripting (XSS)
    • A8: Insecure Deserialization
    • A9: Using Components with Known Vulnerabilities
    • A10: Insufficient Logging & Monitoring
• Module 4: Self-Secure Validation
  • Testing Framework
  • Identified Attack Vectors
  • Security Testing Component
  • Self-Secure Validation Test
  • Tools & Hands-on Exercises based on
    • A1: Injection
    • A2: Broken Authentication
    • A3: Sensitive Data Exposure
    • A4: XML External Entities (XXE)
    • A5: Broken Access Control
    • A6: Security Misconfiguration
    • A7: Cross-Site Scripting (XSS)
    • A8: Insecure Deserialization
    • A9: Using Components with Known Vulnerabilities
    • A10: Insufficient Logging & Monitoring

• This training exposes participants with the relevant skills and knowledge in fundamentals of smart card and its devices, based on the smart card devices ecosystem. Participants will learn the skill and knowledge in smart card security, smart card devices security (reader, Software Development Kit (SDK), applications, etc.) and the fundamentals in cybersecurity (understanding the 3 pillars of IT security: Confidentiality, Integrity and Availability.
• Participants will be able to understand the operations of smart card reader in forms of its components: hardware, firmware, Application Protocol Interface (API), biometric sensor, SDK, and applications. Participants will be exposed with the knowledge in performing IT security assessment using the methodology of Common Criteria, with reference to Common Evaluation Method (CEM).
• This training will also include the knowledge in performing vulnerability assessment and penetration testing inclusive of reverse engineering applications and memory forensic. Participants will be able to produce technical report that highlights the test findings based on risk defined on the vulnerability found during the IT security testing. Lastly, participants will be able to provide recommendations and improvement based in the findings defined inside the test report.

• To provide the fundamentals knowledge in smart card reader security testing in the form of theoretical and hands-on exercises.

• Individual may have background as smart card developer, hardware programmers, IT security officers, security testers and anyone is concerned about smart card reader security.

• Module 1: Fundamental of Smart Card Reader
  • Topic 1.1: Introduction to Smart Card Reader
    • Summary: This topic will be covering the fundamental of smart card reader where the introduction to the main components (software and hardware) and the physical properties of smart card reader. The following is the sub-topics will be covered in the training module, as follows.
      • Theory on Smart Card Reader:
        • Definition of SCR.
        • Type of SCR.
        • SCR Mode Operation.
        • SCR Architecture.
      • Physical Device Properties:
        • Device Specification.
        • Hardware Components.
        • Printed Circuit Board (PCB).
      • Exercise 1 – Quiz and/or Hands on activity.
  • Topic 1.2: Smart Card and Reader Communication
    • Summary: This topic will be discussing about the communication between smart card and the reader. This topic will highlight all the communication details of both components to give the description of SCR working architecture. The following is the sub-topics will be covered in the training module, as follows.
      • Introduction to Smart Card Reader Communication:
        • Answer to Reset (ATR) protocol.
        • Personal Computer and Smart Card (PC/SC) protocol.
      • Smart Card and Reader Communication Method:
        • Communication Protocols.
        • Communication Application Protocol Data Unit (APDU).
      • Exercise 2 – Quiz and/or Hands on activity.
• Module 2: Security, Threats & Evaluations
• Topic 2.1: IT Security Principles
• Summary: This topic be covering all the fundamentals of IT security principles which are very important for IT security environment or ecosystem. The following is the sub-topics will be covered in the training module, as follows.
  • Introduction to Security Principles:
    • Security Definition.
    • Security Pillars.
    • Security Elements.
  • Exercise 3 – Quiz and/or Hands on activity.
• Topic 2.2: Security Threats & Security Controls
  • Summary: This topic be covering on the threats and security controls for smart card security environment and smart card reader ecosystem. The following is the sub-topics will be covered in the training module, as follows.
    • Overview of Security Threats and Security Controls:
      • Security Threats.
      • Threats Attackers.
      • Security Flaws.
      • Security Controls.
      • Model of Security Controls.
      • NIST Framework for Security Controls.
    • Smart Card Reader Security Threats and Security Controls:
      • Smart Card Reader Threats.
      • Security Controls to Smart Card Reader Threats.
• Topic 2.3: Security Evaluations and Certifications
  • Summary: This topic be covering the security evaluations approach and process flow that are applicable for a smart card reader. All the theory and general framework of security evaluation will be discussed. The following is the sub-topics will be covered in the training module, as follows.
    • Introduction to Security Evaluations:
      • Overview of Security Evaluation.
      • Goal of Security Evaluation.
      • Objective of Security Evaluation.
      • Target and Purpose.
      • Method of Security Evaluation.
      • Structure of Security Evaluation Criteria.
      • Types of Security Evaluation.
      • Organizational Framework.
      • Cost and Benefits.
    • Security Evaluation Frameworks:
      • Federal Information Processing Standards (FIPS 140).
      • Payment Card Industry Data Security Standard (PCI-DSS).
      • Common Criteria Evaluation and Certification (CC).
    • Exercise 4 – Quiz and/or Hands on activity.
• Topic 2.4: Security Testing by CyberSecurity Malaysia
  • Summary: This topic be covering the current security evaluation by CyberSecurity Malaysia. The following is the sub-topics will be covered in the training module, as follows.
    • Common Criteria Evaluation & Certification (MyCC).
    • ICT Product Security Assessment (IPSA).
    • Technology Security Assurance (TSA).
• Module 3: Smart Card Reader Security Testing
  • Topic 3.1: Introduction to Security Testing
    • Summary: This topic be covering on the overview of security testing based on method, approach, tools, and techniques used during the test execution. The following is the sub-topics will be covered in the training module, as follows.
      • Overview of Security Testing:
        • Definition of Security Testing.
        • Goal of Security Testing.
        • Types of Security Testing.
        • Knowledge in Security Testing.
        • Approach of Security Testing.
  • Topic 3.2: Perform Security Testing
    • Summary: This topic will allow participant to perform hands-on exercises and participate in performing the test by using the knowledge learned during the training on an actual smart card reader device. The following is the sub-topics will be covered in the training module, as follows.
      • Physical Tampering.
      • Communication Sniffing.

• The outcome of this training is to perform penetration testing, assess identified web applications and find security vulnerabilities in-line with industry best practices. Participants will be able to apply both technical techniques and security best practices to conduct a web application penetration test, document vulnerabilities and produce comprehensive reports with recommended solutions.

• To define the scope of web application penetration testing and identify relevant activities required.
• To perform surveillance and information gathering.
• To Conduct and document the findings of web application penetration test using appropriate tools and software.
• To produce a report on the outcome of web application penetration testing.

• Managements, Administrators, and IT Security Personnel in-charge of security in their organizations.
• Individuals who wants to learn web application security and experience some hands-on penetration testing exercises.

• Module 1: Defining the Scope
  • Web Application Basic
  • N-Tier Application Architecture
  • Cyber Security Standards & Best Practices
  • System Process Flow
  • Attack Plan, Defenses/Obstacles & Attitude/Safety Practices
  • Types of Vulnerabilities, Attacking Techniques & Full Access Requirements to Target Systems
• Module 2: Reconnaissance/Information Gathering & Mapping
  • Basics of Reconnaissance
  • Types and Categories of Security Tools & Technologies for Reconnaissance & Information Gathering
  • Reconnaissance & Information Gathering Processes (Reconnaissance & Mapping):
    • Components of the Target System
    • Component Relationship
    • Session Management
• Module 3: Web Application Penetration Testing/Security Assessment
  • Vulnerability Discovery Techniques
• Module 4: Remediation Strategy (Types of Vulnerabilities & Common Threats and Defend)
  • SQL Injection & Blind SQL Injection
  • Cross Site Scripting (XSS)
  • Information Leakage and Improper Error Handling
  • Sensitive Data Exposure
  • Cross Site Request Forgery
  • Failure to Restrict URL Access
  • Remote File Include (RFI)
  • Broken Authentication & Session Management
• Module 5: Exploitation (Web Application Cyber Attacks)
  • Cross Site Scripting (XSS)
  • Information Leakage and Improper Error Handling
  • Sensitive Data Forgery
  • Failure to Restrict URL Access
  • Remote File Include (RFI)
  • Broken Authentication & Session Management
• Module 6: Reporting