Securing Databases: Practical Database Security Skills for Safer Systems

• Two days of instructor-led lecture with follow-along demonstrations.
• Demonstrations use a simple ASP.NET (C#) web application to show injection and related flaws in context.
• Covers data at rest and in motion, privilege and access control, configuration risk and monitoring.
• Ends with secure development practice: SDLC, threat modeling, secure design and secure coding.

• A general understanding of databases is recommended.
• Basic familiarity with websites and web servers is helpful.
• C# or software-development experience is not required.

By the end of this course, participants will be able to:

• identify vulnerabilities safely and responsibly using ethical bug-hunting techniques
• apply core database security principles to reduce risk across database environments
• protect data at rest and in motion with appropriate controls
• recognize common attack vectors including SQL injection, malware, ransomware and insider threats
• implement effective privilege and access controls using practical role-based approaches
• apply a layered strategy that combines preventive, detective and responsive controls

• 1. Bug Hunting Foundations
  • Why bug hunting matters, and safe, appropriate vulnerability identification.
  • Principles of information security.
  • Fingerprinting databases; data flows and validation.
• 2. Database Security Fundamentals
  • Securing data at rest and in motion.
  • Asset identification and inventory.
  • Privilege management, boundary defenses and continuity of service.
• 3. Database Vulnerabilities and Attack Vectors
  • Insecure design; access control and authentication weaknesses; insider threats.
  • Injection attacks, including SQL injection and cross-site scripting.
  • Vulnerable and outdated components, configuration flaws and data integrity flaws.
  • Malware and ransomware, insecure data handling and third-party risk.
• 4. Detection, Protection and Resilience
  • Logging and monitoring; cryptography fundamentals.
  • Data breach considerations.
  • Security testing, code inspection and compliance considerations.
• 5. Secure Development Practices (time permitting)
  • Secure Development Lifecycle (SDLC) and threat modeling.
  • Secure design and secure coding.