Application Security (OWASP)
- OWASP Top 10
- What’s Changed & Why
- OWASP Top 10 Proactive Controls
A01 Broken Access Control
- What’s the Risk – Notable CWE’s
- What to Check
- Case Study #1
- Case Study #2
- Session Management
- Insecure direct object references
- Typical authorisation components
- Using indirect references
- When not to secure by URL
A02 Security Misconfiguration
- What’s the Risk – Notable CWE’s
- What to Check
- Case Study
- AWS S3 Bucket Audit Checklist
- Azure Tenant (Entra ID) Audit Checklist
- Valuable error messages
- Leakage issues
- Configuration files and sensitive data
- Google Dorks to find config files
A03 Software Supply Chain Failures
- What’s the Risk – Notable CWE’s
- What to Check
- Case Study #1
- Case Study #2
- Software Bill of Materials (SBOM) Ingredients
A04 Cryptographic Failures
- What’s the Risk – Notable CWE’s
- What to Check
- Cryptographic Resilience (PQC)
- Case Study
A05 Injection
- What’s the Risk – Notable CWE’s
- What to Check
- Core Vulnerability Mechanism
- Case Study
- Key Prevention Strategies
A06 Insecure Design
- What’s the Risk – Notable CWE’s
- What to Check
- Insecure Design Scenarios
- Case Study
- Key Prevention Strategies
A07 Authentication Failures
- What’s the Risk – Notable CWE’s
- What to Check
- Common Vulnerabilities
- Case Study #1
- Case Study #2
- Key Prevention Strategies
A08 Software or Data Integrity Failures
- What’s the Risk – Notable CWE’s
- What to Check
- Key Vulnerability Areas
- Key Data Integrity Principles (ALCOA+)
- Core Pillars of Software Integrity
- Key Technical Controls
- Case Study
- Key Prevention Strategies
A09 Logging & Alerting Failures
- What’s the Risk – Notable CWE’s
- What to Check
- Case Study
- Mitigation Strategies
- Logging best practices
- And what should not be logged?
A10 Mishandling of Exceptional Conditions
- What’s the Risk – Notable CWE’s
- Why this new category?
- What to Check
- Modern Attack Scenarios
- Case Study
- Key Prevention Strategies
OWASP Emerging Technology
- Challenges of AI Generated software
- OWASP Top 10 Large Language Model (LLM)
- Prompt injection
- Insecure output handling
- Training data poisoning
- Model denial of service
- Supply chain vulnerabilities
- Sensitive information disclosure
- Insecure plugin design
- Excessive agency
- Overreliance
- Model theft
- OWASP Top 10 for Agentic Applications
- Agent Goal Hijack
- Tool Misuse & Exploitation
- Identity & Privilege Abuse
- Supply Chain Vulnerabilities
- Unexpected Code Execution
- Memory & Context Poisoning
- Insecure Inter-Agent Comms
- Cascading Failures
- Human-Agent Trust Exploit
- Rogue Agents
- Model Context Protocol (MCP) Challenges & Mitigation
- AI Resource Protection
Exams and assessments
Candidates will receive individual emails to access their AMPG candidate portal, typically available one week post exam. If you experience any issues, please contact the APMG technical help desk on 01494 4520450.
- Duration: 45 minutes
- Questions: 40, multiple choice (4 multiple choice answers only 1 of which is correct)
- Pass Mark: 50%
Successful candidates will receive the Certified in OWASP Security Fundamentals digital badge via Credly.
