The OWASP Top 10 list, generated by OWASP, contains the 10 most critical vulnerabilities that are usually found during Web Application Analyses.

During this training, the following topics will be covered:

• Explanation of every vulnerability in the Top 10 list.
• Different ways of detecting them (manually and automatically).
• Practical demonstrations of their exploitation.
• Development best practices to avoid each one of the vulnerabilities.

Duration: 12hs (1 and a half day, o 3 half days)

Attendants will get to know the basic tasks involved in a mobile app security testing project, from understanding the app to reversing the code and modifying it.

Known vulnerabilities for mobile apps will be introduced based on the “OWASP Mobile Top 10” list, and real examples will be shown.

Usual problems that arise when testing an app will be shown, as well as known workarounds for them.

The set of tools used in every task will be introduced and explained.

Even though most of the subjects treated will be cross-platform, the demos and tools shown will be oriented to Android.

Duration: 8hs (1 full day or 2 half days)

This training will cover the importance of Information Security through the Software Development Life Cycle (SDLC).

Attendees will get to understand the threats and vulnerabilities that every application is exposed to, and proactively detect possible weaknesses and errors made during a development project. This way, they will be able to develop more secure applications and avoid vulnerabilities.

The training contents are aimed at Information Systems management, Information Security and Development staff.

During this training, the following topics will be covered:

• The role of Information Security throughout the SDLC.
• Security in Requierement Analysis.
• Security in the Design stage.
• Security in the Coding stage.
• Security in the Testing stage.
• Security in the Implementation stage.
• Introduction to vulnerabilities and OWASP Top 10.

Duration: 8hs (1 full day or 2 half days)

This workshop will provide you with all the tools, materials, and references for further study and research. The workshop covers from the Low Frequency band (mainly used for individual physical access to buildings, garages, hotels, etc.) to the High Frequency band, where NFC is the main term we are going to discuss about.

We will understand which type of access cards can be emulated or even cloned; then we are going to use traditional NFC USB readers, we will compile and execute the famous LibNFC, and play with some special hardware like the Proxmark3 and HydraNFC.

Arduino examples will be shown to deal with both Low and High frequency cards and tokens. We will try to create our own cloner in less than 50 lines of code!

The last part of the workshop will review HID iClass vulnerabilities and focus on NXP Mifare Classic technology and public hacks.

By the end, we will discuss some case studies, practical hacks and lessons learned from working systems the can be found in the wild.

Duration: 8hs (1 full day or 2 half days)

The security level of you company depends strongly on the awareness level of your staff about the importance of information, and the threats and dangers they are constantly exposed to.

In order to adjust our service to your company and help improve your security, Cinta Infinita offers awareness talks on a variety of topics. Some of the issues that our customers are usually interested in are:

• Security on the Internet and Social Networks.
• Information Leakage.
• Electronic fraud and Identity theft.
• Malware, Spam and the use of email.
• Social Engineering and the dangers of phishing.
• Security in the family.
• Secure passwords.
• And many more...

Contact us so we can create a custom awareness plan tailored to your needs.