ISO/IEC 27034 Certified Lead Auditor

The ISO/IEC 27034 Lead Auditor training enables you to acquire the necessary expertise to perform application security (SA) audits by applying recognized audit principles, procedures and techniques. You will learn to plan and conduct application security audits, manage an audit program, a team, client communication and conflict resolution.

Specific objectives:

• Explain the correlation between ISO/IEC 27034 and other standards and regulatory frameworks
• Know how to lead an audit and an audit team

• None

• Code: ISO/IEC 27034
• Duration: 5 days
• Schedule: 8:30 AM - 5:30 PM
• Location: Training center, North Urban Center

• Anyone responsible for maintaining compliance with application security requirements
• Auditors wishing to perform and lead application security audits

• Course materials
• 40% demonstration
• 40% theory
• 20% practical exercises

• Day 1: Introduction to application security and ISO/IEC 27034 standard
  • Training objectives and structure
  • Normative and regulatory frameworks
  • Validation process
  • Fundamental principles of application security
  • General overview of application security
• Day 2: Principles, preparation and initiation of an application audit
  • Business risks facing application threats
  • Understanding and discovering vulnerabilities
  • Testing methods
  • Session management
  • Authentication and authorization issues
  • Tool specifications
• Day 3: Application security audit activities
  • Best practices in application security
  • Code evaluation techniques
  • Information flow analysis
  • Data validation
  • Cryptography
  • Dynamic testing (fuzzing)
  • Defining quality gates/bug bar
  • Security and privacy risk analysis
• Day 4: Closing the application audit
  • Verification of threat models/attack surface
  • Threat modeling
  • Enforcing forbidden functions
  • Static analysis
  • Intervention plan
  • Final security review
  • Auditor competence and evaluation
  • Training closure
• Day 5: Exam