Web Application Security (OWASP Top 10) Fundamentals Training
A one-day fundamentals programme on OWASP Web Top 10. Learn how to recognise and reduce common security weaknesses in websites and business applications. Participants work through practical examples and a guided case before drafting actions for their own organisation.
Who should attend: Developers, application owners, testers, IT operations and security reviewers. No prior framework knowledge is required.
HRD Corp claim support available
Programme Agenda
9:00 AM to 10:00 AM
Web Security and the Current Top 10
Introduce OWASP Top 10:2025 as an awareness and prioritisation resource. Map users, browser, server, data stores and third parties, then distinguish a risk category from a complete testing standard.
10:00 AM to 10:15 AM
Break
10:15 AM to 11:30 AM
Identity and Access
Recognise weak authentication, session handling and broken access control through account and record-access scenarios. Identify server-side checks and why hiding a button does not enforce permission.
11:30 AM to 12:30 PM
Input, Data and Design
Explain injection risks, sensitive data protection and insecure design at a conceptual level. Choose safe query handling, validation and appropriate cryptography without assuming that one scanner covers design flaws.
12:30 PM to 1:30 PM
Lunch
1:30 PM to 2:45 PM
Configuration and Software Dependencies
Explore misconfiguration, software supply chain and integrity risks. Identify responsibilities for supported components, secure configuration, secrets and controlled changes.
2:45 PM to 3:00 PM
Break
3:00 PM to 4:00 PM
Monitoring and Safe Failure
Consider security logging, alerting and exceptional conditions. Define what needs recording, how staff respond and how an application should behave when authentication, dependencies or processing fail.
4:00 PM to 5:00 PM
Practical Exercise: A Customer Portal Review
Review a fictional portal's design and illustrative findings. Map issues to current risk categories and propose prevention, verification evidence and remediation priorities.
Key Outcomes
- Recognise common web application risk categories
- Identify access, data and configuration weaknesses
- Select prevention and verification actions
- Prioritise findings and operational follow-up
Training Mode Physical / Online / Hybrid
HRD Corp Subject to programme eligibility and HRD Corp approval
Level Fundamentals / Beginner. No prior framework knowledge required.
Duration 1 Day | 9:00 AM to 5:00 PM (6.5 learning hours, excluding breaks)
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Group case exercise and a 10-question knowledge check
Certificate Orbix Certificate of Completion upon full attendance; not a professional certification
Malaysia Relevance
High relevance for Malaysian software and IT teams maintaining public websites, customer portals and internal applications. Examples focus on design and verification decisions rather than exploit instructions or penetration testing certification.
Practical Takeaways
A web application review checklist and risk-to-remediation worksheet.
Download a sample practice worksheet (TXT). This fictional exercise is a preview of the learning approach. About Orbix; contact us to confirm the facilitator and relevant experience for your delivery.
Course Completion and Next Steps
Participants receive an Orbix Certificate of Completion upon full attendance. This introductory course does not confer professional certification or establish an organisation's compliance. Further implementation and assessment depend on the organisation's scope and obligations.
Frequently Asked Questions
Related Fundamentals Training
Payment Card Data Security (PCI DSS) Fundamentals AI Security Controls (CSA AICM) Fundamentals Cloud Security (ISO/IEC 27017) Fundamentals AI Agent Runtime Security (OWASP Agent Control Standard) Fundamentals View all fundamentals programmes
Reference material: OWASP: Top 10 web application security risks.