iSAQB® WEBSEC - Web Security

A web application usually comes under automated attack attempts soon after it goes live, because the circle of possible attackers grows with the circle of users. WEBSEC at tecnovy works through the security architecture of exactly those systems, from threat analysis and cryptography to the defences that run in operations. You break each known attack down into its steps and derive the design decisions that make it harder.

iSAQB Accredited Training PartnerAttendance certificate4.8/5 on ProvenExpert

What this module delivers.

Injection, denial-of-service, man-in-the-middle, credential stuffing: WEBSEC works through a web application's attack surface class by class. At tecnovy you then decide which countermeasure belongs in the architecture and which in operations, and derive checkable acceptance criteria.

How the training runs

Method: Work through attack classes, weigh countermeasures against each other
Basis: Official iSAQB WEBSEC curriculum 2020.1-rev10
Outcome: 30 credit points: 10 methodical, 20 technical, no course exam

Dates & booking

Choose a date that fits

No public dates are scheduled yet.

New dates are published regularly. Join the waitlist or plan an in-house course for your team.

Request in-house training

Fit

Who this module is designed for

Typical roles

You design or review web applications that are reachable from the internet.
You decide on authentication, authorisation and how credentials are handled.
You answer the security questions that come out of audits, acceptance reviews and customer assessments.

Prerequisites

No prerequisites

You can start right away. Helpful: basic knowledge of network communication, basic knowledge of HTML, CSS and JavaScript, hands-on experience building web applications.

Consider instead WEB Builds up HTTP, architecture styles and scaling across 1140 minutes; WEBSEC, by contrast, already assumes basic knowledge of web technologies and web development.

Curriculum

CPSA® WEBSEC Course in Detail

Curriculum 2020.1-rev10 splits WEBSEC into six parts across 1080 teaching minutes. The first three apply to any system: analysis, the secure development process, cryptography. The last three belong to web applications, their attackers and the infrastructure around them, with 675 of the minutes.

01Analysis

This part settles what is worth protecting and how much protection is proportionate.

Threat modeling and attack trees as the analysis tools
Security goals such as confidentiality, integrity, authenticity, availability and liability
Trading security off against usability, cost and business purpose
Guidelines and rating: ISO 27000, OWASP, PCI-DSS, GDPR, CVSS

02Secure design and development process

Here security moves out of the review and into the development process itself.

Validating every input and escaping every output as the ground rule
Security gates, the two-man rule and trust no one
Secure coding patterns: secure factory, secure state machine, secure logger
OWASP SAMM, MS SDL and BSIMM as frameworks; SAST, DAST, IAST and SCA as analysis methods

03Cryptography

This part turns cryptography into a selection decision rather than a build project.

Hashing procedures, salting and rainbow-table attacks
Symmetric and asymmetric procedures, entropy and perfect forward secrecy
Trust concepts: PKI, CA models and the web of trust
X.509 certificates, digital signatures and the use of existing libraries

04Web: Technical foundation

One of the two longest parts: who gets in, and how the system recognises them.

Authentication types from HTTP auth through multi-factor to single sign-on
Authorisation with OAuth, OpenID Connect, SAML and JWT
Stateless against stateful concepts and what each of them costs
TLS as a security-related protocol, and the limits of security through obscurity

05Web: Known attacks and attack vectors

A quarter of the curriculum is the attacks themselves, each taken by how it works.

Attack vectors sorted by application, operating system, network, design and process layer
Injection, DoS and DDoS including botnets, man-in-the-middle
Fuzzing as a black box test, in-memory attacks and backdoors
Social engineering, credential stuffing, and sources such as the OWASP Top Ten and SANS25

06Web: Security and infrastructure

To close, everything that surrounds the application.

Firewalls, packet filtering and the architectural consequences of a DMZ
Web application firewalls plus intrusion detection and prevention
Logging, monitoring and fixed feedback processes out of operations
Using TLS even inside closed networks

Official syllabus

Outcome

What you will be able to do afterwards

01
You identify assets worth protecting, model threats with attack trees and compare CVSS and the OWASP Rating as classification systems.
02
You justify the trade-off between security, usability and cost, and derive acceptance criteria from it.
03
You anchor input validation, output escaping and security gates in the development process.
04
You separate SAST, DAST, IAST and SCA from each other and pick the method that fits.
05
You select hashing and encryption procedures with reasons, and distinguish PKI, the web of trust and X.509 certificates.
06
You design authentication and authorisation using multi-factor, OAuth, OpenID Connect, SAML or JWT.
07
You analyse injection, DoS and man-in-the-middle attacks, and derive design decisions that make them harder.
08
You plan firewalls, a DMZ, a WAF and intrusion detection as part of the architecture rather than as an afterthought.

Credit points toward CPSA-A

Methodical competence: 10
Technical competence: 20
Communicative competence: 0

30 of 70 points toward CPSA-A admission

Open the Credit Planner iSAQB Board → Credit point rules Guide →

Certificate of participation

The tecnovy certificate of participation records your attendance of the WEBSEC training, not a passed examination.

Open the Certificate Showroom tecnovy →

≥80%attendance

Trainers

Markus Geiger

Trainer and Architect

Adrian Metzner

Software Developer & Trainer

Johannes Bumüller

Trainer & Software Developer

Why tecnovy

What you get on top with us

iSAQB® Accredited Provider

We are an officially accredited Training Provider of the International Software Architecture Qualification Board.

Certificate Showroom

Get your certificate of participation and, if you have one, add your exam certificate from E-Learning. Fully automated, beautifully designed. Just for you, only at tecnovy.

No Slideshow, Hands-On!

Promised: no PowerPoint marathon. We work in groups, tie theory to practice, and you get real project examples from our experienced trainers plus the exchange with like-minded people.

Attend Twice, Pay Once

You are welcome to attend the training online again within a year as a refresher.

Learn from Experts

We always guarantee you the use of didactically and methodically first-class qualified trainers who draw their knowledge from training experience as well as professional practical and project experience.

Flexible Date Change

If you are not able to attend the course, you can rebook your training free of charge up to one week before the start of the training.

FAQs

Frequently asked questions

01Do I need CPSA-F to attend the tecnovy WEBSEC training?

No. The iSAQB curriculum for the WEBSEC module lists only basic knowledge of network communication, web technologies and the creation of web applications as prerequisites, and names no certification among them. For the later CPSA-A certification, CPSA-F is mandatory.

02Is there a WEBSEC examination?

No. There is no examination for the WEBSEC module. The tecnovy WEBSEC training earns you 30 credit points and a certificate of participation; the assessment comes later on the path to CPSA-A certification, and it covers all modules together.

03How many credit points does WEBSEC carry?

The tecnovy WEBSEC training carries 30 credit points: 20 technical and 10 methodical. WEBSEC awards no communicative points, which matters for your planning: CPSA-A admission requires 70 points in total and at least 10 in each of the three areas of competence. The iSAQB may re-evaluate point allocations every 12 months; these figures are as of August 2026.

04How does the CPSA-A certification work?

CPSA-A certification consists of a written assignment. Two examiners recognised by the iSAQB assess it, and you then defend it in discussion with them. You can take it in German or English, and tecnovy is glad to help if you have questions about the process.

05How long is the WEBSEC training?

The tecnovy WEBSEC training runs for three days. The iSAQB curriculum requires at least two days and 1080 teaching minutes, which is 18 hours; tecnovy spreads those minutes across three days and so runs one day beyond the required minimum.

06What is the difference between WEBSEC and WEB?

WEBSEC covers the security of web applications and assumes basic knowledge of web technologies; WEB builds exactly those foundations, spending 1140 teaching minutes on HTTP, URIs, TLS, architecture styles such as REST and single-page applications, and on proxies, load balancing and scaling. WEB awards 30 technical credit points, WEBSEC 20 technical and 10 methodical.

07Does WEBSEC work through the OWASP Top Ten?

In the tecnovy WEBSEC training the OWASP Top Ten are a source, not the structure. The curriculum sorts attack vectors by application, operating system, network, design and process layer, and covers injection, DoS, MITM, fuzzing and social engineering by how they work. OWASP also appears as a rating system and through the OWASP SAMM maturity model.

08Does WEBSEC cover embedded systems or physical security?

No. The tecnovy WEBSEC training follows the web variant of the curriculum, meaning web applications and the infrastructure around them. The curriculum explicitly excludes organisational entry control, structural measures such as fire protection and locking systems, legal foundations, and hardware attacks such as biometrics or emissions.

09Do I get the flipcharts from the WEBSEC training?

Yes. After the tecnovy WEBSEC training you receive the flipchart notes from all three days as a photo protocol.

What does your training at tecnovy look like?

WEBSECWEBSEC - Web Security

No dates yet

We will let you know as soon as the next date is scheduled.