The applications we develop are increasingly distributed, accessible from anywhere, and connected to many other systems and services. The convenience, innovation, and productivity these applications deliver to our customers, employees, and partners is impressive, but it comes with risk. As developers and IT professionals we have the responsibility to provide a safe and secure experience for our organizations and users.

In this two-day seminar, we will consider the dangers of a weak security posture and explore common vulnerabilities and attacks, including the top OWASP attacks. You will learn about secure design and engineering principles like defense in depth, zero trust, shared responsibility model, and the security development lifecycle. I’ll also show you ways you can attempt to exploit and identify security vulnerabilities in your applications.

We will deep-dive into the security capabilities of ASP.NET Core including implementing modern security protocols such as OpenId Connect (OIDC) and OAuth2 for authentication and delegation. I’ll also show you patterns and practices for implementing authorization in your applications and services. As we work with OIDC and OAuth2, we will work with Azure Active Directory, popular social identity providers, and other open-source and commercial offerings like IdentityServer. In addition to identity and auth, we will dive into additional capabilities in .NET and ASP.NET Core including data protection, secret management, cryptography and encryption, validation, and more. As we progress through the seminar, we will explore how we can utilize the capabilities of ASP.NET Core and .NET, along with secure development practices, to prevent common vulnerabilities and attacks.

The platform and technology estate that we work in includes server-side rendered web apps with ASP.NET Web Forms and MVC, client-side JavaScript-based single page applications (SPA), Web APIs, mobile apps, internet of things (IoT), and more. The seminar will include examples from the wide range of applications platforms and technologies that makeup our digital estates.

While we can host our ASP.NET Core and .NET applications and services anywhere, throughout the seminar, I’ll deploy demo applications and services to the Microsoft Azure cloud. As I do that, I’ll also highlight security capabilities in Azure, including Azure Active Directory, Microsoft Defender for Cloud (previously Azure Security Center), Azure Key Vault, Azure Monitor, Azure Sentinel, WAF with Azure Application Gateway, and more.

You will learn:

• ASP.NET Core security features and capabilities
• OpenId Connect and OAuth2 with Azure Active Directory, IdentityServer, and more
• How to protect yourself and your applications from common vulnerabilities and attacks
• Capabilities in Azure that can help you improve your security posture
• How to apply secure design principles and practices to your development

Attendee Workstation Requirements:
You must provide your own computer (Windows or Mac) for this hands-on lab seminar with a camera, wired Internet connection, speakers, and a microphone. The following technologies must be installed on the computer prior to the start of the Seminar on Monday, September 19th:

• Windows 10 or 11
• Visual Studio 2022
• Access to an Azure subscription (optional)