heise-ponudba: delavnica iX: iskanje sledi po napadu M365 ‒ ciljno ocenjevanje protokolov

heise online has announced a new training workshop focused on securing application programming interfaces (APIs) against common vulnerabilities outlined in the OWASP Top 10 list. The workshop aims to provide participants with practical knowledge and hands-on experience in identifying and mitigating security risks associated with APIs. This initiative highlights growing concerns about the increasing number of cyber threats targeting API endpoints, which serve as critical communication channels between clients and servers. The workshop will take place in a virtual environment where attendees can simulate real-world attacks and learn how to defend against them effectively. Participants will analyze typical weaknesses based on the OWASP Top 10 API Security Risks, including issues related to authentication and authorization using protocols such as OAuth 2.0 and OpenID Connect. They will also explore measures to protect against injection attacks and data leaks. With a maximum of twelve participants per session, the workshop ensures personalized attention and ample opportunity for discussion and question-asking. The event is scheduled for September 25, 2026, and runs from 9:00 AM to 5:00 PM. Attendees who register before July 28, 2026, will receive a 10 percent early bird discount. The workshop is led by two experienced security experts from codecentric AG, Lucy Jochum and Robin Kappler. Both have extensive backgrounds in conducting web penetration tests and responding to security incidents. Their expertise comes from real-world projects, allowing them to share insights into recognizing and addressing common API vulnerabilities. Participants are encouraged to attend if they work with API development and wish to enhance their understanding of security practices. While prior knowledge of API development is beneficial, it is not mandatory. The workshop promises to deliver actionable solutions that can be directly applied to ongoing development projects. In addition to this API security workshop, heise online has also introduced another training program focused on hardening Active Directory environments. Active Directory serves as the central component of many corporate networks and thus represents an attractive target for cyberattacks. This workshop provides comprehensive guidance on systematically securing Active Directory setups, emphasizing the identification and remediation of potential security risks. Attendees will gain hands-on experience using audit tools such as PingCastle alongside offensive tools like PowerView and BloodHound to detect and analyze vulnerabilities within their network infrastructure. Practical exercises will allow participants to conduct audits independently, identify typical misconfigurations, and implement appropriate hardening measures. These activities aim to deepen understanding of secure authentication methods while analyzing specific attack scenarios. This three-day online workshop is set to run from August 19 to 21, 2026, followed by another session from November 4 to 6, 2026. Early registration discounts apply until July 22, 2026, for the first session and October 7, 2026, for the second. Led by Thomas Kudlacek, a cybersecurity specialist at Oneconsult AG, the workshop draws upon his diverse professional background as both a former software developer and long-term IT security consultant. Kudlacek brings valuable insight into how Active Directory environments are typically attacked in practice, highlighting frequently occurring weaknesses and demonstrating effective ways to address these issues. His approach includes providing concrete examples, proven methodologies, and immediately applicable recommendations tailored to each participant's unique situation. The workshop caters specifically to administrators looking to engage more deeply with attack scenarios and seeking to strengthen their on-premise Active Directory configurations. Due to its limited group size—capped at ten participants—it fosters close interaction among attendees and with the trainer itself. This setup ensures that all individuals benefit from direct engagement and thorough discussions regarding their particular challenges and requirements.