SEC522: Application Security: Securing Web Applications, APIs, and Microservices

Important! Bring your own system configured according to these instructions.

Cloud Accounts

Student cloud accounts are provided for students by SANS to complete the course labs. Time-limited accounts for each cloud are provided by SANS to use for completing the labs.

OnDemand Students

• Students can dynamically provision their lab range by logging in to their SANS account and visiting the My Labs page.
• When cloud account provisioning is complete, students can download the range credentials and their time-limited credentials.

Live Events (In Person or Live Online)

• Students are automatically provisioned a lab range and cloud credentials 24 hours before class starts.
• Students can log in to their SANS account and visit the My Labs page to download their range and cloud credentials the day before class begins.

Mandatory Laptop Requirement

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

Students must be in full control of their system's network configuration. The system will need to communicate with the cloud-hosted DevOps server using a combination of HTTPS and SSH traffic. Running VPN, intercepting proxy, or egress firewall filters may cause connection issues communicating with the DevOps server. Students must be able to configure or disable these services to connect to the lab environment.

Bring Your Own Laptop Configured to the Following Directions

A properly configured system is required for each student participating in this course.

Before starting your course, carefully read and follow these instructions exactly:

• Host Operating System: Latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run a browser described below.
• Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.

Mandatory Host Hardware Requirements

• CPU: 64-bit multi-core processor (ARM and Intel processors are both supported)
• Memory: 8GB RAM required (16GB recommended)
• Wireless Ethernet 802.11 B/G/N/AC
• Local Administrator Access within your host operating system
• Permission to install and update Chrome or Firefox

Mandatory Software Requirements

• Install the Amazon DCV Client here.
• For MacOS – install the “Windows App” (previously Remote Desktop) from Apple App Store

In Summary

Before beginning the course, you should:

• Download the SEC5522 Lab Setup Instructions from your sans.org account.
• Have RDP client (Windows App on MacOS) and DCV client installed
• After you have completed those steps, browse to the My Labs page in your sans.org account and download the range credentials in order to login (DCV or RDP) to the range virtual machine.

If you have additional questions about the laptop specifications, please contact customer service.

SEC522 training is recommended for a diverse range of individuals, including:

• Application security analysts or managers
• Application architects
• Penetration testers who are interested in learning about defensive strategies
• Security professionals who are interested in learning about web application security
• Auditors who need to understand defensive mechanisms in web applications
• Employees of PCI-compliant organizations who need to be trained to comply with PCI requirements
• Technical managers of software development teams and organizations
• Managers of Bug Bounty programs

The GIAC Web Application Defender (GWEB) certification allows candidates to demonstrate mastery of the security knowledge and skills needed to deal with common web application errors that lead to most security problems. The successful candidate will have hands-on experience using current tools to detect and prevent input validation flaws, cross-site scripting (XSS), and SQL injection as well as an in-depth understanding of authentication, access control, and session management, their weaknesses, and how they are best defended. GWEB candidates have the knowledge, skills, and abilities to secure web applications and recognize and mitigate security weaknesses in existing web applications.

• Access Control, AJAX Technologies and Security Strategies, Security Testing, and Authentication
• Cross Origin Policy Attacks and Mitigation, CSRF, and Encryption and Protecting Sensitive Data
• File Upload, Response Readiness, Proactive Defense, Input Related Flaws and Input Validation
• Modern Application Framework Issues and Serialization, Session Security and Business Logic, Web
• Application and HTTP Basics, Web Architecture, Configuration, and Security

More Certification Details

• Printed and electronic courseware
• Exercise workbook with over 100 pages of detailed step-by-step instructions
• Access to a virtual lab range with security tools installed and ready to use
• A poster containing the summary of the most crucial defensive techniques covered in the course in a checklist format, which can be used as a baseline Web defensive framework/standard for your organization
• MP3 audio files of the complete course lecture

This class requires a basic understanding of web application technology and concepts such as HTML and JavaScript. To maximize the benefit for a wider range of audiences, the discussions in this course will be programming-language-agnostic. Attendees should have some understanding of concepts like databases (SQL) and scripting languages used in modern web applications. 

SEC522: Application Security: Securing Web Applications, APIs, and Microservices is part of the Cloud Security Engineer Journey within the Cloud Security curriculum, focusing on defending the application layer in cloud-native environments. Alongside SEC510: Cloud Security Engineering and Controls and SEC540: Cloud Native Security and DevSecOps Automation, it forms a flexible, hands-on path for engineers to build deep, end-to-end expertise in securing infrastructure, code, and cloud workloads—empowering them to become adaptable defenders in today’s dynamic threat landscape. 

Application security protects web applications and APIs from a variety of current cyber threats. It identifies and mitigates vulnerabilities. Key strategies include implementing a secure architecture, employing secure coding practices, protecting against attacks like SQL injection and cross-site scripting (XSS), and implementing proper access controls.

Application security is crucial because cyber threats are constantly evolving, and applications are a prime target for hackers. Vulnerabilities like SQL injection, cross-site scripting (XSS), and broken authentication can lead to data breaches, financial loss, and reputational damage. Strong security measures help prevent unauthorized access, protect sensitive user data, and ensure compliance with industry regulations.

Embedding security early in the development process reduces risk and maintains data integrity. Organizations must adopt proactive security strategies, such as regular vulnerability assessments, penetration testing, and the use of security frameworks, to minimize risks and maintain trust with users. A secure application safeguards both business assets and customer information.

SEC522: Application Security: Securing Web Apps, APIs, and Microservices gives you in-depth knowledge and hands-on skills to protect modern web applications, APIs, and microservices architectures. As businesses increasingly rely on cloud-based applications and microservices, securing these environments has become critical.

This course teaches you how to identify vulnerabilities, apply security best practices, and prevent common attacks like SQL injection, cross-site scripting, and API security risks.

In SEC522, you will learn to secure the software development lifecycle (SDLC), implement secure authentication and authorization mechanisms, and address complex security challenges in distributed systems. This expertise positions you as a valuable asset to organizations, boosting your career prospects in cybersecurity roles such as application security specialist, security engineer, or architect.

Starting with SANS Cloud Security Exchange Summit & Training 2026 in San Francisco, CA, US, SEC522 will be streamlined as a 5-day course. All sessions before this event will continue in the current 6-day format. Content previously delivered on Day 6, including the Defending the Flag Capstone Exercise, will be incorporated into Day 5, with tuition priced accordingly. The course page will be updated with the new 5-day syllabus following the final 6-day session at SANS Live Online Europe July 2026.