Train From Home on Your Schedule with OnDemand - Special Offers Available Now


Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

"Global security breaches have reached epidemic proportions" says expert

Current teaching practice needs to change as coders learn security best practice too late leading to applications with poor basic security processes

  • United Kingdom
  • 7th January, 2013

The teaching of application design and programming needs to undergo a substantial change as students are not taught and have not practiced secure design processes at an early enough stage within most courses.

In the view of Pieter Danhieux, SANS instructor and co-founder of the security and hacking conference BRUCON in Belgium, "Programming students will typically attend a single module on security during a course and it often comes in the later part of the educational cycle. The result is often a class of very talented developers but they don't think with security in mind."

In his view, this leads to poor security practices such as building applications with buffer-overflow and SQL injection vulnerabilities that are widely exploited by hackers. Danhieux who will be teaching the SANS SEC542: Web App Penetration Testing and Ethical Hacking course in his native Belgium in February points out that many of the fundamental mistakes that he was exploiting as a penetration tester 10 years ago are still the most common issues today.

"But you can't just say it's just down to insecure program design," he notes, "the bigger problem is still due to insecure passwords, over privileged users and poorly patched systems."

Danhieux is familiar with the reality on the ground in his work for BAE Systems Detica, an information intelligence company, "We deal with incidents and security assessment results every day and when you look at the root cause analysis, 80% of the time it was one of these issues."

However, he is also keen to point out the scale of the problem. "The US is one of the only countries with a well-developed disclosure culture around security breaches," he comments, "So the assumption might be that there are relatively few incidents and that America is the epicentre - I can tell you for a fact that the scale of the attacks is at epidemic proportions and it is organised, well-funded and global."

The upcoming SANS course is aimed at helping web site designers, architects, and developers understand and learn web app vulnerabilities in-depth with tried-and-true techniques for finding them using a structured testing regime. "The goal is to learn the skills of an attacker so that students can become better defenders," Danhieux adds.

The 'SANS SEC542: Web App Penetration Testing and Ethical Hacking' course taught by Danhieux will be running at SANS Belgium from February 18th to 23rd at the NH Hotel du Grand Sablon in the heart of Brussels. SANS is also offering an 'Early Bird' discount of up to up to [euro]250 for any full course paid for by January 9th of 2013.

For more information, please visit:

Media Contact

About SANS Institute

The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cyber security training and certification to professionals in government and commercial institutions worldwide. Renowned SANS instructors teach more than 60 courses at In-Person and Live Online cyber security training events, and more than 50 courses are available anytime, anywhere with our OnDemand platform. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 35 hands-on, technical certifications in cyber security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers a master’s degree, graduate certificates, and an undergraduate certificate in cyber security. SANS Security Awareness, a division of SANS, provides organizations with a complete and comprehensive security awareness solution, enabling them to easily and effectively manage their ‘human’ cybersecurity risk. SANS also delivers a wide variety of free resources to the InfoSec community including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet's early warning system – the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to support and educate the global information security community. (