- Duration: 2 days
Course Overview
The PECB Certified ISO/IEC 27034 Application Security Foundation training course provides participants with a fundamental understanding of application security principles, concepts, and requirements based on the ISO/IEC 27034 series of standards.
This two-day training course introduces the structure and key components of ISO/IEC 27034 and explains how application security can be integrated throughout the software life cycle. Participants will explore essential security concepts, including confidentiality, integrity, availability, threats, vulnerabilities, and risks, while learning how application security practices align with broader information security standards and frameworks.
The course also covers the Organization Normative Framework (ONF) and Application Normative Framework (ANF), including their roles in establishing, implementing, managing, and improving application security. Participants will gain an understanding of application security requirements validation, risk assessment, security control verification, and the use of key performance indicators (KPIs) to support continual improvement.
Upon successful completion of the training course and examination, participants may apply for the PECB Certificate Holder in ISO/IEC 27034 Foundation designation.
Learning Objectives
Upon successful completion of this training course, participants will be able to:
- Describe the structure, scope, and components of the ISO/IEC 27034 series.
- Explain how ISO/IEC 27034 aligns with and complements other information security standards and frameworks.
- Identify fundamental application security concepts, including confidentiality, integrity, availability, threats, vulnerabilities, and risks.
- Understand the importance of integrating application security throughout the software development life cycle.
- Explain the roles and responsibilities involved in establishing and maintaining the Organization Normative Framework (ONF) and Application Normative Framework (ANF).
- Describe the processes involved in validating application security requirements and assessing application security risks.
- Explain how application security controls are implemented and verified.
- Understand how key performance indicators (KPIs) support the monitoring and continual improvement of application security practices.
Target Audience
This training course is intended for:
- Individuals involved in application security, information security, or IT governance.
- IT professionals seeking foundational knowledge of ISO/IEC 27034.
- Software developers and application development team members.
- Professionals involved in implementing, managing, or improving application security.
- IT managers and professionals responsible for protecting business applications.
- Individuals involved in software security requirements, risk assessment, and security control verification.
- Professionals seeking to strengthen their understanding of application security standards and best practices.
Course Content
Day 1: Introduction to Application Security and ISO/IEC 27034
- Introduction to application security and its importance.
- Overview of the ISO/IEC 27034 series and its scope.
- Fundamental principles and concepts of application security.
- Confidentiality, integrity, and availability in application security.
- Understanding threats, vulnerabilities, and application security risks.
- Application security throughout the software life cycle.
- Relationship between ISO/IEC 27034 and other standards and frameworks.
- Introduction to the Organization Normative Framework (ONF).
- Introduction to the Application Normative Framework (ANF).
Day 2: Implementation and Verification of Application Security Controls
- Roles and responsibilities in application security management.
- Establishing and maintaining the ONF and ANF.
- Validating application security requirements.
- Assessing and managing application security risks.
- Implementing application security controls.
- Verifying application security controls and requirements.
- Monitoring application security performance using key performance indicators (KPIs).
- Continual improvement of application security practices.
- Review of key course concepts and certification examination preparation.
Examination and Certification
The PECB ISO/IEC 27034 Foundation examination evaluates participants’ understanding of fundamental application security principles, organisational and application security planning, implementation, and monitoring.
The examination covers the following competency domains:
- Domain 1: Fundamental Principles and Concepts of Application Security.
- Domain 2: Organizational and Application Security Planning, Implementation, and Monitoring.
Examination Duration: 1 Hour
After successfully passing the examination, participants may apply for the PECB Certificate Holder in ISO/IEC 27034 Foundation designation, subject to the applicable certification requirements.
Certification Requirements
Candidates must:
- Successfully pass the PECB ISO/IEC 27034 Foundation examination.
- Sign and comply with the PECB Code of Ethics.
There are no professional experience or application security project experience requirements for this entry-level credential.
Course Benefits
- Develop a foundational understanding of application security principles and practices based on ISO/IEC 27034.
- Understand how application security can be integrated throughout the software life cycle.
- Gain knowledge of the ONF and ANF frameworks and their role in application security management.
- Develop awareness of application security risk assessment, control implementation, and verification.
- Understand how to monitor and improve application security practices using appropriate performance indicators.
- Receive comprehensive training materials containing over 200 pages of information, practical examples, exercises, and quizzes.
- Obtain an attestation of course completion worth 14 Continuing Professional Development (CPD) credits, subject to applicable attendance requirements.
- Benefit from examination and certification fees included in the training course price.
- Access one free examination retake within 12 months, subject to PECB’s applicable conditions. For courses completed through a PECB partner, the free retake is subject to the stated coupon and examination policies.
Duration
- Training Duration: 2 Days
- Examination Duration: 1 Hour
Prerequisites
There are no formal prerequisites for participating in this training course. However, a basic understanding of information security, software development, or IT governance may help participants gain greater value from the programme.
Certification Body
PECB (Professional Evaluation and Certification Board)
PECB provides professional training, examination, and certification services across information security, application security, risk management, governance, and related professional disciplines.