CASE

EC-Council · Application Security

Certified Application

Security Engineer

EC-Council's CASE certification teaches developers and security professionals to build secure applications from the ground up — covering secure SDLC, threat modelling, input validation, authentication, session management, cryptography, web services security, and thick client security across Java and .NET platforms.

Secure SDLC Threat Modelling Input Validation Authentication Session Management Cryptography Web Services OWASP Java Security .NET Security

Enroll Now

CASE Program

Certified Application Security Engineer · 11 Modules

Understanding Application Security

Module 01

Security Requirements in SDLC

Module 02

Threat Modelling

Module 03

Input Validation and Output Encoding

Module 04

Authentication and Session Management

Module 05

Cryptography in Applications

Module 06

+ 5 more modules: Access Control, Code Review, DAST & more

Modules

Full CASE syllabus

Questions

Multiple choice exam

2 Hours

Duration

Timed exam

24/7

Support

Expert guidance

Why CASE

The Developer's Application Security Certification

CASE bridges the gap between development and security — giving engineers the skills to write secure code, implement secure SDLC practices, and defend applications against real-world threats.

Developer-Focused Security

Only EC-Council cert designed specifically for developers to write secure code from day one — not just for testers or defenders.

Dual Platform Coverage

Covers both Java and .NET security in one comprehensive certification program — the most practical coverage in the industry.

EC-Council Accredited

Globally recognised application security certification issued by EC-Council — trusted by enterprises and governments worldwide.

AppSec Career Demand

Application Security Engineers are among the highest-paid roles in cybersecurity globally — CASE gives you the credential to prove it.

Skills You'll Gain

The Complete CASE Skill Set

From secure SDLC fundamentals to advanced application security testing — every skill area from the CASE exam syllabus across Java and .NET platforms.

Application Security Fundamentals

OWASP Top 10, attack surface analysis, vulnerability classification, and security testing methodologies.

Secure SDLC & DevSecOps

Security requirements in Agile/Scrum, abuse cases, security design principles, and DevSecOps integration.

Threat Modelling

STRIDE and PASTA frameworks, attack tree construction, risk prioritisation using Threat Dragon and Microsoft TMT.

Input Validation

Whitelist/blacklist strategies, regex validation, output encoding for XSS prevention, OWASP ESAPI, SQL parameterisation.

Authentication & Sessions

MFA implementation, OAuth 2.0, OIDC, JWT security, session fixation prevention, bcrypt/Argon2 password storage.

Cryptography

AES-256, RSA, ECC, SHA-256, PKI, TLS best practices, key management, and Java Cryptography Architecture.

Access Control

RBAC, ABAC, IDOR prevention, privilege escalation mitigation, least privilege, and API authorisation design.

Secure Code Review

SAST tools (SonarQube, Checkmarx, Veracode), code review checklists, manual and automated code review.

Web Services Security

REST and SOAP security, API authentication, rate limiting, JWT attacks, OWASP API Security Top 10.

Thick Client Security

Binary analysis, memory inspection, DLL hijacking prevention, IPC security, and reverse engineering countermeasures.

DAST & Security Testing

Burp Suite, OWASP ZAP automation, fuzz testing, penetration testing for applications, and vulnerability remediation.

Security Standards

OWASP guidelines, secure coding standards, compliance frameworks, and enterprise application security policies.

Who Should Enroll

CASE Is for Developers & AppSec Professionals

Whether you are a developer looking to specialise in application security or a security engineer seeking to validate your AppSec expertise, CASE provides the structured, hands-on skills that enterprises demand.

👨‍💻

Software Developers

Java and .NET developers who want to build security into their code and advance into application security roles.

🛡️

Application Security Engineers

Security engineers responsible for application security reviews, SAST/DAST, and secure SDLC implementation.

🔍

Security Analysts

Security analysts who want to add application security expertise to their penetration testing skill set.

📋

Security Architects

Architects designing secure application frameworks and security standards for development teams.

Your EC-Council Certification Roadmap

CASE Certified Application Security Engineer Start Here

Start here — Java/312-96 or .NET/312-92

C|EH Certified Ethical Hacker

Ethical hacking mastery — Exam 312-50

C|PENT Certified Penetration Testing Professional

Advanced pen testing — Exam 312-64

C|SA EC-Council Certified SOC Analyst

Advanced SOC — Exam 312-39

C|EH Master CEH Master

Elite recognition — practical exam crown credential

Curriculum

CASE — 11 Course Modules

Every CASE exam objective covered — from application security fundamentals to DAST, thick client security, and secure code review across Java and .NET.

OWASP Top 10 overview and application threat landscape
Common vulnerability classifications and severity scoring
Attack surface analysis and threat identification
Security testing methodologies: SAST, DAST, IAST, RASP
Business impact of application vulnerabilities
Application security maturity models and frameworks

Secure SDLC phases and security gates
Security in Agile and Scrum methodologies
Security requirements gathering techniques
Abuse cases and misuse cases in requirements
Security design principles: least privilege, defence in depth
DevSecOps integration points and pipeline security

STRIDE methodology for threat identification
PASTA framework: Process for Attack Simulation and Threat Analysis
Threat identification and categorisation techniques
Attack tree construction and analysis
Risk prioritisation and mitigation planning
Microsoft Threat Modelling Tool: hands-on usage
OWASP Threat Dragon: practical threat modelling

Input validation strategies: server-side and client-side
Whitelist vs blacklist validation approaches
Regular expression validation and pattern matching
Output encoding for XSS prevention across contexts
OWASP ESAPI for input/output security
SQL parameterisation and prepared statements
Command injection and path traversal prevention

Secure authentication design principles
Multi-factor authentication implementation patterns
OAuth 2.0 and OpenID Connect (OIDC) integration
JWT security: signing, validation, and attack mitigation
Session fixation and session hijacking prevention
Secure cookie attributes: HttpOnly, Secure, SameSite
Password storage with bcrypt and Argon2

Symmetric encryption: AES-256 implementation
Asymmetric encryption: RSA and ECC algorithms
Hashing algorithms: SHA-256, bcrypt, and Argon2
PKI and certificate management in applications
TLS implementation best practices and configuration
Key management and secure key storage
Java Cryptography Architecture (JCA) practical usage

Role-based access control (RBAC) design and implementation
Attribute-based access control (ABAC) patterns
Broken access control vulnerabilities and prevention
Insecure Direct Object Reference (IDOR) prevention
Privilege escalation mitigation techniques
Least privilege principle in application design
API authorisation patterns and enforcement

Manual code review techniques and methodology
SAST tools: SonarQube, Checkmarx, and Veracode
Code review checklists and security standards
Common coding vulnerabilities and root causes
Peer review processes and security gates
Automated vs manual code review trade-offs
Integrating code review into CI/CD pipelines

REST API security best practices
SOAP web service security (WS-Security)
API authentication: API keys, OAuth, and mutual TLS
Rate limiting and throttling implementation
Input validation for API payloads and parameters
JWT attacks: algorithm confusion, none algorithm, and mitigations
OWASP API Security Top 10 vulnerabilities

Thick client attack surface and threat landscape
Binary analysis and static reverse engineering
Memory inspection and sensitive data exposure
Local storage security: registry, files, and databases
Inter-process communication (IPC) security
DLL hijacking prevention and countermeasures
Reverse engineering countermeasures and obfuscation

Dynamic application security testing (DAST) methodology
Burp Suite for application penetration testing
OWASP ZAP automation and scan configuration
Penetration testing for web and API applications
Fuzz testing techniques and tool usage
Regression security testing in CI/CD pipelines
Vulnerability remediation verification and retesting

Have Questions?

Chat with our EC-Council certified trainers instantly.

WhatsApp Us Call Us

Build Secure Applications as a Certified Engineer

EC-Council CASE is the gold standard for application security engineering. Expert-led training in secure SDLC, threat modelling, and application security testing with full exam support at Zetlan Technologies.