Advanced Training Techniques
🌟 Objective
To strengthen practical learning in security through active training methods, applicable in the real context of the technical teams.
These techniques are especially useful in organisations with distributed teams or with growing maturity, where traditional training is not enough.
The training techniques described aim to strengthen people's understanding and critical capacity, complementing - and not replacing - the existing automated mechanisms.
🧬 What advanced training techniques are
They are approaches centred on practical experience, which connect knowledge to execution:
- Contextualised: based on real risks or errors
- Iterative: incorporated into sprints, reviews, incidents
- Engaging: labs, simulations, clinics, peer-led sessions
- Facilitated: with the support of Champions or designated people
🛠️ How to apply - Suggested techniques
1. CTF (Capture The Flag)
| Aspect | Details |
|---|---|
| 🎯 Objective | Explore intentional flaws and solve security challenges |
| 👥 Target audience | Developers, QA, AppSec, Champions |
| 🛠️ Format | Internal or external (public or organised platform) |
| 💡 Recommendations | Real labs, leaderboard, themes by stack or threat |
Ideal for strengthening technical knowledge and detecting gaps in real practice.
2. War Room / Incident Simulation
| Aspect | Details |
|---|---|
| 🎯 Objective | Assess incident response in real time |
| 👥 Target audience | Dev, QA, PO, DevOps, AppSec |
| 🛠️ Format | Simulation of real incidents, focusing on communication and validation |
| 💡 Recommendations | Use real history as the basis, hold an educational debrief |
Excellent for aligning behaviours and processes under pressure.
3. Code Clinics / PR Live Reviews
| Aspect | Details |
|---|---|
| 🎯 Objective | Learn from real reviews, strengthen secure standards |
| 👥 Target audience | Developers, QA, Champions |
| 🛠️ Format | Regular sessions with collective reviews (30–45 min) |
| 💡 Recommendations | Real PRs with good practices and common errors |
Low friction, highly effective. It can be part of the sprint review.
4. Threat Modeling Peer-led
| Aspect | Details |
|---|---|
| 🎯 Objective | Analyse technical risks in the design in a participatory way |
| 👥 Target audience | Technical team with the support of a Champion |
| 🛠️ Format | Regular sessions (per epic, sprint or release) |
| 💡 Recommendations | Templates + repository of outputs (e.g. draw.io, markdown) |
A technique that trains and applies at the same time.
5. Learning Logs / Repository of Real Failures
| Aspect | Details |
|---|---|
| 🎯 Objective | Learn from documented incidents or errors |
| 👥 Target audience | The whole technical organisation |
| 🛠️ Format | Wiki or internal page (no blame), integrated into labs |
| 💡 Recommendations | Validate as part of internal quizzes or labs |
Encourages a culture of continuous improvement based on real failures.
6. Guided Labs
| Aspect | Details |
|---|---|
| 🎯 Objective | Perform specific tasks in a controlled environment |
| 👥 Target audience | All technical roles |
| 🛠️ Tools | Juice Shop, Secure Code Warrior, internal labs, etc. |
| 💡 Recommendations | Integrate into onboarding, validate before permissions (deploy, merge) |
Ideal for technical onboarding and validation of competences.
✅ Good practices
- Start with 1 or 2 techniques adapted to the team's maturity
- Define learning objectives per technique
- Maintain a repository of examples by stack or type of threat
- Involve Security Champions in facilitation
- Measure impact: participation, feedback and observed improvement
📎 Cross-references
| Document | Relevance |
|---|---|
03-programa-champions.md | Champions as facilitators |
01-catalogo-formativo.md | Techniques aligned with the training themes |
15-aplicacao-lifecycle.md | Continuous application of these techniques in the rituals |
90-indicadores-metricas.md | Assessment of the impact of and adherence to the techniques |
🧠 Continuous practical learning is the true catalyst of security maturity. These techniques help to turn knowledge into action - and culture into behaviour.