Close
Contact Us info@learnquest.com

??WelcomeName??
??WelcomeName??
« Important Announcement » Contact Us 877-206-0106 | USA Flag
Close
Close
Close
photo

Thank you for your interest in LearnQuest.

Your request is being processed and LearnQuest or a LearnQuest-Authorized Training Provider will be in touch with you shortly.

photo

Thank you for your interest in Private Training.

We look forward to helping you develop the perfect training solution to help you meet your company's goals.

For immediate assistance, speak with one of our representatives using the chat module below. Otherwise, LearnQuest or a LearnQuest-Authorized Training Provider will be in touch with you shortly.

Close
photo

Thank you for your interest in LearnQuest!

Now, you will be able to stay up-to-date on our latest course offerings, promotions, and training discounts. Watch your inbox for upcoming special offers.

title

Date: xxx

Location: xxx

Time: xxx

Price: xxx

Please take a moment to fill out this form. We will get back to you as soon as possible.

All fields marked with an asterisk (*) are mandatory.

Secure Java Web Application Development

Price
1,400 USD
2 Days
TT8120-J
Classroom Training, Online Training
Open Source

AWS Training Pass

Take advantage of flexible training options with the AWS Training Pass and get Authorized AWS Training for a full year.

Learn More

Prices reflect a 22.5% discount for IBM employees (wherever applicable).
Prices reflect a 24% discount for Kyndryl employees (wherever applicable).
Prices reflect the Accenture employee discount.
Prices shown are the special AWS Partner Prices.
Prices reflect the Capgemini employee discount.
Prices reflect the UPS employee discount.
Prices reflect the ??democompanyname?? employee discount.
GSA Private/Onsite Price: ??gsa-private-price??
For GSA pricing, please go to GSA Advantage.

Class Schedule

Delivery Formats

Sort results

Filter Classes

Guaranteed to Run

Modality

Location

Language

Date

  • Date: 10-Jun-2024 to 11-Jun-2024
    Time: 9AM - 5PM US Eastern
    Location: Virtual
    Language: English
    Delivered by: LearnQuest
    Price: 1,400 USD
  • Date: 22-Jul-2024 to 23-Jul-2024
    Time: 9AM - 5PM US Eastern
    Location: Virtual
    Language: English
    Delivered by: LearnQuest
    Price: 1,400 USD
View Global Schedule

Course Description

Overview

Secure Java Web Application Development is a seminar style course designed for Java web developers and technical stakeholders who need to produce secure Java web applications. Our web app security expert will share how to integrate security measures into the development process. You will also explore core concepts and challenges in web application security, showcasing real world examples that illustrate the potential consequences of not following these best practices.

Security experts agree that the least effective approach to security is 'penetrate and patch'. It is far more effective to 'bake' security into an application throughout its lifecycle. After spending significant time examining a poorly designed (from a security perspective) web application, you are ready to learn how to build secure web applications starting at project inception. The final portion of this course builds on the previously learned mechanics for building defenses by exploring how design and analysis can be used to build stronger applications from the beginning of the software lifecycle.

Students who attend Secure Java Web Application Development will gain an understanding of how to recognize actual and potential software vulnerabilities, implement defenses for those vulnerabilities, and test those defenses for sufficiency. This course introduces most common security vulnerabilities faced by web applications today. Each vulnerability is examined from a coding perspective through a process of describing the threat and attack mechanisms, recognizing associated vulnerabilities, and, finally, designing, implementing, and testing effective defenses.
 

Objectives

Upon completion of the Secure Java Web Application Development course, students will be able to:
  • Ensure that any hacking and bug hunting is performed in a safe and appropriate manner
  • Identify defect/bug reporting mechanisms within their organizations
  • Avoid common mistakes that are made in bug hunting and vulnerability testing
  • Understand the concepts and terminology behind defensive, secure coding including the phases and goals of a typical exploit
  • Develop an appreciation for the need and value of a multilayered defense in depth
  • Understand potential sources for untrusted data
  • Understand the consequences for not properly handling untrusted data such as denial of service, cross-site scripting, and injections
  • Prevent and defend the many potential vulnerabilities associated with untrusted data
  • Understand the vulnerabilities of associated with authentication and authorization
  • Detect, attack, and implement defenses for authentication and authorization functionality and services
  • Understand the dangers and mechanisms behind Cross-Site Scripting (XSS) and Injection attacks
  • Detect, attack, and implement defenses against XSS and Injection attacks
  • Understand the risks associated with XML processing, file uploads, and server-side interpreters and how to best eliminate or mitigate those risks
  • Understand techniques and measures that can used to harden web and application servers as well as other components in your infrastructure

Audience

This is an introductory-level course lecture and demonstration style course, designed to provide technical application project stakeholders with a first-look or baseline understanding of how to develop well defended web applications.
 

Prerequisites

    Real-world programming experience is highly recommended for code reviews, but not required. Students should have basic development skills and a working knowledge in the following topics, or attend these courses as a pre-requisite: TT5102 JEE Web Essentials
     

Topics

Bug Hunting Foundation
  • Why Hunt Bugs?
    • Security and Insecurity
    • Dangerous Assumptions
    • Attack Vectors
    • Lab: Case Study in Failure
  • Safe and Appropriate Bug Hunting/Hacking
    • Working Ethically
    • Respecting Privacy
    • Bug/Defect Notification
    • Bug Bounty Programs
Moving Forward From Hunting Bugs
  • Removing Bugs
    • Open Web Application Security Project (OWASP)
    • OWASP Top Ten Overview
    • Web Application Security Consortium
    • CERT Secure Coding Standards
    • Bug Hunting Mistakes to Avoid
    • Tools and Resources
Foundation for Securing Web Applications
  • Principles of Information Security
    • Security Is a Lifecycle Issue
    • Minimize Attack Surface Area
    • Layers of Defense: Tenacious D
    • Compartmentalize
    • Consider All Application States
    • Do NOT Trust the Untrusted
Bug Stomping 101
  • Unvalidated Data
    • Buffer Overflows
    • Integer Arithmetic Vulnerabilities
    • Unvalidated Data: Crossing Trust Boundaries
    • Defending Trust Boundaries
    • Whitelisting vs Blacklisting
  • A1: Injection
    • Injection Flaws
    • SQL Injection Attacks Evolve
    • Drill Down on Stored Procedures
    • Other Forms of Injection
    • Minimizing Injection Flaws
  • A2: Broken Authentication
    • Quality and Protection of Authentication Data
    • Handling Passwords on Server Side
    • SessionID Risk Reduction
    • HttpOnly and Security Headers
  • A3: Sensitive Data Exposure
    • Protecting Data Can Mitigate Impact
    • In-Memory Data Handling
    • Secure Pipes
    • Failures in TLS/SSL Framework
  • A4: XML External Entities (XXE)
    • XML Parser Coercion
    • XML Attacks: Structure
    • XML Attacks: Injection
    • Safe XML Processing
  • A5: Broken Access Control
    • Access Control Issues
    • Excessive Privileges
    • Insufficient Flow Control
    • Unprotected URL/Resource Access
    • Examples of Shabby Access Control
    • Sessions and Session Management
    • Lab: Spotlight: Verizon
Bug Stomping 102
  • A6: Security Misconfiguration
    • System Hardening: IA Mitigation
    • Application Whitelisting
    • Least Privileges
    • Anti-Exploitation
    • Secure Baseline
  • A7: Cross Site Scripting (XSS)
    • XSS Patterns
    • Persistent XSS
    • Reflective XSS
    • DOM-Based XSS
    • Best Practices for Untrusted Data
  • A8/9: Deserialization/Vulnerable Components
    • Deserialization Issues
    • Identifying Serialization and Deserializations
    • Vulnerable Components
    • Software Inventory
    • Managing Updates
    • Lab: Spotlight: Equifax
  • A10: Insufficient Logging and Monitoring
    • Fingerprinting a Web Site
    • Error-Handling Issues
    • Logging In Support of Forensics
    • Solving DLP Challenges
  • Spoofing, CSRF, and Redirects
    • Name Resolution Vulnerabilities
    • Fake Certs and Mobile Apps
    • Targeted Spoofing Attacks
    • Cross Site Request Forgeries (CSRF)
    • CSRF Defenses
Moving Forward
  • Applications: What Next?
    • Common Vulnerabilities and Exposures
    • CWE/SANS Top 25 Most Dangerous SW Errors
    • Strength Training: Project Teams/Developers
    • Strength Training: IT Organizations
    • Leveraging Common AppSec Practices and Control
    • Lab: Recent Incidents
    • Lab: Spotlight: Capital One
  • Making Application Security Real
    • Cost of Continually Reinventing
    • Paralysis by Analysis
    • Actional Application Security
    • Additional Tools for the Toolbox
Additional Topics: Time Permitting
  • Cryptography Overview
    • Strong Encryption
    • Message Digests
    • Encryption/Decryption
    • Keys and Key Management
    • NIST Recommendations
  • Scanning Applications Overview
    • Scanning Beyond the Applications
    • Fingerprinting
    • Vulnerability Scanning: Hunting for Bugs
    • Reconnaissance Goals
    • Data Collection Techniques
    • Fingerprinting the Environment
    • Enumerating the Web Application
2023 Top 20 Training Industry Company - IT Training

Need Help?

Call us at 877-206-0106 or e-mail us at info@learnquest.com

Personalized Solutions

Need a personalized solution for your Training? Contact us, and one of our training advisors will help you find the best solution.

Contact Us

Need Help?

Do you have a question about the courses, instruction, or materials covered? Do you need help finding which course is best for you? We are here to help!

Talk to us

20% Off All AI Training Courses

Achieve more with AI-powered tools and strategies.

PROMO CODE: AI20
VALID THROUGH APRIL 30, 2024

20% Off All AI Training Courses

Self-Paced Training Info

Learn at your own pace with anytime, anywhere training

  • Same in-demand topics as instructor-led public and private classes.
  • Standalone learning or supplemental reinforcement.
  • e-Learning content varies by course and technology.
  • View the Self-Paced version of this outline and what is included in the SPVC course.
  • Learn more about e-Learning

Course Added To Shopping Cart

bla

bla

bla

bla

bla

bla

Self-Paced Training Terms & Conditions

??spvc-wbt-warning??
??group-training-form-area??
??how-can-we-help-you-area??
??personalized-form-area??
??request-quote-area??

Sorry, there are no classes that meet your criteria.

Please contact us to schedule a class.
Close

self-paced
STOP! Before You Leave

Save 0% on this course!

Take advantage of our online-only offer & save 0% on any course !

Promo Code skip0 will be applied to your registration

Close
Nothing yet
here's the message from the cart

To view the cart, you can click "View Cart" on the right side of the heading on each page
Add to cart clicker.

Purchase Information

??elearning-coursenumber?? ??coursename??
View Cart

Need more Information?

Speak with our training specialists to continue your learning journey.

 

Delivery Formats

Close

By submitting this form, I agree to LearnQuest's Terms and Conditions

heres the new schedule
This website uses third-party profiling cookies to provide services in line with the preferences you reveal while browsing the Website. By continuing to browse this Website, you consent to the use of these cookies. If you wish to object such processing, please read the instructions described in our Privacy Policy.
Your use of this LearnQuest site affirms your consent to our use of session and persistent cookies to track how you use our website.