title
Please take a moment to fill out this form. We will get back to you as soon as possible.
All fields marked with an asterisk (*) are mandatory.
Secure Java Web Application Development
Duration
2 Days
Course
TT8120-J
Available Formats
Classroom Training, Online Training
Course Description
Overview
Secure Java Web Application Development is a seminar style course designed for Java web developers and technical stakeholders who need to produce secure Java web applications. Our web app security expert will share how to integrate security measures into the development process. You will also explore core concepts and challenges in web application security, showcasing real world examples that illustrate the potential consequences of not following these best practices.Security experts agree that the least effective approach to security is 'penetrate and patch'. It is far more effective to 'bake' security into an application throughout its lifecycle. After spending significant time examining a poorly designed (from a security perspective) web application, you are ready to learn how to build secure web applications starting at project inception. The final portion of this course builds on the previously learned mechanics for building defenses by exploring how design and analysis can be used to build stronger applications from the beginning of the software lifecycle.
Students who attend Secure Java Web Application Development will gain an understanding of how to recognize actual and potential software vulnerabilities, implement defenses for those vulnerabilities, and test those defenses for sufficiency. This course introduces most common security vulnerabilities faced by web applications today. Each vulnerability is examined from a coding perspective through a process of describing the threat and attack mechanisms, recognizing associated vulnerabilities, and, finally, designing, implementing, and testing effective defenses.
Objectives
Upon completion of the Secure Java Web Application Development course, students will be able to:
- Ensure that any hacking and bug hunting is performed in a safe and appropriate manner
- Identify defect/bug reporting mechanisms within their organizations
- Avoid common mistakes that are made in bug hunting and vulnerability testing
- Understand the concepts and terminology behind defensive, secure coding including the phases and goals of a typical exploit
- Develop an appreciation for the need and value of a multilayered defense in depth
- Understand potential sources for untrusted data
- Understand the consequences for not properly handling untrusted data such as denial of service, cross-site scripting, and injections
- Prevent and defend the many potential vulnerabilities associated with untrusted data
- Understand the vulnerabilities of associated with authentication and authorization
- Detect, attack, and implement defenses for authentication and authorization functionality and services
- Understand the dangers and mechanisms behind Cross-Site Scripting (XSS) and Injection attacks
- Detect, attack, and implement defenses against XSS and Injection attacks
- Understand the risks associated with XML processing, file uploads, and server-side interpreters and how to best eliminate or mitigate those risks
- Understand techniques and measures that can used to harden web and application servers as well as other components in your infrastructure
Audience
This is an introductory-level course lecture and demonstration style course, designed to provide technical application project stakeholders with a first-look or baseline understanding of how to develop well defended web applications.
Prerequisites
-
Real-world programming experience is highly recommended for code reviews, but not required.
Students should have basic development skills and a working knowledge in the following topics, or attend these courses as a pre-requisite: TT5102 JEE Web Essentials
Topics
Bug Hunting Foundation
- Why Hunt Bugs?
- Security and Insecurity
- Dangerous Assumptions
- Attack Vectors
- Lab: Case Study in Failure
- Safe and Appropriate Bug Hunting/Hacking
- Working Ethically
- Respecting Privacy
- Bug/Defect Notification
- Bug Bounty Programs
- Removing Bugs
- Open Web Application Security Project (OWASP)
- OWASP Top Ten Overview
- Web Application Security Consortium
- CERT Secure Coding Standards
- Bug Hunting Mistakes to Avoid
- Tools and Resources
- Principles of Information Security
- Security Is a Lifecycle Issue
- Minimize Attack Surface Area
- Layers of Defense: Tenacious D
- Compartmentalize
- Consider All Application States
- Do NOT Trust the Untrusted
- Unvalidated Data
- Buffer Overflows
- Integer Arithmetic Vulnerabilities
- Unvalidated Data: Crossing Trust Boundaries
- Defending Trust Boundaries
- Whitelisting vs Blacklisting
- A1: Injection
- Injection Flaws
- SQL Injection Attacks Evolve
- Drill Down on Stored Procedures
- Other Forms of Injection
- Minimizing Injection Flaws
- A2: Broken Authentication
- Quality and Protection of Authentication Data
- Handling Passwords on Server Side
- SessionID Risk Reduction
- HttpOnly and Security Headers
- A3: Sensitive Data Exposure
- Protecting Data Can Mitigate Impact
- In-Memory Data Handling
- Secure Pipes
- Failures in TLS/SSL Framework
- A4: XML External Entities (XXE)
- XML Parser Coercion
- XML Attacks: Structure
- XML Attacks: Injection
- Safe XML Processing
- A5: Broken Access Control
- Access Control Issues
- Excessive Privileges
- Insufficient Flow Control
- Unprotected URL/Resource Access
- Examples of Shabby Access Control
- Sessions and Session Management
- Lab: Spotlight: Verizon
- A6: Security Misconfiguration
- System Hardening: IA Mitigation
- Application Whitelisting
- Least Privileges
- Anti-Exploitation
- Secure Baseline
- A7: Cross Site Scripting (XSS)
- XSS Patterns
- Persistent XSS
- Reflective XSS
- DOM-Based XSS
- Best Practices for Untrusted Data
- A8/9: Deserialization/Vulnerable Components
- Deserialization Issues
- Identifying Serialization and Deserializations
- Vulnerable Components
- Software Inventory
- Managing Updates
- Lab: Spotlight: Equifax
- A10: Insufficient Logging and Monitoring
- Fingerprinting a Web Site
- Error-Handling Issues
- Logging In Support of Forensics
- Solving DLP Challenges
- Spoofing, CSRF, and Redirects
- Name Resolution Vulnerabilities
- Fake Certs and Mobile Apps
- Targeted Spoofing Attacks
- Cross Site Request Forgeries (CSRF)
- CSRF Defenses
- Applications: What Next?
- Common Vulnerabilities and Exposures
- CWE/SANS Top 25 Most Dangerous SW Errors
- Strength Training: Project Teams/Developers
- Strength Training: IT Organizations
- Leveraging Common AppSec Practices and Control
- Lab: Recent Incidents
- Lab: Spotlight: Capital One
- Making Application Security Real
- Cost of Continually Reinventing
- Paralysis by Analysis
- Actional Application Security
- Additional Tools for the Toolbox
- Cryptography Overview
- Strong Encryption
- Message Digests
- Encryption/Decryption
- Keys and Key Management
- NIST Recommendations
- Scanning Applications Overview
- Scanning Beyond the Applications
- Fingerprinting
- Vulnerability Scanning: Hunting for Bugs
- Reconnaissance Goals
- Data Collection Techniques
- Fingerprinting the Environment
- Enumerating the Web Application
Related Courses
-
Securing Web Applications | 2021 OWASP Top Ten and Beyond (Language Neutral)
WDSE-120- Duration: 2 Days
- Delivery Format: Classroom Training
- Price: 1,400.00 USD
-
Java EE Secure Coding Camp | Attacking and Securing Java EE Web Applications
TT8320-J- Duration: 4 Days
- Delivery Format: Classroom Training, Online Training
- Price: 2,800.00 USD
Self-Paced Training Info
Learn at your own pace with anytime, anywhere training
- Same in-demand topics as instructor-led public and private classes.
- Standalone learning or supplemental reinforcement.
- e-Learning content varies by course and technology.
- View the Self-Paced version of this outline and what is included in the SPVC course.
- Learn more about e-Learning
Course Added To Shopping Cart
bla
bla
bla
bla
bla
bla
Self-Paced Training Terms & Conditions
??spvc-wbt-warning??
Exam Terms & Conditions
??exam-warning??
??group-training-form-area??
??how-can-we-help-you-area??
??personalized-form-area??
??request-quote-area??
Sorry, there are no classes that meet your criteria.
Please contact us to schedule a class.
STOP! Before You Leave
Save 0% on this course!
Take advantage of our online-only offer & save 0% on any course !
Promo Code skip0 will be applied to your registration
Nothing yet
Purchase Information
??elearning-coursenumber?? ??coursename??
View Cart
title
Please take a moment to fill out this form. We will get back to you as soon as possible.
All fields marked with an asterisk (*) are mandatory.