Secure Web Application Development

Course Code: 1311

Overview
Schedule classes
What you'll learn
Outline
Prerequisites
Who should attend

Overview

This immersive training seminar is focused on providing web developers training in web application security. Participants learn to build secure web applications, incorporating essential security elements into the applications, from the development to deployment stage and beyond. Participants are equipped with basic programming skills and knowledge of integrating security into the entire software development cycle for web applications.

Schedule Classes

Looking for more sessions of this class?

Course Delivery

This course is available in the following formats:

Live Classroom
Duration: 5 days

Live Virtual Classroom
Duration: 5 days

What You'll learn

Recognize potential as well as real security vulnerabilities and employ defense measures to overcome them
Learn the most common security vulnerabilities encountered in web applications today
Examine security vulnerabilities from a coding perspective
Describe the threat and attack mechanisms
Design, implement, and test effective defenses

Outline

Module 1: Who is safe?

Assumptions we make
Security: The complete picture
Anthem, Sony, target, heartland, and TJX debriefs
Verizon’s 2017 data breach report
Attack patterns and recommendations

Module 2: Security concepts

Motivations: Costs and standards
Open web application security project
Web application security consortium
CERT secure coding standards
Microsoft SDL
Assets and trust boundaries
Threat modeling
Potential demonstration: Asset analysis

Module 3: Principles of information security

Security is a lifecycle issue
Minimize attack surface area
Layers of defense: Tenacious D
Compartmentalize
Consider all application states
Do not trust the untrusted

Module 4: Unvalidated input

Buffer overflows
Integer arithmetic vulnerabilities
Unvalidated input: From the web
Defending trust boundaries
Whitelisting vs blacklisting
Potential demonstration: defending trust boundaries

Module 5: Broken access control

Access control issues
Excessive privileges
Insufficient flow control
Unprotected URL/resource access
Examples of shabby access control
Sessions and session management

Module 6: Broken authentication

Broken quality/DoS
Authentication data
Username/password protection
Exploits magnify importance
Handling passwords on server side
Single sign-on (SSO)
Potential demonstration: Defending authentication

Module 7: Cross-site scripting (XSS)

XSS patterns
Persistent XSS
Reflective XSS
Best practices for untrusted data
Potential demonstration: Defending against XSS

Module 8: Injection

Injection flaws
SQL injection attacks evolve
Drill down on stored procedures
Other forms of injection
Minimizing injection flaws
Potential demonstration: Defending against SQL injection

Module 9: Error handling and information leakage

Injection flaws
SQL injection attacks evolve
Drill down on stored procedures
Other forms of injection
Minimizing injection flaws
Potential demonstration: Defending against SQL injection

Prerequisites

There are no mandatory prerequisites for this course, however, completing the Foundations of Agile course prior to taking up this course would be beneficial.

Who Should Attend

Anyone interested in the paradigm shifts necessary to enable organizational agility in today’s innovative business climate will find the Business Agility Foundations course compelling. The course is highly recommended for –