Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd
Upload
132 views

Secure Web Application Development

This course teaches web application developers and architects how to build applications with strong security. It covers every major aspect of application and API security through modules that provide both design and coding advice. Hands-on labs help students learn concepts interactively. The focus is on strategies and tactics that secure software during development. Prerequisites include knowledge of HTML, JavaScript, and a server-side language. Major topics include information disclosure, authentication, sessions, authorization, secure data handling, cryptography, logging, web services security, and the secure development lifecycle.

Uploaded by

Mangesh Abnave
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
132 views

Secure Web Application Development

This course teaches web application developers and architects how to build applications with strong security. It covers every major aspect of application and API security through modules that provide both design and coding advice. Hands-on labs help students learn concepts interactively. The focus is on strategies and tactics that secure software during development. Prerequisites include knowledge of HTML, JavaScript, and a server-side language. Major topics include information disclosure, authentication, sessions, authorization, secure data handling, cryptography, logging, web services security, and the secure development lifecycle.

Uploaded by

Mangesh Abnave
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 3

SECURE WEB/API APPLICATION DEVELOPMENT

This course is designed to teach web application developers and architects how to build applications with
world-class security. QA engineers, IT security analysts, and IT risk managers can also benefit from this course.
Every major aspect of application security is covered, and each module includes both design and coding
advice. Hands-on labs are provided to help students master the concepts in a highly interactive setting. The
course focuses on application development strategies and tactics that secure software at the source.

Prerequisites
The course is contains coding examples in both Java and ASP.Net, but can be customized for any development
language. A working knowledge of HTML, JavaScript and any server-side programming language (ASP.Net, Java,
PHP, etc.) is recommended.

Security Principles Overview: Importance of Security in the Software Development Lifecycle


Regulations, Privacy and Compliance
Impact of Security Defects
Core Security Concepts
Security Design Principles

Information Disclosure Leakage in Web Technologies (HTML, HTTP, Files, Client-Side Objects, URLs,
Web Services)
Error Handling (Structured vs. Functional)
Google Hacking

Authentication Methods of Authentication


2-Factor Authentication
Single Sign-On
Common Authentication Attacks (Brute Force, Username Harvesting, etc.)
Implementing Secure Authentication – Design and Coding

Session Management Overview of Sessions


Threats to Sessions and Impact
Common Implementation Mistakes and Exploits (Interception, Prediction,
Brute Force, etc.)
Implementing Secure Sessions – Design and Coding

Authorization
and Access Control Methods of Access Control
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Rule-Based Access Control
Common Authorization Attacks (Parameter Tampering, Privilege Escalation,
Cross-Site Request Forgery, etc.)
Implementing Secure Authentication – Design and Coding

Secure Data Handling Overview of Data Handling


Integrity Validation
Data Validation
Business Rule Validation
Common Exploits (SQL Injection, Cross-Site Scripting, HTTP Response Splitting,
etc.)
Implementing Secure Data Handling – Design and Coding

Cryptography Hashing
Secure Password Storage
Symmetric and Asymmetric Encryption
Digital Signatures
Certificates
Key Distribution
SSL and Digital Certificates
Implementing Cryptography – Design and Coding

Logging Logging Overview


Threats and Considerations
Implementing Logging – Design and Coding

Web Service Security Simple Object Access Protocol (SOAP)


SOAP Related Protocols
Security Assertion Markup Language (SAML)
WS-Security
REpresentational State Transfer (REST)
REST Related Protocols
JSON vs XML
Implementing Secure Web Services – Design and Coding

Secure Application
Development Software Development Life Cycle (SDLC)
Threat Modeling
Application Risk Levels
Risk Assessment
STRIDE and DREAD
Severity Level Classifications
Web Application Security Tools
Web Application Security Resources
API SECURITY
This course is designed to teach web application developers and architects how to build applications with
world-class security. QA engineers, IT security analysts, and IT risk managers can also benefit from this course.
Every major aspect of application programming interface security is covered, and each module includes both
design and coding advice.

Prerequisites
The course is contains coding examples in both Java and ASP.Net, but can be customized for any development
language. A working knowledge of HTML, JavaScript and any server-side programming language (ASP.Net, Java,
PHP, etc.) is recommended.

Module 1: Managed APIs

Module 2: Security by Design

Module 3: HTTP Basic/Digest Authentication

Module 4: Mutual Athentication with TLS

Module 5: Identity Delegation

Module 6: OAuth 2.0

Module 7: OAuth 2.0 MAC Token Profile

Module 8: OAuth 2.0 Profiles

Module 10: User Managed Access

Module 11: Federation

Module 12: OpenID Connect

Module 13: JWT, JWS and JWE

Module 14: Patterns and Practices

You might also like