Secure Web and Distributed Application Development Training

• Perform bug hunting safely and ethically, and use organizational defect-reporting mechanisms
• Understand the concepts and terminology behind defensive, secure coding and the goals of a typical exploit
• Identify the OWASP Top 10 Most Critical Web Application Security Risks and the consequences of their exploitation
• Recognize common web application exploits and implement secure-coding standards to mitigate them
• Identify untrusted data sources and test web applications with attack techniques to verify layered defenses
• Detect, attack and defend authentication and authorization mechanisms
• Write web application code that implements security best practices, including secure database use
• Harden web and application servers and apply strong encryption for data at rest and in flight

Experience programming in Java or a similar object-oriented language; familiarity with JEE.

• Module 1: Bug Hunting Foundations
  • Security and insecurity, dangerous assumptions, attack vectors, safe and ethical bug hunting, working ethically, respecting privacy, defect notification and bug-bounty programs.
• Module 2: Moving Forward from Hunting Bugs
  • Removing bugs with OWASP and the OWASP Top Ten, the Web Application Security Consortium, CERT Secure Coding Standards, mistakes to avoid, and tools and resources.
• Module 3: Securing Web Applications
  • Principles of information security, security as a lifecycle issue, minimizing attack surface, layered defense and compartmentalization — with Eclipse (JEE) and Apache TomEE lab setup and a HyperSQL database tutorial.
• Module 4: Unvalidated Data
  • Buffer overflows, integer arithmetic vulnerabilities, crossing trust boundaries, defending trust boundaries, and whitelisting versus blacklisting.
• Module 5: OWASP A1 — Injection
  • Injection flaws, how SQL injection attacks evolve, stored procedures, other forms of injection, and minimizing injection flaws.
• Module 6: OWASP A2 — Broken Authentication
  • Quality and protection of authentication data, server-side password handling, database authentication defenses, session-ID risk reduction, and HttpOnly and security headers.
• Module 7: OWASP A3 — Sensitive Data Exposure
  • Protecting data to mitigate impact, in-memory data handling, secure pipes, and failures in the TLS/SSL framework.
• Module 8: OWASP A4 — XML External Entities
  • XML parser coercion, XML attack structure and injection, safe XML processing, and dynamic loading using XSLT.
• Module 9: OWASP A5 — Broken Access Control
  • Excessive privileges, insufficient flow control, unprotected resource access, unsafe direct object references, and session management.
• Module 10: OWASP A6 — Security Misconfiguration
  • System hardening and IA mitigation, application whitelisting, least privilege, anti-exploitation and a secure baseline.
• Module 11: OWASP A7 — Cross-Site Scripting
  • XSS patterns, persistent and reflective XSS, DOM-based XSS, and best practices for untrusted data.
• Module 12: OWASP A8/A9 — Deserialization & Vulnerable Components
  • Deserialization issues, identifying serialization and deserialization, vulnerable components, software inventory and managing updates.
• Module 13: OWASP A10 — Insufficient Logging & Monitoring
  • Logging best practices, error-handling fixes, and forensics and data loss prevention.