Maxtrain.com - info@maxtrain.com - 513-322-8888 - 866-595-6863
Secure Web Applications | OWASP Top Ten, Web Services, Rich Interfaces & More
Description
Secure Web Applications Introduction
Welcome to Secure Web Applications | OWASP Top Ten, Web Services, Rich Interfaces & More Training. This course emphasizes proactive security in web application development, moving beyond the outdated “penetrate and patch” method.
It teaches developers to integrate security from the start of the development lifecycle, focusing on secure design and analysis principles. Participants will learn to build secure applications from the ground up, understanding the importance of a security-first approach in software development.
Designed for web developers and technical stakeholders, this seminar-style course covers the 2021 OWASP Top Ten and other key security risks, including secure file uploads and handling untrusted text. An experienced web app security expert guides participants in embedding security practices into their development process.
This course uses real-world examples to highlight the risks of overlooking security, emphasizing defensive coding and a deep understanding of web application security challenges.
Secure Web Applications Course Objectives
Guided by our application security expert, you will explore how to:
- Understand defensive, secure coding concepts and terminology, including typical exploit phases and goals.
- Learn the fundamental principle in security analysis of all web applications for this course and future work.
- Establish the primary principle in addressing all security concerns in this course and beyond.
- Ensure hacking and bug hunting are conducted safely and appropriately.
- Identify defect and bug reporting mechanisms within organizations.
- Avoid common errors in bug hunting and vulnerability testing.
- Develop an understanding of the necessity and value of multilayered defense strategies.
- Recognize potential sources of untrusted data.
Prerequisites
Real-world programming experience is highly recommended for code reviews, but not required.
Audience
This is an overview-level , lecture and demonstration style course, designed to provide technical application project stakeholders with a first-look or baseline understanding of how to develop well defended web applications.
Secure Web Applications Outline
Bug Hunting Foundation
- Why Hunt Bugs?
- The Language of Cybersecurity
- The Changing Cybersecurity Landscape
- AppSec Dissection of SolarWinds
- The Human Perimeter
- Interpreting the Verizon Data Breach Investigation Report
- First Axiom in Web Application Security Analysis
- First Axiom in Addressing ALL Security Concerns
- Lab: Case Study in Failure
Safe and Appropriate Bug Hunting/Hacking
- Working Ethically
- Respecting Privacy
- Bug/Defect Notification
- Bug Bounty Programs
- Bug Hunting Mistakes to Avoid
Moving Forward From Hunting Bugs
- Removing Bugs
- Open Web Application Security Project (OWASP)
- OWASP Top Ten Overview
- Web Application Security Consortium (WASC)
- CERT Secure Coding Standards
- Microsoft Security Response Center
- Software-Specific Threat Intelligence
Foundation for Securing Web Applications
- Principles of Information Security
- Security Is a Lifecycle Issue
- Minimize Attack Surface Area
- Layers of Defense: Tenacious D
- Compartmentalize
- Consider All Application States
- Do NOT Trust the Untrusted
- AppSec Dissection of the Verkada Exploit
Bug Stomping 101
Unvalidated Data
- Buffer Overflows
- Integer Arithmetic Vulnerabilities
- Defining and Defending Trust Boundaries
- Rigorous., Positive Specifications
- Whitelisting vs Blacklisting
- Challenges: Free-Form Text, Email Addresses, and Uploaded Files
Broken Access Control
- Elevation of Privileges
- Insufficient Flow Control
- Unprotected URL/Resource Access/Forceful Browsing
- Metadata Manipulation (JWTs)
- CORS Misconfiguration Issues
- Cross Site Request Forgeries (CSRF)
- CSRF Defenses
- Lab: Spotlight: Verizon
Cryptographic Failures
-
- Identifying Protection Needs
- Evolving Privacy Considerations
- Options for Protecting Data
- Transport/Message Level Security
- Weak Cryptographic Processing
- Keys and Key Management
- NIST Recommendations
Injection
- Injection Flaws
- SQL Injection Attacks Evolve
- Drill Down on Stored Procedures
- Other Forms of Server-Side Injection
- Minimizing Injection Flaws
- Client-side Injection: XSS
- Persistent, Reflective, and DOM-Based XSS
- Best Practices for Untrusted Data
Insecure Design
- Secure Software Development Processes
- Shifting Left
- Cost of Continually Reinventing
- Leveraging Common AppSec Practices and Control
- Paralysis by Analysis
- Actionable Application Security
- Additional Tools for the Toolbox
- Lab: Actionable AppSec
Security Misconfiguration
- System Hardening
- Risks with Internet-Connected Resources (Servers to Cloud)
- Minimalist Configurations
- Application Whitelisting
- Secure Baseline
- Segmentation with Containers and Cloud
- Lab: Configuration Guidance
- Resolution of External References
- Safe XML Processing
Bug Stomping 102
Vulnerable and Outdated Components
- Vulnerable Components
- Software Inventory
- Managing Updates: Balancing Risk and Timeliness
- AppSec Dissection of Ongoing Microsoft Exchange Exploits
- Lab: Spotlight: Equifax
Identification and Authentication Failures
- Quality and Protection of Authentication Data
- Proper hashing of passwords
- Handling Passwords on Server Side
- Session Management
- HttpOnly and Security Headers
Software and Data Integrity Failures
- Serialization/Deserialization
- Issues with Consuming Vulnerable Software
- Using Trusted Repositories
- CI/CD Pipeline Issues
- Protecting Software Development Resources
Security Logging and Monitoring Failures
- Detecting Threats and Active Attacks
- Best Practices for Determining What to Log
- Safe Logging in Support of Forensics
- Lab: Auditing and Logging Guidance
Server-Side Request Forgery (SSRF)
- Understanding SSRF
- Remote Resource Access Scenarios
- Complexity of Cloud Services
- SSRF Defense in Depth
- Positive Allow Lists
Moving Forward
Applications: What Next?
- Common Vulnerabilities and Exposures
- CWE/SANS Top 25 Most Dangerous SW Errors
- Strength Training: Project Teams/Developers
- Strength Training: IT Organizations
- Lab: Spotlight: Capital One
$1695.00
|
2 Days Course |