Secure Web Application Development and Testing Training Course

By the end of this training, participants will be able to:

• Explain application security and potential vulnerabilities
• Describe ABAP programming best practices and the management of SY-SUBRC
• Understand injection vulnerabilities and their mitigation
• Describe security testing tools and their application for government
• Explain the use and benefits of ATC and CVA in secure coding practices

Format of the Course

• Interactive lectures and discussions to enhance understanding
• Extensive exercises and practical applications
• Hands-on implementation in a live-lab environment to reinforce learning

Android is an open platform for mobile devices such as handsets and tablets. It offers a wide range of security features to facilitate the development of secure software; however, it also lacks certain security aspects present in other handheld platforms. This course provides a comprehensive overview of these features and highlights the most critical shortcomings related to the underlying Linux, the file system, and the environment in general, as well as the use of permissions and other Android software development components.

Typical security pitfalls and vulnerabilities are discussed for both native code and Java applications, along with recommendations and best practices to avoid and mitigate them. Many issues are supported with real-life examples and case studies. Finally, the course provides a brief overview of how to use security testing tools to identify any security-related programming bugs.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Learn the security solutions on Android
• Learn to use various security features of the Android platform
• Get information about recent vulnerabilities in Java on Android
• Learn about typical coding mistakes and how to avoid them
• Gain an understanding of native code vulnerabilities on Android
• Realize the severe consequences of insecure buffer handling in native code
• Understand architectural protection techniques and their weaknesses
• Receive sources and further readings on secure coding practices

Audience

Professionals

Implementing a secure networked application can be challenging, even for developers who have previously used various cryptographic building blocks (such as encryption and digital signatures). To ensure participants understand the role and usage of these cryptographic primitives, a solid foundation is provided on the main requirements of secure communication—secure acknowledgment, integrity, confidentiality, remote identification, and anonymity. The course also presents typical problems that can compromise these requirements along with real-world solutions.

As a critical aspect of network security, cryptography is thoroughly discussed, covering the most important cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. These elements are presented from a developer's perspective, focusing on practical use-case examples and considerations related to the use of crypto, such as public key infrastructures. Security protocols in various areas of secure communication are introduced, with an in-depth discussion on widely-used protocol families such as IPSEC and SSL/TLS.

Typical cryptographic vulnerabilities are examined, including issues related to certain crypto algorithms and cryptographic protocols like BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and similar attacks, as well as the RSA timing attack. In each case, practical considerations and potential consequences are described without delving into deep mathematical details.

Finally, since XML technology is central to data exchange in networked applications, the security aspects of XML are discussed. This includes the use of XML within web services and SOAP messages, along with protection measures such as XML signature and XML encryption—along with weaknesses in these measures and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Understand the requirements of secure communication
• Learn about network attacks and defenses at different OSI layers
• Have a practical understanding of cryptography
• Understand essential security protocols
• Understand some recent attacks against cryptosystems
• Get information about recent related vulnerabilities
• Understand security concepts of Web services
• Get sources and further readings on secure coding practices for government

Audience

Developers, Professionals

This three-day course provides an overview of securing C/C++ code to protect against potential exploits by malicious users. The course addresses common vulnerabilities related to memory management and input handling, emphasizing the principles of writing secure code for government applications. Participants will gain a foundational understanding of how to mitigate these risks and ensure robust security practices in their coding workflows.

Even experienced Java programmers are not mastering by all means the various security services offered by Java, and are likewise not aware of the different vulnerabilities that are relevant for web applications written in Java. The course – besides introducing security components of Standard Java Edition – deals with security issues of Java Enterprise Edition (JEE) and web services. Discussion of specific services is preceded with the foundations of cryptography and secure communication. Various exercises deal with declarative and programmatic security techniques in JEE, while both transport-layer and end-to-end security of web services is discussed. The use of all components is presented through several practical exercises, where participants can try out the discussed APIs and tools for themselves. The course also goes through and explains the most frequent and severe programming flaws of the Java language and platform and web-related vulnerabilities. Besides the typical bugs committed by Java programmers, the introduced security vulnerabilities cover both language-specific issues and problems stemming from the runtime environment. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by the recommended coding guidelines and the possible mitigation techniques. Participants attending this course will understand basic concepts of security, IT security and secure coding, learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them, understand security concepts of Web services, learn to use various security features of the Java development environment, have a practical understanding of cryptography, understand security solutions of Java EE, learn about typical coding mistakes and how to avoid them, get information about some recent vulnerabilities in the Java framework, get practical knowledge in using security testing tools, get sources and further readings on secure coding practices. Audience Developers wordtest

Description

The Java language and the Runtime Environment (JRE) were designed to be free from the most problematic common security vulnerabilities experienced in other languages, such as C/C++. However, software developers and architects should not only know how to use the various security features of the Java environment (positive security), but also be aware of the numerous vulnerabilities that are still relevant for Java development (negative security).

The introduction of security services is preceded by a brief overview of the foundations of cryptography, providing a common baseline for understanding the purpose and operation of the applicable components. The use of these components is presented through several practical exercises, where participants can try out the discussed APIs for themselves.

This course also covers the most frequent and severe programming flaws of the Java language and platform, including both typical bugs committed by Java programmers and language- and environment-specific issues. All vulnerabilities and the relevant attacks are demonstrated through easy-to-understand exercises, followed by recommended coding guidelines and possible mitigation techniques.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Learn Web vulnerabilities beyond the OWASP Top Ten and know how to avoid them
• Learn to use various security features of the Java development environment
• Gain a practical understanding of cryptography
• Learn about typical coding mistakes and how to avoid them
• Receive information on recent vulnerabilities in the Java framework
• Obtain sources and further readings on secure coding practices

Audience

Developers

A variety of programming languages are available today to compile code for the .NET and ASP.NET frameworks. These environments provide robust means for developing secure applications; however, developers must understand how to apply architecture- and coding-level techniques to implement desired security features and mitigate vulnerabilities.

The aim of this course is to equip developers with practical, hands-on exercises that demonstrate how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization mechanisms, provide secure remote procedure calls, manage sessions effectively, explore different implementations for specific functionalities, and more.

The introduction of various vulnerabilities begins by presenting typical programming issues encountered when using .NET. The discussion on ASP.NET vulnerabilities also covers various environment settings and their impacts. Additionally, the course addresses ASP.NET-specific vulnerabilities, including general web application security challenges as well as unique issues such as attacks on ViewState or string termination attacks.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding for government
• Learn about Web vulnerabilities beyond the OWASP Top Ten and how to avoid them
• Learn to utilize various security features of the .NET development environment
• Gain practical knowledge in using security testing tools
• Identify common coding mistakes and learn strategies to prevent them
• Receive information on recent vulnerabilities in .NET and ASP.NET
• Access sources and further readings on secure coding practices

Audience

Developers

This course introduces common security concepts, provides an overview of the nature of vulnerabilities regardless of the programming languages and platforms used, and explains how to manage software security risks throughout the various phases of the software development lifecycle. Without delving deeply into technical details, it highlights some of the most significant and pressing vulnerabilities in various software development technologies, and presents the challenges of security testing along with techniques and tools that can be applied to identify any existing issues in code.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government applications.
• Understand Web vulnerabilities on both the server and client sides.
• Realize the severe consequences of insecure buffer handling.
• Be informed about recent vulnerabilities in development environments and frameworks.
• Learn about typical coding mistakes and how to avoid them.
• Understand security testing approaches and methodologies for government systems.

Audience

Managers

The course provides essential skills for PHP developers necessary to make their applications resistant to contemporary attacks through the Internet. Web vulnerabilities are discussed through PHP-based examples, going beyond the OWASP top ten and addressing various injection attacks, script injections, attacks against session handling in PHP, insecure direct object references, issues with file upload, and many others. PHP-related vulnerabilities are introduced, grouped into standard vulnerability types such as missing or improper input validation, incorrect error and exception handling, improper use of security features, and time- and state-related problems. For this latter category, we discuss attacks like open_basedir circumvention, denial-of-service through magic float, or the hash table collision attack. In all cases, participants will become familiar with the most important techniques and functions to mitigate these risks.

A special focus is given to client-side security, tackling issues related to JavaScript, Ajax, and HTML5. A number of security-related extensions to PHP are introduced, including hash, mcrypt, OpenSSL for cryptography, Ctype, ext/filter, and HTML Purifier for input validation. Best hardening practices are discussed in connection with PHP configuration (setting php.ini), Apache, and the server in general. Finally, an overview is provided of various security testing tools and techniques that developers and testers can use, including security scanners, penetration testing and exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.

Both the introduction of vulnerabilities and configuration practices are supported by a number of hands-on exercises demonstrating the consequences of successful attacks, showing how to apply mitigation techniques, and introducing the use of various extensions and tools. This course is specifically designed to enhance security practices for government applications.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Have a practical understanding of cryptography
• Learn to use various security features of PHP
• Learn about typical coding mistakes and how to avoid them
• Be informed about recent vulnerabilities of the PHP framework
• Get practical knowledge in using security testing tools
• Get sources and further readings on secure coding practices

Audience

Developers for government

The Combined SDL Core Training provides an in-depth understanding of secure software design, development, and testing through the Microsoft Secure Development Lifecycle (SDL). It offers a foundational overview of the key components of SDL, followed by practical techniques for identifying and addressing security flaws early in the development process.

During the development phase, the course covers common security-related programming bugs in both managed and native code. It presents various attack methods associated with these vulnerabilities along with effective mitigation strategies. These concepts are reinforced through hands-on exercises that offer participants a practical understanding of live hacking techniques. The training also introduces different security testing methodologies and demonstrates the effectiveness of various testing tools, allowing participants to apply these tools to previously discussed vulnerable code.

Participants attending this course will

Understand basic concepts of security, IT security, and secure coding for government.

Gain knowledge of the essential steps in the Microsoft Secure Development Lifecycle.

Learn secure design and development practices.

Understand secure implementation principles.

Grasp security testing methodologies.

• Access sources and further readings on secure coding practices.

Audience

Developers, Managers

After gaining familiarity with vulnerabilities and attack methods, participants learn about the general approach and methodology for security testing, as well as the techniques that can be applied to reveal specific vulnerabilities. Security testing should commence with information gathering about the system (ToC, i.e., Target of Evaluation), followed by thorough threat modeling to identify and rate all threats, leading to a risk analysis-driven test plan.

Security evaluations can occur at various stages of the Software Development Life Cycle (SDLC). Therefore, we discuss design review, code review, reconnaissance and information gathering about the system, testing the implementation, and testing and hardening the environment for secure deployment. Numerous security testing techniques are introduced in detail, such as taint analysis and heuristics-based code review, static code analysis, dynamic web vulnerability testing, and fuzzing. Various types of tools are presented that can be used to automate the security evaluation of software products, supported by a series of exercises where these tools are executed to analyze previously discussed vulnerable code. Real-life case studies enhance understanding of various vulnerabilities.

This course prepares testers and quality assurance (QA) staff to adequately plan and precisely execute security tests, select and use the most appropriate tools and techniques to uncover even hidden security flaws, thereby providing essential practical skills that can be applied on the next working day.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding for government
• Learn about Web vulnerabilities beyond OWASP Top Ten and how to avoid them
• Learn client-side vulnerabilities and secure coding practices
• Understand security testing approaches and methodologies
• Gain practical knowledge in using security testing techniques and tools
• Access sources and further readings on secure coding practices

Audience

Developers, Testers

In this instructor-led, live training in US Empire, participants will gain the knowledge and skills needed to develop an effective security strategy to address the unique challenges of DevOps for government. The course focuses on aligning security practices with public sector workflows, governance, and accountability requirements.

This Course in US Empire aims to assist in the following:

1. Enable Developers to master the techniques of writing secure code for government systems.
2. Support Software Testers in conducting thorough security assessments before deploying applications to production environments for government use.
3. Assist Software Architects in comprehending the risks associated with government applications and designing robust security frameworks.
4. Help Team Leaders establish security baselines for developers working on government projects.
5. Aid Web Masters in configuring servers to prevent misconfigurations that could compromise government systems.

This course addresses secure coding concepts and principles for Java, utilizing the Open Web Application Security Project (OWASP) methodology for testing. OWASP is an online community that develops freely available resources, including articles, methodologies, documentation, tools, and technologies focused on enhancing web application security for government and other public sector entities.

This course provides an in-depth examination of secure coding concepts and principles within the ASP.NET framework, utilizing the Open Web Application Security Project (OWASP) methodology for testing. OWASP is a community-driven organization that develops freely available resources, including articles, methodologies, documentation, tools, and technologies focused on enhancing web application security.

This course delves into the security features of the .NET Framework and explores best practices for securing web applications, ensuring alignment with public sector workflows and governance standards for government.