Web application security in Java and C# (WASEC-JC#) – Contenuti

Contenuti dettagliati del Corso

Day 1

  • Cyber security basics
    • What is security?
    • Threat and risk
    • Cyber security threat types – the CIA triad
    • Consequences of insecure software
  • The OWASP Top Ten 2021
    • The OWASP Top 10 2021
    • A01 - Broken Access Control
      • Access control basics
      • Missing or improper authorization
      • Failure to restrict URL access
      • Confused deputy
      • File upload
      • Open redirects and forwards
      • Cross-site Request Forgery (CSRF)
    • A02 - Cryptographic Failures
      • Information exposure
      • Cryptography for developers

    Day 2

    • A02 - Cryptographic Failures (continued)
      • Cryptography for developers
    • A03 - Injection
      • Injection principles
      • Injection attacks
      • SQL injection
      • Parameter manipulation
      • Code injection
      • HTML injection - Cross-site scripting (XSS)

    Day 3

    • A03 - Injection (continued)
      • Input validation
    • A04 - Insecure Design
      • The STRIDE model of threats
      • Secure design principles of Saltzer and Schroeder
      • Client-side security
    • A05 - Security Misconfiguration
      • Configuration principles
      • Server misconfiguration
      • ASP.NET and IIS configuration best practices
      • Cookie security
      • XML entities
    • A06 - Vulnerable and Outdated Components
      • Using vulnerable components
      • Assessing the environment
      • Hardening
      • Untrusted functionality import
      • Vulnerability management

    Day 4

    • A07 - Identification and Authentication Failures
      • Authentication
      • Session management
      • Password management
    • A08 - Software and Data Integrity Failures
      • Integrity protection
      • Subresource integrity
      • Insecure deserialization
    • A09 - Security Logging and Monitoring Failures
      • Logging and monitoring principles
      • Log forging
      • Log forging – best practices
      • Case study – Log interpolation in log4j
      • Case study – The Log4Shell vulnerability (CVE-2021-44228)
      • Case study – Log4Shell follow-ups (CVE-2021-45046, CVE-2021-45105)
      • Logging best practices
    • A10 - Server-side Request Forgery (SSRF)
      • Server-side Request Forgery (SSRF)
      • Case study – SSRF and the Capital One breach
    • Wrap up
      • Secure coding principles
      • And now what?