Name: Web application security in Java
Brand: Java
SKU: 2625
Price: 29900 SEK
Availability: InStock

Beskrivning

Cyber security basics
- What is security?
- Threat and risk
- Cyber security threat types – the CIA triad
- Consequences of insecure software

The OWASP Top Ten 2025
- A01 – Broken Access Control
  - Access control basics
  - Case study – Broken authn/authz in Apache OFBiz
  - Confused deputy
    - Insecure direct object reference (IDOR)
    - Path traversal
    - Case study – RCE via path traversal in Apache OFBiz
    - Lab – Insecure Direct Object Reference
    - Path traversal best practices
    - Authorization bypass through user-controlled keys
    - Case study – Remote takeover of Nexx garage doors and alarms
    - Lab – Horizontal authorization
  - File upload
    - Unrestricted file upload
    - Good practices
    - Lab – Unrestricted file upload
  - Server-side Request Forgery (SSRF)
    - Case study – SSRF in Ivanti Connect Secure
- A02 – Security Misconfiguration
  - Configuration principles
  - Web security configuration issues
    - Content Security Policy
    - Fetch directives
    - Source allowlisting
    - Strict CSP: using nonces and hashes
    - CSP best practices
  - Cookie security
    - Cookie attributes
  - Secrets management
    - Hard coded passwords
    - Best practices
    - Lab – Hardcoded password
  - XML entities
    - DTD and the entities
    - Entity expansion
    - External Entity Attack (XXE)
      - File inclusion with external entities
      - Server-Side Request Forgery with external entities
      - Lab – External entity attack
      - Preventing XXE
      - Lab – Prohibiting DTD
      - Case study – XXE vulnerability in Ivanti products
- A03 – Software Supply Chain Failures
  - Using vulnerable components
  - Untrusted functionality import
  - Supply chain security and the Software Bill of Materials (SBOM)
  - SBOM examples
  - Case study – The Polyfill.io supply chain attack
  - Vulnerability management
    - Lab – Finding vulnerabilities in third-party components
    - DevOps, the CI / CD build process and Software Composition Analysis
    - Dependency checking in Java
    - Lab – Detecting vulnerable components

The OWASP Top Ten 2025
- A04 – Cryptographic Failures
  - Cryptography for developers
    - Cryptography basics
    - Java Cryptographic Architecture (JCA) in brief
    - Elementary algorithms
      - Hashing
        
        Hashing basics
        
        Hashing in Java
        
        Lab – Hashing in JCA
      - Random number generation
        
        Pseudo random number generators (PRNGs)
        
        Cryptographically secure PRNGs
        
        Weak and strong PRNGs in Java
        
        Lab – Using random numbers in Java
    - Confidentiality protection
      - Symmetric encryption
        
        Block ciphers
        
        Modes of operation
        
        Modes of operation and IV – best practices
        
        Symmetric encryption in Java
        
        Symmetric encryption in Java with streams
        
        Lab – Symmetric encryption in JCA
      - Asymmetric encryption
      - Combining symmetric and asymmetric algorithms
- A05 – Injection
  - Input validation
    - Input validation principles
    - What to validate – the attack surface
    - Where to validate – defense in depth
    - When to validate – validation vs transformations
  - SQL injection
    - SQL injection basics
    - Lab – SQL injection
    - SQL injection best practices
      - Input validation
      - Parameterized queries
      - Lab – Using prepared statements
      - Case study – SQL injection in Fortra FileCatalyst
  - Code injection
    - OS command injection
      - OS command injection best practices
      - Using Runtime.exec()
      - Case study – Shellshock
      - Lab – Shellshock
      - Case study – Command injection in VMware Aria
  - HTML injection – Cross-site scripting (XSS)
    - Cross-site scripting basics
    - Cross-site scripting types
      - Persistent cross-site scripting
      - Reflected cross-site scripting
      - Client-side (DOM-based) cross-site scripting
    - Lab – Stored XSS
    - Lab – Reflected XSS
    - XSS protection best practices
      - Protection principles – escaping
      - Lab – XSS fix / stored
      - Lab – XSS fix / reflected
      - Case study – XSS vulnerabilities in DrayTek Vigor routers

The OWASP Top Ten 2025
- A06 – Insecure Design
  - The STRIDE model of threats
  - Secure design principles of Saltzer and Schroeder
    - Economy of mechanism
    - Fail-safe defaults
    - Complete mediation
    - Open design
    - Separation of privilege
    - Least privilege
    - Least common mechanism
    - Psychological acceptability
  - Client-side security
    - Frame sandboxing
      - Cross-Frame Scripting (XFS) attacks
      - Lab – Clickjacking
      - Clickjacking protection best practices
      - Lab – Using CSP to prevent clickjacking
- A07 – Authentication Failures
  - Authentication
    - Authentication basics
    - Multi-factor authentication (MFA)
    - Case study – The InfinityGauntlet attack
  - Password management
    - Storing account passwords
    - Password in transit
    - Lab – Is just hashing passwords enough?
    - Dictionary attacks and brute forcing
    - Salting
    - Adaptive hash functions for password storage
    - Lab – Using adaptive hash functions in JCA
  - Password policy
    - NIST authenticator requirements for memorized secrets
    - Password database migration
- A08 – Software and Data Integrity Failures
  - Integrity protection
    - Message Authentication Code (MAC)
      - Calculating MAC in Java
      - Lab – Calculating MAC in JCA
    - Digital signature
      - Digital signature with RSA
      - Elliptic Curve Cryptography
        
        ECC basics
        
        Digital signature with ECC
      - Digital signature in Java
        
        Lab – Digital signature with ECDSA in JCA
  - Subresource integrity
    - Importing JavaScript
    - Lab – Importing JavaScript
    - Case study – The British Airways data breach
  - Insecure deserialization
    - Serialization and deserialization challenges
    - Integrity – deserializing untrusted streams
    - Integrity – deserialization best practices
    - Look ahead deserialization
    - Property Oriented Programming (POP)
      - Creating a POP payload
      - Lab – Creating a POP payload
      - Lab – Using the POP payload
      - Case study – Deserialization RCEs in NextGen Mirth Connect

Wrap up
- Secure coding principles
  - Principles of robust programming by Matt Bishop
- And now what?
  - Software security sources and further reading
  - Java resources

Kursen levereras i samarbete med

Kontakta oss om denna kurs

← Tillbaka

Tack för din respons. ✨

Ytterligare information

Kurslängd	3 dagar
Lärarledd	Ja
Språk	Engelskt tal, material på engelska

Recensioner

Det finns inga recensioner än.

Endast inloggade kunder som har köpt denna produkt får lämna en recension.

Web application security in Java

Web application security in Java

Beskrivning

Kursen levereras i samarbete med

Kontakta oss om denna kurs

Tack för din respons. ✨

Ytterligare information

Recensioner

Relaterade produkter

Excel Grundutbildning

Excel för självlärda

MS Teams, Best Practices

MS-500T00: Microsoft 365 Security Administration