Choose your language:

France
Germany
Hong Kong
India
Ireland
Japan
Malaysia
Netherlands
New Zealand
Singapore
Sweden
United Kingdom
United States

Secure Java Web Application Development Lifecycle (SDL)

Course Code

IN1606

Duration

5 Days

This is an intermediate-level JEE/web services programming course, designed for developers who wish to get up and running on developing well defended software applications. Familiarity with Java and JEE is required and real world programming experience is highly recommended. Ideally participants should have approximately 6 months to a year of Java and JEE working knowledge.
Secure Java Web Application Development Lifecyle (SDL) is a lab-intensive, hands-on Java / JEE security training course, essential for experienced enterprise developers who need to engineer, maintain, and support secure JEE-based web applications. In addition to teaching basic secure programming skills, this course digs deep into sound processes and practices that apply to the entire software development lifecycle.

In this course, participants thoroughly examine best practices for defensively coding web applications, including XML processing, rich interfaces, and both RESTful and SOAP-based web services. Participants will repeatedly attack and then defend various assets associated with fully-functional web applications and web services. This hands-on approach drives home the mechanics of how to secure JEE web applications in the most practical of terms.

Security experts agree that the least effective approach to security is "penetrate and patch". It is far more effective to "bake" security into an application throughout its lifecycle. After spending significant time trying to defend a poorly designed (from a security perspective) web application, developers are ready to learn how to build secure web applications starting at project inception. The final portion of this course builds on the previously learned mechanics for building defenses by exploring how design and analysis can be used to build stronger applications from the beginning of the software lifecycle.

A key component to our Best Defense IT Security Training Series, this workshop is a companion course with several developer-oriented courses and seminars. Although this edition of the course is Java-specific, it may also be presented using .NET or other programming languages.
This course is designed for Java and JEE Web Developers

In this course, participants will:

  • Understand potential sources for untrusted data
  • Understand the consequences for not properly handling untrusted data such as denial of service, cross-site scripting, and injections
  • Be able to test web applications with various attack techniques to determine the existence of and effectiveness of layered defenses
  • Prevent and defend the many potential vulnerabilities associated with untrusted data
  • Understand the vulnerabilities of associated with authentication and authorization
  • Be able to detect, attack, and implement defenses for authentication and authorization functionality and services
  • Understand the dangers and mechanisms behind Cross-Site Scripting (XSS) and Injection attacks
  • Be able to detect, attack, and implement defenses against XSS and Injection attacks
  • Understand the concepts and terminology behind defensive, secure, coding
  • Understand the use of Threat Modeling as a tool in identifying software vulnerabilities based on realistic threats against meaningful assets
  • Perform both static code reviews and dynamic application testing to uncover vulnerabilities in Java-based web applications
  • Design and develop strong, robust authentication and authorization implementations within the context of JEE
  • Understand the fundamentals of XML Digital Signature and XML Encryption as well as how they are used within the web services arena
  • Be able to detect, attack, and implement defenses for both RESTful and SOAP-based web services and functionality
  • Understand techniques and measures that can used to harden web and application servers as well as other components in your infrastructure
  • Understand and implement the processes and measures associated with the Secure Software Development (SSD)
  • Acquire the skills, tools, and best practices for design and code reviews as well as testing initiatives
  • Understand the basics of security testing and planning
  • Work through a comprehensive testing plan for recognized vulnerabilities and weaknesses
Introduction: Misconceptions
Security: The Complete Picture
TJX: Anatomy of a Disaster?
Causes of Data Breaches
Heartland – Slipping Past PCI Compliance
Target's Painful Christmas
Meaning of Being Compliant
Verizon’s 2013 and 2014 Data Breach Reports

Security Concepts
Motivations: Costs and Standards
Open Web Application Security Project
Web Application Security Consortium
CERT Secure Coding Standards
Assets are the Targets
Security Activities Cost Resources
Threat Modeling
System/Trust Boundaries

Principles of Information Security
Security Is a Lifecycle Issue
Minimize Attack Surface Area
Layers of Defense: Tenacious D
Compartmentalize
Consider All Application States
Do NOT Trust the Untrusted

Unvalidated Input
Buffer Overflows
Integer Arithmetic Vulnerabilities
Unvalidated Input: From the Web
Defending Trust Boundaries
Whitelisting vs Blacklisting

Overview of Regular Expressions
Regular Expressions
Working With Regexes in Java
Applying Regular Expressions

Broken Access Control
Access Control Issues
Excessive Privileges
Insufficient Flow Control
Unprotected URL/Resource Access
Examples of Shabby Access Control
Session and Session Management

Broken Authentication
Broken Quality/DoS
Authentication Data
Username/Password Protection
Exploits Magnify Importance
Handling Passwords on Server Side
Single Sign-on (SSO)

Cross Site Scripting (XSS)
Persistent XSS
Reflective XSS
Best Practices for Untrusted Data

Injection
Injection Flaws
SQL Injection Attacks Evolve
Drill Down on Stored Procedures
Other Forms of Injection
Minimizing Injection Flaws

Error Handling and Information Leakage
Fingerprinting a Web Site
Error-Handling Issues
Logging In Support of Forensics
Solving DLP Challenges

Insecure Data Handling
Protecting Data Can Mitigate Impact
In-Memory Data Handling
Secure Pipes
Failures in the SSL Framework Are Appearing
Insecure Configuration Management
System Hardening: IA Mitigation
Application Whitelisting
Least Privileges
Anti-Exploitation
Secure Baseline

Direct Object Access
Dynamic Loading
Direct Object References

Spoofing, CSRF, and Redirects
Name Resolution Vulnerabilities
Fake Certs and Mobile Apps
Targeted Spoofing Attacks
Cross Site Request Forgeries (CSRF)
CSRF Defenses are Entirely Server-Side
Safe Redirects and Forwards

Cryptography Overview
Strong Encryption
Message digests
Keys and key management
Certificate management
Encryption/Decryption

Understanding What’s Important
Common Vulnerabilities and Exposures
OWASP Top Ten for 2013
CWE/SANS Top 25 Most Dangerous SW Errors
Monster Mitigations
Strength Training: Project Teams/Developers
Strength Training: IT Organizations

Defending XML
XML Signature
XML Encryption
XML Attacks: Structure
XML Attacks: Injection
Safe XML Processing

Defending Web Services
Web Service Security Exposures
When Transport-Level Alone is NOT Enough
Message-Level Security
WS-Security Roadmap
XWSS Provides Many Functions
Web Service Attacks
Web Service Appliance/Gateways

Defending Rich Interfaces and REST
How Attackers See Rich Interfaces
Attack Surface Changes When Moving to Rich Interfaces
Bridging and its Potential Problems
Three Basic Tenets for Safe Rich Interfaces
OWASP REST Security Recommendations

SDL Process Overview
Software Security Axioms
Security Lifecycle – Phases

Applying Processes and Practices
Awareness
Application Assessments
Security Requirements
Secure Development Practices
Security Architecture/Design Review
Security Code Review
Configuration Management and Deployment
Vulnerability Remediation Procedures

Risk Analysis
Threat Modeling Process
1. Identify Security Objectives
2. Describe the System
3. List Assets
4. Define System/Trust Boundaries
5. List and Rank Threats
6. List Defenses and Countermeasures

Testing Tools and Processes
Security Testing Principles
Black Box Analyzers
Static Code Analyzers
Criteria for Selecting Static Analyzers

Testing Practices
OWASP Web App Penetration Testing
Authentication Testing
Session Management Testing
Data Validation Testing
Denial of Service Testing
Web Services Testing
Ajax Testing
Send Us a Message
Choose one