Overview
The Certified Application Security Engineer (CASE) focuses on secure application software development processes. It is a, hands-on, comprehensive application security course that will help you create a secure application software. This course encompasses security activities involved in all phases of the Secure Software Development Lifecycle (SDLC): planning, creating, testing, and deploying an application.
Unlike other application security training, CASE goes beyond just the guidelines on secure coding practices to include secure requirement gathering, robust application design, and handling security issues in post development phases of application development.
Prerequisites
Participants who wish to take up CASE – Java must be well-versed with basic programming skills.
Who Should Attend?
NET / Java Developers with a minimum of 2 years of experience and individuals who want to become application security engineers/analysts/testers.
Individuals involved in the role of developing, testing, managing, or protecting applications
Course Outline
- What is Secure Application
- Need for Application Security
- Most Common Application Level Attacks
- Why Applications become Vulnerable to Attacks
- What Constitutes a Comprehensive Application Security?
- Insecure Application: A Software Development Problem
- Software Security Standards, Models, and Frameworks
- Importance of Gathering Security Requirements
- Security Requirement Engineering (SRE)
- Abuse Case and Security Use Case Modeling
- Abuser and Security Stories
- Security Quality Requirements Engineering (SQUARE)
- Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)
- Relative Cost of Fixing Vulnerabilities at Different Phases of SDLC
- Secure Application Design and Architecture
- Goal of Secure Design Process
- Secure Design Actions
- Secure Design Principles
- Threat Modeling
- Decompose Application
- Secure Application Architecture
- Input Validation Pattern
- Validation and Security Issues
- Impact of Invalid Data Input
- Data Validation Techniques
- Input Validation using Frameworks and APIs
- Open Source Validation Framework for Java
- Servlet Filters
- Validation Filters for Servlet
- Data Validation using OWASP ESAPI
- Data Validation: Struts Framework
- Data Validation: Spring Framework
- Input Validation Errors
- Common Secure Coding Practices
- Introduction to Authentication
- Types of Authentication
- Authentication Weaknesses and Prevention
- Introduction to Authorization
- Access Control Model
- EJB Authorization
- Java Authentication and Authorization (JAAS)
- Java EE Security
- Authorization Common Mistakes and Countermeasures
- Authentication and Authorization in Spring Security Framework
- Defensive Coding Practices against Broken Authentication and Authorization
- Secure Development Checklists: Broken Authentication and Session Management
- Java Cryptography
- Encryption and Secret Keys
- Cipher Class
- Digital Signatures
- Secure Socket Layer (SSL)
- Key Management
- Digital Certificates
- Signed Code Sources
- Hashing
- Java Card Cryptography
- Spring Security: Crypto Module
- Dos and Don’ts in Java Cryptography
- Best Practices for Java Cryptography
- Session Management
- Session Tracking
- Session Management in Spring Security
- Session Vulnerabilities and their Mitigation Techniques
- Best Practices and Guidelines for Secured Sessions Management
- Checklist to Secure Credentials and Session IDs
- Guidelines for Secured Session Management
- Introduction to Exceptions
- Erroneous Exceptional Behaviors
- Dos and Don’ts in Error Handling
- Spring MVC Error Handling
- Exception Handling in Struts 2
- Best Practices for Error Handling
- Introduction to Logging
- Logging using Log4j
- Secure Coding in Logging
- Secured Practices in Logging
- Static Application Security Testing
- Manual Secure Code Review for Most Common Vulnerabilities
- Code Review: Check List Approach
- SAST Finding
- SAST Report
- Dynamic Application Security Testing (DAST)
- Automated Application Vulnerability Scanning Tools
- Proxy-based Security Testing Tools
- Choosing Between SAST and DAST
- Secure Deployment
- Prior Deployment Activity
- Deployment Activities: Ensuring Security at Various Levels
- Ensuring Security at Host Level
- Ensuring Security at Network Level
- Ensuring Security at Application Level
- Ensuring Security at Web Container Level (Tomcat)
- Ensuring Security in Oracle
- Security Maintenance and Monitoring
