Even experienced programmers do not always fully grasp the various security services provided by their development platforms, nor are they always aware of the different vulnerabilities relevant to their work. This course is designed for developers using both Java and PHP, equipping them with essential skills to make their applications resilient against modern internet attacks.
The levels of Java security architecture are explored through topics such as access control, authentication and authorization, secure communication, and various cryptographic functions. The course also introduces several APIs that can be used to secure your code in PHP, including OpenSSL for cryptography and HTML Purifier for input validation. On the server side, best practices for hardening and configuring the operating system, web container, file system, SQL server, and PHP itself are covered, with a special focus on client-side security issues related to JavaScript, Ajax, and HTML5.
General web vulnerabilities are discussed through examples aligned with the OWASP Top Ten, covering various injection attacks, script injections, session handling attacks, insecure direct object references, file upload issues, and more. The course also addresses Java- and PHP-specific language problems and runtime environment issues, grouped into standard vulnerability types such as missing or improper input validation, misuse of security features, incorrect error and exception handling, time- and state-related problems, code quality issues, and vulnerabilities related to mobile code.
Participants will have the opportunity to try out the discussed APIs, tools, and configurations themselves. The introduction of vulnerabilities is supported by hands-on exercises that demonstrate the consequences of successful attacks, how to correct bugs, apply mitigation techniques, and use various extensions and tools.
Participants attending this course will
- Understand basic concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and how to avoid them
- Gain knowledge of client-side vulnerabilities and secure coding practices
- Learn to use various security features of the Java development environment
- Develop a practical understanding of cryptography
- Learn to use various security features of PHP
- Understand the security concepts of web services
- Gain practical knowledge in using security testing tools
- Learn about typical coding mistakes and how to avoid them
- Stay informed about recent vulnerabilities in Java and PHP frameworks and libraries
- Receive sources and further readings on secure coding practices
Audience
Developers
Read more...
