Even seasoned developers do not necessarily master all the security services provided by their development platforms, nor are they always fully aware of the vulnerabilities that could affect their projects. This course is designed for developers working with both Java and PHP, equipping them with the essential skills needed to make their applications resilient against modern internet-based attacks.
Participants will navigate the layers of Java security architecture, addressing access control, authentication, authorization, secure communication, and various cryptographic functions. The course also introduces key APIs for securing PHP code, such as OpenSSL for cryptography and HTML Purifier for input validation. Server-side best practices for hardening and configuring the operating system, web container, file system, SQL server, and PHP itself are covered, with a special emphasis on client-side security issues related to JavaScript, Ajax, and HTML5.
General web vulnerabilities are discussed using examples aligned with the OWASP Top Ten, including various injection attacks, script injections, session handling attacks, insecure direct object references, file upload issues, and more. The course introduces language-specific problems in Java and PHP, as well as issues arising from the runtime environment, categorizing them into standard vulnerability types such as missing or improper input validation, incorrect use of security features, flawed error and exception handling, time- and state-related problems, code quality issues, and mobile code-related vulnerabilities.
Participants will have the opportunity to experiment with the discussed APIs, tools, and configuration effects. Each introduction to vulnerabilities is supported by hands-on exercises that demonstrate the consequences of successful attacks, show how to fix bugs, apply mitigation techniques, and introduce the use of various extensions and tools.
Participants attending this course will
- Understand fundamental concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and how to avoid them
- Learn about client-side vulnerabilities and secure coding practices
- Learn to utilize various security features within the Java development environment
- Gain a practical understanding of cryptography
- Learn to use various security features in PHP
- Understand the security concepts of web services
- Acquire practical knowledge in using security testing tools
- Learn about typical coding mistakes and how to prevent them
- Stay informed about recent vulnerabilities in Java and PHP frameworks and libraries
- Receive sources and further readings on secure coding practices
Audience
Developers
Read more...
