Even seasoned developers do not always fully master the security services provided by their development platforms, nor are they always aware of the vulnerabilities relevant to their projects. This course is designed for developers working with both Java and PHP, equipping them with the essential skills needed to make their applications resilient against contemporary internet-based attacks.
The course explores layers of Java security architecture by addressing access control, authentication, authorization, secure communication, and various cryptographic functions. It also introduces various APIs that can be used to secure code in PHP, such as OpenSSL for cryptography and HTML Purifier for input validation. On the server side, best practices are provided for hardening and configuring the operating system, web container, file system, SQL server, and PHP itself, with a special focus on client-side security through the security issues of JavaScript, Ajax, and HTML5.
General web vulnerabilities are discussed using examples aligned with the OWASP Top Ten, illustrating various injection attacks, script injections, attacks against session handling, insecure direct object references, issues with file uploads, and many others. The various Java- and PHP-specific language problems and issues stemming from the runtime environment are introduced, grouped into the standard vulnerability types of missing or improper input validation, improper use of security features, incorrect error and exception handling, time- and state-related problems, code quality issues, and mobile code-related vulnerabilities.
Participants can try out the discussed APIs, tools, and the effects of configurations for themselves, while the introduction of vulnerabilities is supported by a number of hands-on exercises demonstrating the consequences of successful attacks, showing how to correct the bugs and apply mitigation techniques, and introducing the use of various extensions and tools.
Participants attending this course will
- Understand basic concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and know how to avoid them
- Learn about client-side vulnerabilities and secure coding practices
- Learn to use various security features of the Java development environment
- Gain a practical understanding of cryptography
- Learn to use various security features of PHP
- Understand security concepts of web services
- Gain practical knowledge in using security testing tools
- Learn about typical coding mistakes and how to avoid them
- Be informed about recent vulnerabilities in Java and PHP frameworks and libraries
- Get sources and further readings on secure coding practices
Audience
Developers
Read more...
