Secure Java Web Application Development Lifecycle (SDL)

Course Duration

4 Days

Audience

Employees of federal, state and local governments; and businesses working with the government.

Prerequisites

No prerequisites required.

Course Description

PCI Compliant Developer Training This secure coding training addresses common coding vulnerabilities in software development processes. This training is used by one of the principle participants in the PCI DSS. Having passed multiple PCI audits, this course has been shown to meet the PCI requirements. The specification of those training requirements are detailed in 6.5.1 through 6.5.10 on pages 59 through 62 of the PCI DSS Requirements 3.1 document dated April, 2015. This is not "checklist mentality" training as it integrates demonstrations, code flashes, and hands-on labs for vulnerabilities, defenses, and best practices in secure development lifecycle (SDL). The Best Defense™ Security Training Series is a suite of developer-oriented, application security courses that provide complete coverage of the CWE/SANS Top 25 Most Dangerous Programming Errors (http://cwe.mitre.org/top25/), the OWASP Top Ten, the Verizon Data Breach Report, and the WASC Threat Classifications. These errors enable cyber espionage and crime, and this course equips developers with the knowledge and hands-on practice needed to recognize, address, and prevent them.

Learning Objectives

• Teach programmers what these errors are
• Demonstrate, in real terms, the potential impact of each of these errors
• Provide experience in how to recognize and properly address these errors
• Teach stakeholders how to defend against the potential consequences of security breaches in other parts of their IT infrastructure.
• Incorporates the applicable CERT Oracle Java Coding Standards
• Cross-reference materials, vulnerabilities, and attacks that are covered with both the OWASP Top 10 and the WASC Threat Classifications

Course Outline

Introduction: Misconceptions

• Security: The Complete Picture
• Seven Deadly Assumptions
• Anthem, Sony, Target, Heartland, and TJX Debriefs
• Causes of Data Breaches
• Meaning of Being Compliant
• Verizon’s 2015 Data Breach Report
• 2015 PCI Compliance Report

Session: Foundation

• Motivations: Costs and Standards
• Open Web Application Security Project
• Web Application Security Consortium
• CERT Secure Coding Standards
• Assets are the Targets
• Security Activities Cost Resources
• Threat Modeling
• System/Trust Boundaries

Lesson: Principles of Information Security

• Security Is a Lifecycle Issue
• Minimize Attack Surface Area
• Layers of Defense: Tenacious D
• Compartmentalize
• Consider All Application States
• Do NOT Trust the Untrusted

Session: Vulnerabilities

• Buffer Overflows
• Integer Arithmetic Vulnerabilities
• Unvalidated Input: From the Web
• Defending Trust Boundaries
• Whitelisting vs Blacklisting

Lesson: Overview of Regular Expressions

• Regular Expressions
• Working With Regexes in Java
• Applying Regular Expressions

Lesson: Broken Access Control

• Access Control Issues
• Excessive Privileges
• Insufficient Flow Control
• Unprotected URL/Resource Access
• Examples of Shabby Access Control
• Session and Session Management

Lesson: Broken Authentication

• Broken Quality/DoS
• Authentication Data
• Username/Password Protection
• Exploits Magnify Importance
• Handling Passwords on Server Side
• Single Sign-on (SSO)

Lesson: Cross Site Scripting (XSS)

• Persistent XSS
• Reflective XSS
• Best Practices for Untrusted Data

Lesson: Injection

• Injection Flaws
• SQL Injection Attacks Evolve
• Drill Down on Stored Procedures
• Other Forms of Injection
• Minimizing Injection Flaws

Lesson: Error Handling and Information Leakage

• Fingerprinting a Web Site
• Error-Handling Issues
• Logging In Support of Forensics
• Solving DLP Challenges

Lesson: Insecure Data Handling

• Protecting Data Can Mitigate Impact
• In-Memory Data Handling
• Secure Pipes
• Failures in the SSL Framework Are Appearing

Lesson: Insecure Configuration Management

• System Hardening: IA Mitigation
• Application Whitelisting
• Least Privileges
• Anti-Exploitation
• Secure Baseline

Lesson: Direct Object Access

• Dynamic Loading
• Direct Object References

Lesson: Spoofing, CSRF, and Redirects

• Name Resolution Vulnerabilities
• Fake Certs and Mobile Apps
• Targeted Spoofing Attacks
• Cross Site Request Forgeries (CSRF)
• CSRF Defenses are Entirely Server-Side
• Safe Redirects and Forwards

Lesson: Cryptography Overview

• Strong Encryption
• Message digests
• Keys and key management
• Certificate management
• Encryption/Decryption

Lesson: Understanding What’s Important

• Common Vulnerabilities and Exposures
• OWASP Top Ten for 2013
• CWE/SANS Top 25 Most Dangerous SW Errors
• Monster Mitigations
• Strength Training: Project Teams/Developers
• Strength Training: IT Organizations

Session: Defending XML, Services, and Rich Interfaces

• XML Signature
• XML Encryption
• XML Attacks: Structure
• XML Attacks: Injection
• Safe XML Processing

Lesson: Defending Web Services

• Web Service Security Exposures
• When Transport-Level Alone is NOT Enough
• Message-Level Security
• WS-Security Roadmap
• XWSS Provides Many Functions
• Web Service Attacks
• Web Service Appliance/Gateways

Lesson: Defending Rich Interfaces and REST

• How Attackers See Rich Interfaces
• Attack Surface Changes When Moving to Rich Interfaces
• Bridging and its Potential Problems
• Three Basic Tenets for Safe Rich Interfaces
• OWASP REST Security Recommendations

Session: Secure Development Lifecycle (SDL)

• Software Security Axioms
• Security Lifecycle – Phases

Lesson: Applying Processes and Practices

• Awareness
• Application Assessments
• Security Requirements
• Secure Development Practices
• Security Architecture/Design Review
• Security Code Review
• Configuration Management and Deployment
• Vulnerability Remediation Procedures

Lesson: Risk Analysis

• Threat Modeling Process
• Identify Security Objectives
• Describe the System
• List Assets
• Define System/Trust Boundaries
• List and Rank Threats
• List Defenses and Countermeasures

Session: Security Testing

• Security Testing Principles
• Black Box Analyzers
• Static Code Analyzers
• Criteria for Selecting Static Analyzers

Lesson: Testing Practices

• OWASP Web App Penetration Testing
• Authentication Testing
• Session Management Testing
• Data Validation Testing
• Denial of Service Testing
• Web Services Testing
• Ajax Testing

Frequently Asked Questions