Course Summary
Throughout the course, we highlight the risks associated with web applications and the potential for sensitive data to be exposed or compromised. We then provide real-world solutions to mitigate these risks and guide students on how to evaluate and communicate residual risks effectively.
Upon completing the course, students will be able to quickly apply the knowledge gained, bringing back practical techniques to enhance the security of their applications. They will also learn to implement security early in the software development lifecycle, “shifting left” on security decisions and testing, ultimately saving time, money, and resources for the organization.
Key Topics Covered:
Access Control, AJAX Technologies, and Security Strategies
Security Testing and Authentication
Cross-Origin Policy Attacks and Mitigation, CSRF, Encryption, and Protecting Sensitive Data
File Uploads, Response Readiness, Proactive Defense, and Input Validation
Modern Application Framework Issues and Serialization
Session Security, Business Logic, and Web Application Basics
HTTP Basics, Web Architecture, Configuration, and Security
Access Control
The candidate will demonstrate an understanding of access control vulnerabilities and mitigation strategies, applying best practices to prevent access control issues.
AJAX Technologies and Security Strategies
The candidate will show a comprehensive understanding of Asynchronous JavaScript and XML (AJAX) architecture, common attacks targeting AJAX technologies, and the best practices for securing AJAX-based applications.
Authentication
The candidate will demonstrate an understanding of web authentication, single sign-on methods, third-party session sharing, and common weaknesses, along with how to develop testing strategies and implement best practices.
Cross-Origin Policy Attacks and Mitigation
The candidate will show knowledge of how attackers circumvent the same-origin policy and apply best practices for preventing, detecting, and mitigating these attacks in web applications.
CSRF (Cross-Site Request Forgery)
The candidate will demonstrate an understanding of the conditions that make CSRF attacks possible, the steps an attacker takes, and how to effectively mitigate these types of attacks.
Encryption and Protecting Sensitive Data
The candidate will demonstrate knowledge of cryptographic components used to protect data in transit and at rest, and when to use encryption or tokenization to secure sensitive information.
File Upload, Response Readiness, and Proactive Defense
The candidate will show understanding of incident response, file upload security, logging, and anti-automation measures.
Input-Related Flaws and Input Validation
The candidate will demonstrate an understanding of input-related vulnerabilities, such as SQL injection, Cross-Site Scripting (XSS), and HTTP Response Splitting, and how to prevent them using proper input validation techniques.
Leading Edge Technologies and Web Security
The candidate will demonstrate awareness of emerging web application security issues and technologies.
Modern Application Framework Issues and Serialization
The candidate will show an understanding of security concerns related to modern web application frameworks, including REST, Java frameworks, serialization, and browser defense techniques.
Security Testing
The candidate will demonstrate the ability to detect, respond to incidents, and conduct effective security testing in a web application environment.
Session Security and Business Logic
The candidate will demonstrate an understanding of session security, how to test and mitigate common session weaknesses, and the proper implementation of session tokens and cookies, along with security concerns related to business logic.
Web Application and HTTP Basics
The candidate will demonstrate knowledge of the fundamental components of web applications, how these components interact to deliver HTTP content, and general attack trends affecting web applications.
Web Architecture and Configuration
The candidate will show an understanding of web application architecture and the security controls required to secure the servers and services hosting web applications.
Web Services Security
The candidate will demonstrate an understanding of Service-Oriented Architecture (SOA), common attacks against web services components (SOAP, XML, WSDL), and best practices for securing web services.
Other Popular Courses
CompTIA: SecurityX
- Duration: 5 Days
- Language: English
- Level: Advanced
- Exam: CAS-005
Executive Cyber Risk Certification (ECRC)
- Duration: 2 Days
- Language: English
- Level: Advanced
- Exam: ECRC
Mastering Communication & Presentation Te...
- Duration: 5 Days
- Language: Danish
- Level: Intermediate
- Exam: MCPT