SECURE WEB/API APPLICATION DEVELOPMENT
This course is designed to teach web application developers and architects how to build applications with
world-class security. QA engineers, IT security analysts, and IT risk managers can also benefit from this course.
Every major aspect of application security is covered, and each module includes both design and coding
advice. Hands-on labs are provided to help students master the concepts in a highly interactive setting. The
course focuses on application development strategies and tactics that secure software at the source.
Prerequisites
The course is contains coding examples in both Java and ASP.Net, but can be customized for any development
language. A working knowledge of HTML, JavaScript and any server-side programming language (ASP.Net, Java,
PHP, etc.) is recommended.
Security Principles Overview: Importance of Security in the Software Development Lifecycle
Regulations, Privacy and Compliance
Impact of Security Defects
Core Security Concepts
Security Design Principles
Information Disclosure Leakage in Web Technologies (HTML, HTTP, Files, Client-Side Objects, URLs,
Web Services)
Error Handling (Structured vs. Functional)
Google Hacking
Authentication Methods of Authentication
2-Factor Authentication
Single Sign-On
Common Authentication Attacks (Brute Force, Username Harvesting, etc.)
Implementing Secure Authentication – Design and Coding
Session Management Overview of Sessions
Threats to Sessions and Impact
Common Implementation Mistakes and Exploits (Interception, Prediction,
Brute Force, etc.)
Implementing Secure Sessions – Design and Coding
Authorization
and Access Control Methods of Access Control
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Rule-Based Access Control
Common Authorization Attacks (Parameter Tampering, Privilege Escalation,
Cross-Site Request Forgery, etc.)
Implementing Secure Authentication – Design and Coding
Secure Data Handling Overview of Data Handling
Integrity Validation
Data Validation
Business Rule Validation
Common Exploits (SQL Injection, Cross-Site Scripting, HTTP Response Splitting,
etc.)
Implementing Secure Data Handling – Design and Coding
Cryptography Hashing
Secure Password Storage
Symmetric and Asymmetric Encryption
Digital Signatures
Certificates
Key Distribution
SSL and Digital Certificates
Implementing Cryptography – Design and Coding
Logging Logging Overview
Threats and Considerations
Implementing Logging – Design and Coding
Web Service Security Simple Object Access Protocol (SOAP)
SOAP Related Protocols
Security Assertion Markup Language (SAML)
WS-Security
REpresentational State Transfer (REST)
REST Related Protocols
JSON vs XML
Implementing Secure Web Services – Design and Coding
Secure Application
Development Software Development Life Cycle (SDLC)
Threat Modeling
Application Risk Levels
Risk Assessment
STRIDE and DREAD
Severity Level Classifications
Web Application Security Tools
Web Application Security Resources
API SECURITY
This course is designed to teach web application developers and architects how to build applications with
world-class security. QA engineers, IT security analysts, and IT risk managers can also benefit from this course.
Every major aspect of application programming interface security is covered, and each module includes both
design and coding advice.
Prerequisites
The course is contains coding examples in both Java and ASP.Net, but can be customized for any development
language. A working knowledge of HTML, JavaScript and any server-side programming language (ASP.Net, Java,
PHP, etc.) is recommended.
Module 1: Managed APIs
Module 2: Security by Design
Module 3: HTTP Basic/Digest Authentication
Module 4: Mutual Athentication with TLS
Module 5: Identity Delegation
Module 6: OAuth 2.0
Module 7: OAuth 2.0 MAC Token Profile
Module 8: OAuth 2.0 Profiles
Module 10: User Managed Access
Module 11: Federation
Module 12: OpenID Connect
Module 13: JWT, JWS and JWE
Module 14: Patterns and Practices
