Web application security masterclass in Java (WASECM-J) – Outline

Detailed Course Outline

Day 1

  • Cyber security basics
    • What is security?
    • Threat and risk
    • Cyber security threat types – the CIA triad
    • Consequences of insecure software
    • Constraints and the market
  • The OWASP Top Ten 2021
    • The OWASP Top 10 2021
    • A01 - Broken Access Control
      • Access control basics
      • Failure to restrict URL access
      • Confused deputy
      • File upload
      • Open redirects and forwards
      • Cross-site Request Forgery (CSRF)
    • A02 - Cryptographic Failures
      • Information exposure
      • Cryptography for developers

Day 2

  • A02 - Cryptographic Failures (continued)
    • Cryptography for developers
    • Certificates
  • A03 - Injection
    • Injection principles
    • Injection attacks
    • SQL injection
    • Code injection
    • HTML injection - Cross-site scripting (XSS)

Day 3

  • A03 - Injection (continued)
    • Input validation
  • A04 - Insecure Design
    • The STRIDE model of threats
    • Secure design principles of Saltzer and Schroeder
    • Client-side security

Day 4

  • A05 - Security Misconfiguration
    • Configuration principles
    • Server misconfiguration
    • Cookie security
    • XML entities
  • A06 - Vulnerable and Outdated Components
    • Using vulnerable components
    • Assessing the environment
    • Hardening
    • Untrusted functionality import
    • Vulnerability management
  • A07 - Identification and Authentication Failures
    • Authentication
    • Session management
    • Password management
  • A08 - Software and Data Integrity Failures
    • Integrity protection

Day 5

  • A08 - Software and Data Integrity Failures (continued)
    • Subresource integrity
    • Insecure deserialization
  • A09 - Security Logging and Monitoring Failures
    • Logging and monitoring principles
    • Insufficient logging
    • Case study – Plaintext passwords at Facebook
    • Log forging
    • Log forging – best practices
    • Case study – Log interpolation in log4j
    • Case study – The Log4Shell vulnerability (CVE-2021-44228)
    • Case study – Log4Shell follow-ups (CVE-2021-45046, CVE-2021-45105)
    • Lab – Log4Shell
    • Logging best practices
    • Monitoring best practices
  • A10 - Server-side Request Forgery (SSRF)
    • Server-side Request Forgery (SSRF)
    • Case study – SSRF and the Capital One breach
  • Web application security beyond the Top Ten
    • Code quality
    • Denial of service
  • Security testing
    • Security testing techniques and tools
      • Code analysis
      • Dynamic analysis
  • Wrap up
    • Secure coding principles
    • And now what?