Building a secure networked application can be challenging, even for developers who have previously utilized various cryptographic building blocks, such as encryption and digital signatures. To help participants grasp the role and application of these cryptographic primitives, this course first establishes a solid foundation in the core requirements of secure communication: secure acknowledgment, integrity, confidentiality, remote identification, and anonymity. It also addresses common issues that can compromise these requirements and presents real-world solutions.
Given that cryptography is a critical component of network security, the course covers essential cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. Rather than focusing on in-depth mathematical theory, these concepts are explored from a developer's perspective, featuring typical use-case examples and practical considerations such as public key infrastructures. Additionally, the course introduces security protocols used across various domains of secure communication, with a detailed discussion on widely adopted protocol families like IPSEC and SSL/TLS.
Common cryptographic vulnerabilities are examined, both concerning specific algorithms and protocols. Examples include BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and others, as well as the RSA timing attack. For each issue, the course outlines practical considerations and potential consequences without delving into complex mathematical details.
Finally, since XML technology is central to data exchange for networked applications, the course describes the security aspects of XML. This covers the use of XML in web services and SOAP messages, along with protection measures such as XML Signature and XML Encryption. It also addresses weaknesses in these protections and XML-specific security issues, including XML injection, XML External Entity (XXE) attacks, XML bombs, and XPath injection.
Participants attending this course will
- Grasp the fundamental concepts of security, IT security, and secure coding
- Understand the requirements for secure communication
- Learn about network attacks and defenses across different OSI layers
- Gain a practical understanding of cryptography
- Comprehend essential security protocols
- Understand recent attacks targeting cryptosystems
- Receive information on recent related vulnerabilities
- Understand the security concepts of web services
- Access resources and further readings on secure coding practices
Audience
Developers, Professionals
Read more...
