Experienced programmers do not always fully master the security features available in their development platforms, nor are they always aware of the vulnerabilities relevant to their specific projects. This course is designed for developers working with both Java and PHP, equipping them with the essential skills needed to make their applications resilient against modern internet threats.
The course explores the layers of the Java security architecture by addressing access control, authentication, authorization, secure communication, and various cryptographic functions. It also introduces several APIs available in PHP to help secure code, such as OpenSSL for cryptographic purposes and HTML Purifier for input validation. On the server side, it outlines best practices for hardening and configuring the operating system, web containers, file systems, SQL servers, and PHP itself, while placing special emphasis on client-side security issues related to JavaScript, Ajax, and HTML5.
General web vulnerabilities are discussed through examples aligned with the OWASP Top Ten, covering various injection attacks, script injections, session handling attacks, insecure direct object references, file upload issues, and more. The course also introduces Java- and PHP-specific language problems and issues arising from the runtime environment, categorized into standard vulnerability types such as missing or improper input validation, incorrect use of security features, flawed error and exception handling, time- and state-related problems, code quality issues, and mobile code-related vulnerabilities.
Participants have the opportunity to experiment with the discussed APIs, tools, and configuration effects. The introduction of vulnerabilities is supported by numerous hands-on exercises that demonstrate the consequences of successful attacks, show how to correct bugs, apply mitigation techniques, and introduce the use of various extensions and tools.
Participants attending this course will
- Understand the fundamental concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and know how to avoid them
- Understand client-side vulnerabilities and secure coding practices
- Learn to utilize various security features within the Java development environment
- Gain a practical understanding of cryptography
- Learn to use various security features of PHP
- Understand the security concepts of Web services
- Acquire practical knowledge in using security testing tools
- Learn about typical coding mistakes and how to avoid them
- Be informed about recent vulnerabilities in Java and PHP frameworks and libraries
- Receive resources and further readings on secure coding practices
Audience
Developers
Read more...
