Writing Secure Java Code – SS202

This technical course covers a wide range of application security topics related to Java applications. During this hands-on course, students will examine actual Java code, tools, and other resources that help them understand how hackers think, the techniques they use to attack their applications and the best countermeasures they can use to mitigate the risk of those attacks.

Target Audience § Java Software Developers § Technical Leads § Software Architect

Course Requirements & Prerequisites § Application Security Fundamentals – SS101 § Intermediate to expert understanding of the web as well as the HTTP protocol. § Intermediate to expert experience with web development technologies such as HTML, CSS, JavaScript, SQL, etc § Students are required to bring their own laptops with a minimum of 4 GB RAM installed. § VMware Workstation / Fusion / VirtualBox installed. § At least 60 GB HD free § Wired Network Support § USB 2.0/3.0 Support

Writing Secure Java Code SS-202

“This was a great class! The instructor is quite knowledgeable and makes the classes fun and informative. He is open to questions and tries to answer every one of them. Sherif is a joy!”

Keith Cooper – Elavon 2 Days Course

Writing Secure Java Code – SS202

Course Contents § Introduction § Attacking & Securing Data Storages:

o SQL Injection o XML Injection o XPath Injection o Parameterization o Secure Stored Proc Usage

§ Attacking & Securing OS Calls o Path manipulation o Secure File Upload o Command Injection o Secure OS system calls

§ Attacking & Securing User Input o The 6 contexts of cross-site scripting o Whitelisting vs. blacklisting o Using RegEx in Java

§ Attacking & Securing Authentication and Authorization o Designing secure authentication process o Designing secure authorization process o Using Spring security to secure authentication and authorization

§ Attacking & securing the software security supply chain § Exploiting & preventing cross-site request forgery using the synchronizer pattern § Attacking & securing direct object reference using indirect reference maps § Implementing secure cryptography § Securing the transport layer § Exception management and error handling § Securing redirect and forwards § Overview of a secure software development lifecycle. § Quick overview of effective security code review techniques. § Conclusion and closeout remarks