Even seasoned developers often fail to fully leverage the security services available within their development platforms or remain unaware of the specific vulnerabilities that threaten their projects. This course is tailored for developers working with both Java and PHP, equipping them with the critical skills needed to fortify their applications against modern internet-based threats.
The curriculum delves into the layers of Java security architecture, covering access control, authentication, authorization, secure communication protocols, and various cryptographic functions. It also introduces key APIs for enhancing PHP security, such as OpenSSL for cryptographic operations and HTML Purifier for input validation. On the server side, best practices for hardening and configuring the operating system, web containers, file systems, SQL servers, and the PHP environment itself are provided. Special attention is given to client-side security, addressing security challenges associated with JavaScript, Ajax, and HTML5.
Common web vulnerabilities are explored through examples aligned with the OWASP Top Ten, illustrating various injection attacks, script injections, session handling flaws, insecure direct object references, file upload issues, and more. The course addresses language-specific problems in Java and PHP, as well as issues arising from the runtime environment, categorizing them into standard vulnerability types such as missing or improper input validation, misused security features, incorrect error and exception handling, time- and state-related problems, code quality deficiencies, and mobile code vulnerabilities.
Participants will have the opportunity to experiment with the discussed APIs, tools, and configuration effects. Each vulnerability introduction is supported by hands-on exercises that demonstrate the impact of successful attacks, show how to fix bugs, apply mitigation techniques, and introduce the use of various extensions and tools.
Participants attending this course will
- Grasp fundamental concepts of security, IT security, and secure coding practices
- Understand web vulnerabilities beyond the OWASP Top Ten and learn how to prevent them
- Identify client-side vulnerabilities and adopt secure coding practices
- Utilize the security features inherent in the Java development environment
- Develop a practical understanding of cryptography
- Apply various security features available in PHP
- Comprehend the security concepts underlying Web services
- Gain practical experience with security testing tools
- Recognize typical coding mistakes and learn how to avoid them
- Stay informed about recent vulnerabilities in Java and PHP frameworks and libraries
- Access resources and further reading materials on secure coding practices
Audience
Developers
Read more...
