Building Secure Applications

Although application security is a relative old subject, most of the focus in the 90’s was focused on securing the network infrastructure (e.g. firewalls, VPNs etc.), as well as the servers OS (e.g. patch management systems). However, in the last years focus has been shifted from the network and the infrastructure to the application layer. This is due to the fact that the infrastructure (i.e. network and OS) security has improved significantly while applications have remained vulnerable. Thus, the application layer has become the main target of attacks. In addition, it is well understood today, that secure applications means high-quality and more safe applications.
In the course we will learn the different aspects of application security including authentication, authorization, auditing, confidentiality, and data-integrity, as well as the different technologies addressing these requirements. We will study the risk analysis model and understand how to use it to analyze the risk of the threat associated with vulnerabilities in the application.
In addition, we will learn how to build secure applications, starting from including the security in the application development life cycle, continuing in secure coding practices, and security testing tools.