Web Application Security
Start Date: Please contact us
Course Overview
Most of the focus when dealing with security has been on securing the network infrastructure and the server OS. However, during the last few years the focus has shifted to the application layer. This is because infrastructure (network and OS) security has improved significantly while applications have remained vulnerable. The application layer has become the main target of attack. This is particularly true for web applications which are more vulnerable.
The course discusses how application aspects such as authentication, confidentiality and data integrity apply to web applications. In addition, participants will learn in depth what web application vulnerabilities are, what causes them, how to prevent them from design/coding and testing perspectives and what countermeasure are required to prevent exploitation of these vulnerabilities.
Who should attend?
Web application developers, web software system engineers, web development engineers, web system architects and information security expertsPrerequisite:
Since web applications are based on HTTP, HTML and JavaScript, the following is recommended:
– A general understanding of HTTP, the request-response concept, HTTP headers, HTTP cookies.
– Understanding HTML.
– Understanding JavaScript.
The relevant terms are presented in the course, but prior knowledge will help the participant. Also prior knowledge on web application architecture and the web infrastructure will help.
Course 4402, building secure applications, will also be of help.
Course Outline:
1. Introduction
• The unique security aspects and challenges of web applications
• Application layer logical vulnerabilities
• Application layer DoS and DDoS
2. Confidentiality and data integrity
• Encryption and hashing
• SSL
3. HTTP Authentication and session management attacks and mitigation
• HTTP basic and digest authentication
• Certificate based authentication
• Application layer authentication
• Web session management mechanisms
• Session hijacking
• Cookie poisoning
4. Non-validated input and related attacks
• Direct object reference vulnerability and mitigation
• Input validation methodology
• Evasion techniques
5. Injection attacks and mitigation
• SQL injection attack description and examples
• SQL injection evasion techniques
• Command (OS) injection
• LDAP Injection
• Buffer overflow
• Reflected XSS
• Stored XSS
• DOM based XSS
• XSS evasion techniques
• XSS mitigation countermeasures7. Cross site request forgery and mitigation
• CSRF (XSRF) attack description
• ISRF attack description
• CSRF/ISRF mitigation countermeasures8. Regulations and web application security
• OpenID
• OAuth
• SAML
• XCAML
• Web application single sign on (SSO) and OpenID
9. Security of AJAX based web applications
10. Summary
