Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
1. IT security and secure coding
- Fundamental Security Principles: Applying Confidentiality, Integrity, and Availability (CIA) within the context of Java applications.
- Secure Software Development Lifecycle (SSDLC): Integrating security measures from the requirements phase through to deployment.
- Secure Coding Paradigms: Implementing defense in depth, the principle of least privilege, and fail-safe defaults.
- Standard Vulnerability Classifications: Understanding frameworks such as CWE (Common Weakness Enumeration) and OWASP.
2. Web application security
- Deep Dive into OWASP Top Ten: A detailed analysis of Injection, Broken Authentication, and Sensitive Data Exposure.
- Cross-Site Scripting (XSS): Examining Reflected, Stored, and DOM-based XSS scenarios in Java/JSP environments.
- Cross-Site Request Forgery (CSRF): Understanding attack mechanisms and implementing Anti-CSRF tokens.
- Session Management: Addressing cookie security, session fixation risks, and timeout management.
- API Security: Protecting REST and SOAP endpoints from unauthorized abuse.
3. Security of Web services
- Web Services vs. Traditional Web Apps: Analyzing the differences in potential attack surfaces.
- Transport Layer Security: Configuring SSL/TLS for Java clients and servers.
- Message Security: Ensuring integrity and confidentiality at the payload level.
- Authentication Standards: Implementing OAuth 2.0, OpenID Connect, and JWT (JSON Web Tokens).
4. XML security
- XML Parsing Vulnerabilities: Strategies for preventing XML External Entity (XXE) attacks.
- XML Schema Validation: Best practices for enforcing strict schema validation.
- XML Digital Signatures: Implementing signatures to ensure non-repudiation.
- XML Encryption: Standard methodologies for encrypting XML content.
5. Foundations of Java security
- The Java Security Architecture: Overview of the
java.securitypackage and the provider architecture. - Security Providers: Procedures for installing and configuring providers such as Bouncy Castle.
- Access Control: Managing policy files, permissions, and the Security Manager (comparing legacy and modern approaches).
- KeyStore Management: Techniques for creating and managing keystores and truststores for certificates.
6. Practical cryptography
- Cryptographic Algorithms: An overview of Symmetric (AES), Asymmetric (RSA, ECC), and Hashing (SHA-256/512) algorithms.
- Random Number Generation: Comparing the security risks of
java.util.Randomagainstjava.security.SecureRandom. - Key Management: Strategies for key generation, secure storage, and rotation.
- Java Cryptography Architecture (JCA): Utilizing
Cipher,MessageDigest, andMacclasses. - Java Cryptography Extension (JCE): Understanding policy files and unlimited strength jurisdiction requirements.
7. Java security services
- SSL/TLS in Java: Implementing secure connections using
SSLSocketFactoryandHttpsURLConnection. - Trust Managers: Customizing trust verification for private PKI environments.
- Authenticators: Performing programmatic authentication using
Authenticator.getDefault(). - Certificate Parsing: Techniques for reading and analyzing X.509 certificates programmatically.
8. Java EE security
- Declarative Security: Implementing role-based access control (RBAC) via
web.xmland annotations. - Programmatic Security: Utilizing
HttpServletRequest.isUserInRole()andgetRemoteUser()for runtime checks. - JAAS (Java Authentication and Authorization Service): Configuring
login.confand implementingLoginModules. - Servlet Security: Managing container-level security constraints and authentication methods (FORM, BASIC, DIGEST).
9. Common coding errors and vulnerabilities
- Insecure Deserialization: Analyzing the risks associated with
ObjectInputStreamand bypassing security checks. - Command Injection: Strategies for mitigating OS-level execution vulnerabilities.
- Path Traversal: Sanitizing file system inputs to prevent directory traversal attacks.
- Reflection Abuse: Assessing risks related to
java.lang.reflectand potential bypasses of access control. - Hardcoded Credentials: Methods for identifying and removing secrets from source code.
- Cryptography Implementation Errors: Avoiding the use of ECB mode, weak keys, or static IVs.
10. Knowledge sources
- Static Analysis Tools: Leveraging SonarQube, Checkmarx, and Fortify for automated code scanning.
- Dynamic Analysis Tools: An overview of Burp Suite and OWASP ZAP for runtime testing.
- CVE Databases: Methods for tracking and responding to new Java framework vulnerabilities.
- Recommended Readings: A curated list of books, documentation, and secure coding checklists.
Requirements
None.
Testimonials (4)
the knowledge of the trainer was very high - he knew what he was talking about, and knew the answers to our questions
Adam - Fireup.PRO
Course - Advanced Java Security
Practical exercises
Olek - Fireup.PRO
Course - Advanced Java Security
coding excercies
Mirek - Fireup.PRO
Course - Advanced Java Security
It opens up a lot and gives lots of insight what security
