Even experienced programmers do not necessarily master all the security features offered by their development platforms, nor are they always aware of the various vulnerabilities relevant to their work. This course is designed for developers working with both Java and PHP, equipping them with essential skills to make their applications resilient against modern Internet-based attacks.
The course explores the layers of the Java security architecture, covering access control, authentication, authorisation, secure communication, and a range of cryptographic functions. It also introduces various APIs that can be used to secure PHP code, such as OpenSSL for cryptography and HTML Purifier for input validation. On the server side, best practices are provided for hardening and configuring the operating system, web container, file system, SQL server, and PHP itself. Special emphasis is placed on client-side security, addressing security issues related to JavaScript, Ajax, and HTML5.
General web vulnerabilities are examined through examples aligned with the OWASP Top Ten, illustrating various injection attacks, script injections, session handling attacks, insecure direct object references, file upload issues, and more. The course also covers language-specific problems and runtime environment issues in both Java and PHP, grouped into standard vulnerability categories such as missing or improper input validation, incorrect use of security features, flawed error and exception handling, time- and state-related problems, code quality issues, and mobile code-related vulnerabilities.
Participants will have the opportunity to experiment with the discussed APIs, tools, and configuration effects firsthand. Each vulnerability introduction is supported by hands-on exercises that demonstrate the consequences of successful attacks, guide learners on how to fix the bugs, apply mitigation techniques, and make use of various extensions and tools.
Participants attending this course will
- Understand fundamental concepts of security, IT security, and secure coding
- Learn about web vulnerabilities beyond the OWASP Top Ten and how to avoid them
- Gain knowledge of client-side vulnerabilities and secure coding practices
- Learn how to utilise various security features within the Java development environment
- Develop a practical understanding of cryptography
- Learn how to apply various security features in PHP
- Understand security concepts related to web services
- Gain practical experience using security testing tools
- Learn about common coding mistakes and how to avoid them
- Stay informed about recent vulnerabilities in Java and PHP frameworks and libraries
- Access resources and further reading materials on secure coding practices
Audience
Developers
Read more...
