Duration
6 days
Overview
Web Applications are increasingly distributed. What used to be a complex monolithic application hosted on premise has become a distributed set of services incorporating on-premise legacy applications along with interfaces to cloud-hosted and cloud-native components. Because of this coupled with a lack of security knowledge, web applications are exposing sensitive corporate data. Security professionals are asked to provide validated and scalable solutions to secure this content in line with best industry practices using modern web application frameworks. Attending this class will not only raise awareness about common security flaws in modern web applications, but it will also teach students how to recognize and mitigate these flaws early and efficiently. 20 Hands-On Labs + Defend the Flag Game in Section 6.
You Will Be Able To
- Defend against the attacks specified in OWASP Top 10
- Infrastructure security and configuration management
- Securely integrating cloud components into a web application
- Authentication and authorization mechanisms, including single sign-on patterns
- Cross-domain web request security
- Protective HTTP headers
- Defending SOAP, REST and GraphQL APIs
- Securely implement Microservice architecture
- Defending against input related flaws such as SQL injection, XSS and CSRF
Who Should Attend
- Application developers
- Application security analysts or managers
- Application architects
- Penetration testers who are interested in learning about defensive strategies
- Security professionals who are interested in learning about web application security
- Auditors who need to understand defensive mechanisms in web applications
- Employees of PCI-compliant organizations who need to be trained to comply with those requirements
SECTION 1: Web Fundamentals and Security Configurations
The first section of the course will set the stage for the course with the fundamentals of web applications such as the HTTP protocol and the various mechanisms that make web applications work. We then transition over to the architecture of the web applications which plays a big role in securing the application.
TOPICS: Introduction to HTTP Protocol; Overview of Web Authentication Technologies; Web Application Architecture; Recent Attack Trends; Web Infrastructure Security/Web Application Firewalls; Managing Configurations for Web Apps
Section 2 is devoted to protecting against threats arising from external input. Modern applications have to accept input from multiple sources, such as other applications, browsers, and web services. The basic mechanics of the common input related attacks are covered, followed by real-world examples and defense patterns that work in large applications. Input related flaws take up multiple places in the OWASP Top 10 list, the coverage of these input related topics forms a great defense foundations against these common risks.
TOPICS: Input-related Vulnerabilities in Web Applications; SQL Injection; Cross-site Request Forgery; Cross-site Scripting Vulnerability and Defenses; Unicode Handling Strategy; File Upload Handling; Business Logic and Concurrency
Section 3 starts with a discussion of authentication and authorization in web applications, followed by examples of exploitation and the mitigations that can be implemented in the short and long terms. Considering the trend to move towards less reliance on passwords for authentication, we cover the modern patterns of password-less authentication and multifactor authentications.
TOPICS: Authentication Vulnerabilities and Defense; Multifactor Authentication; Session Vulnerabilities and Testing; Authorization Vulnerabilities and Defense; SSL Vulnerabilities and Testing; Proper Encryption Use in Web Application
SECTION 4: Web Services and Front-End Security
In this section, we start with covering the concepts of Web services and specifically SOAP based web services. Then we pivot the focus to the front end usage of JavaScript with the related security implications such as CORS (Cross Domain Requests). We will cover security issues, mitigation strategies, and general best practices for implementing AJAX based Web applications. We will also examine real-world attacks and trends to give you a better understanding of exactly what you are protecting against. We end the day with multiple client-side, header-based defense mechanisms such as Content Security Policy to help you further secure your applications. We go in-depth into how these headers can uplift the security level of an application, but we’ll also look at the potential downfall of these mechanisms.
TOPICS: Web services overview; XML Security; AJAX Attack Trends and Defenses; Modern JavaScript Frameworks; Browser Features and Defenses; Browser-Based Defense such as Content Security Policy
SECTION 5: APIs and Microservices
The section starts off with the topic of deserialization security issue which is quickly rising to be a common attack amongst modern applications. We also cover the topic of DNS rebinding which lingers in the application world since practically the beginning of web applications. The focus then shift over to REST API and GraphQL API based Web services and APIs where these technologies exist in every modern applications and have lots of potential security pitfalls. We then extend the discussion into microservices architecture and the security implications of this modern architecture. Across all these technology topics we cover the common attacks and the current best practices in keeping them secure. The day ends with three process centric topics of operational security, security testing, and logging.
TOPICS: Deserialization; REST Security; GraphQL Security; Microservices; Operational Security; Security Testing; Logging and Error Handling
SECTION 6: DevSecOps and Defending the Flag
We start this section by introducing the concept of DevSecOps and how to apply it to web development and operations in enterprise environment. The main activity of this section will be a lab experience that will tie together the lessons learned during the entire course and reinforce them with hands-on implementation. Students will then have to decide which vulnerabilities are real and which are false positives, then mitigate the vulnerabilities. Students will learn through these hands-on exercises how to secure the web application, starting with securing the operating system and the web server, finding configuration problems in the application language setup, and finding and fixing coding problems on the site.
TOPICS: DevSecOps
Programme scope, delivery arrangements and suitability are confirmed during enquiry.