EIEIOTECHNOVATION
← Training programmes

EIEIO / AUTOMATION & EMERGING TECHNOLOGY

ECSS- 3 Days

Course outline

3 days
Discuss this programme →

Duration

3 days

Course Description

EC-Council Certified Security Specialist (ECSS) allows students to enhance their skills in three different areas namely information security, network security, and computer forensics. Information security plays a vital role in most of the organizations. Information security is a state of affairs where information, information processing, and communication are protected against the confidentiality, integrity, and availability of information and information processing. In communications, information security also covers trustworthy authentication of messages that cover identification of the parties, verifying, and recording the approval and authorization of the information, non-alteration of the data, and the non-repudiation of the communication or stored data. Network security plays a vital role in most of the organizations. It is the process of preventing and detecting the unauthorized use of your computer. It protects the networks and their services from the unauthorized modification, destruction, or disclosure. Network security provides assurance that a network performs its critical functions correctly and there are no harmful side effects. Computer forensics is the process of detecting hacking attacks and properly extracting evidence to report the crime and conduct audits to prevent future attacks. Computer forensics is the application of computer investigation and analysis techniques in the interests of determining potential legal evidence. Evidence might be sought in a wide range of computer crime or misuse, including but not limited to theft of trade secrets, theft of or destruction of intellectual property, and fraud. Computer forensics enables the systematic and careful

Who should attend

This course will benefit the students who are interested in learning fundamentals of information security, network

security, and computer forensics.

Course outline

Information Security Fundamentals

Backdoors, Virus, and Worms

Introduction to the Linux Operating System

Password Cracking

Cryptography

Web Servers and Web Applications

Wireless Networks

Intrusion Detection System

Firewalls and Honeypots

Hacking Cycle

Introduction to Ethical Hacking

Networking Revisited

Secure Network Protocols

Authentication

Network Attacks

Bastion Hosts and DMZ

Proxy Servers

Virtual Private Network

Introduction to Wireless Network Security

Voice over Internet Protocol

Computer Forensics Fundamentals

Network and Router Forensics Fundamentals

Incident Response and Forensics

Digital Evidence

Understanding Windows, DOS, Linux, and Macintosh

Steganography

Analyzing Logs

E-mail Crime and Computer Forensics

Introduction to Writing Investigative Report

Computer Forensics as a Profession

Module 05 Error Handling and Logging

  • Exception and Error Handling
  • Example of an Exception
  • Handling Exceptions in Java
  • Exception Classes Hierarchy
  • Exceptions and Threats
  • Erroneous Exceptional Behaviors
  • Do’s and Don’ts in Exception Handling
  • Best Practices for Handling Exceptions in Java
  • Logging in Java
  • Example for Logging Exceptions
  • Logging Levels
  • Log4j and Java Logging API
  • Java Logging using Log4j
  • Vulnerabilities in Logging
  • Logging: Vulnerable Code and Secure Code
  • Secured Practices in Logging

Module 06 Authentication and Authorization

  • Percentage of Web Applications Containing Authentication Vulnerabilities
  • Percentage of Web Applications Containing Authorization Bypass Vulnerabilities
  • Introduction to Authentication
  • Java Container Authentication
  • Authentication Mechanism Implementation
  • Declarative v/s Programmatic Authentication
  • Declarative Security Implementation
  • Programmatic Security Implementation
  • Java EE Authentication Implementation Example
  • Basic Authentication
  • How to Implement Basic Authentication?
  • Form-Based Authentication
  • Form-Based Authentication Implementation
  • Implementing Kerberos Based Authentication
  • Secured Kerberos Implementation
  • Configuring Tomcat User Authentication Setup
  • Client Certificate Authentication in Apache Tomcat
  • Client Certificate Authentication
  • Certificate Generation with Keytool
  • Implementing Encryption and Certificates in Client Application
  • Authentication Weaknesses and Prevention
  • Introduction to Authorization
  • JEE Based Authorization
  • Access Control Model
  • Discretionary Access Control (DAC)
  • Mandatory Access Control (MAC)
  • Role-based Access Control (RBAC)
  • Servlet Container
  • Authorizing users by Servlets
  • Securing Java Web Applications
  • Session Management in Web Applications
  • EJB Authorization Controls
  • Common Mistakes

Module 07 Java Authentication and Authorization Service (JAAS)

Java Authentication and Authorization (JAAS)

JAAS Features

JAAS Architecture

Pluggable Authentication Module (PAM) Framework

JAAS Classes

JAAS Subject and Principal

Authentication in JAAS

Subject Methods doAs() and doAsPrivileged()

Impersonation in JAAS

JAAS Permissions

LoginContext in JAAS

JAAS Configuration

Locating JAAS Configuration File

JAAS CallbackHandler and Callbacks

Login to Standalone Application

JAAS Client

LoginModule Implementation in JAAS

Phases in Login Process

Java EE Application Architecture

Java EE Servers as Code Hosts

Tomcat Security Configuration

Best Practices for Securing Tomcat

Declaring Roles

HTTP Authentication Schemes

Securing EJBs

Module 08 Java Concurrency and Session Management

  • Percentage of Web Applications Containing a Session Management Vulnerability
  • Java Concurrency/ Multithreading
  • Concurrency in Java
  • Different States of a Thread
  • Java Memory Model: Communication between Memory of the Threads and the Main Memory
  • Creating a Thread
  • Thread Implementation Methods
  • Threads Pools with the Executor Framework
  • Concurrency Issues
  • Do not use Threads Directly
  • Avoid calling Thread.run() Method directly
  • Use ThreadPool instead of Thread Group
  • Use notify all() for Waiting Threads
  • Call await() and wait() methods within a Loop
  • Avoid using Thread.stop()
  • Gracefully Degrade Service using Thread Pools
  • Use Exception Handler in Thread Pool
  • Avoid Overriding Thread-Safe Methods with the non Thread- Safe Methods
  • Use this Reference with caution during Object Construction
  • Avoid using Background Threads while Class Initialization
  • Avoid Publishing Partially Initialized Objects
  • Race Condition
  • Secure and Insecure Race Condition Code
  • Deadlock
  • Avoid Synchronizing high level Concurrency Objects using Intrinsic Locks
  • Avoid Synchronizing Collection View if the program can access Backing Collection
  • Synchronize Access to Vulnerable Static fields prone to Modifications
  • Avoid using an Instance Lock to Protect Shared Static Data
  • Avoid multiple threads Request and Release Locks in Different Order
  • Release Actively held Locks in Exceptional Conditions
  • Ensure Programs do not Block Operations while Holding Lock
  • Use appropriate Double Checked Locking Idiom forms
  • Class Objects that are Returned by getClass() should not be Synchronized
  • Synchronize Classes with private final lock Objects that Interact with Untrusted Code
  • Objects that may be Reused should not be Synchronized
  • Be Cautious while using Classes on Client Side that do not Stick to their Locking Strategy
  • Deadlock Prevention Techniques
  • Secured Practices for Handling Threads
  • Session Management
  • Session Tracking
  • Session Tracking Methods
  • Types of Session Hijacking Attacks
  • Countermeasures for Session Hijacking
  • Countermeasures for Session ID Protection
  • Guidelines for Secured Session Management

Module 09 Java Cryptography

  • Percentage of Web Applications Containing Encryption Vulnerabilities
  • Need for Java Cryptography
  • Java Security with Cryptography
  • Java Cryptography Architecture (JCA)
  • Java Cryptography Extension (JCE)
  • Attack Scenario: Inadequate/Weak Encryption
  • Encryption: Symmetric and Asymmetric Key
  • Encryption/Decryption Implementation Methods
  • SecretKeys and KeyGenerator
  • The Cipher Class
  • Attack Scenario: Man-in-the-Middle Attack
  • Digital Signatures
  • The Signature Class
  • The SignedObjects
  • The SealedObjects
  • Insecure and Secure Code for Signed/Sealed Objects
  • Digital Signature Tool: DigiSigner
  • Secure Socket Layer (SSL)
  • Java Secure Socket Extension (JSSE)
  • SSL and Security
  • JSSE and HTTPS
  • Insecure HTTP Server Code
  • Secure HTTP Server Code
  • Attack Scenario: Poor Key Management
  • Keys and Certificates
  • Key Management System
  • KeyStore
  • Implementation Method of KeyStore Class
  • KeyStore: Temporary Data Stores
  • Secure Practices for Managing Temporary Data Stores
  • KeyStore: Persistent Data Stores
  • Key Management Tool: KeyTool
  • Digital Certificates
  • Certification Authorities
  • Signing Jars
  • Signing JAR Tool: Jarsigner
  • Signed Code Sources
  • Code Signing Tool: App Signing Tool
  • Java Cryptography Tool: JCrypTool
  • Java Cryptography Tools
  • Do’s and Don’ts in Java Cryptography
  • Best Practices for Java Cryptography

Module 10 Java Application Vulnerabilities

  • Average Number of Vulnerabilities Identified within a Web Application
  • Computers reporting Exploits each quarter in 2011, by Targeted Platform or Technology
  • Introduction to Java Application
  • Java Application Vulnerabilities
  • Cross-Site Scripting (XSS)
  • Cross Site Request Forgery (CSRF)
  • Directory Traversal
  • HTTP Response Splitting
  • Parameter Manipulation
  • XML Injection
  • SQL Injection
  • Command Injection
  • LDAP Injection
  • XPATH Injection
  • Injection Attacks Countermeasures

Programme scope, delivery arrangements and suitability are confirmed during enquiry.