Duration
5 days
Introduction
- Web Application Environment and Components
- General Web Application Security Concepts
Module 2 Web, Windows and Mobile Application bases
Application Threat Modeling
- Threat Modeling Concepts
- Application Decomposition
- Identifying Attacks, Vulnerabilities & Countermeasures
- Threat Modeling Tools
Module 3 Applications Attacks and Exploits, XSS, SQL injection
Cross-Site Scripting (XSS)
- Reflected Cross-Site Scripting
- What an Attacker Can Accomplish
- Persistent Cross-Site Scripting
- Preventing Cross-Site Scripting Vulnerabilities
- Testing for Cross-Site Scripting Vulnerabilities
- Cross-Site Scripting Prevention Checklist
SQL Injection (SQLI)
- Exploiting a SQL Injection Vulnerability
- Blind SQL Injection Attacks
- Union-Based SQL Injection Attacks
- Second Order SQL Injection Vulnerabilities
- Direct Database Attacks
- Preventing SQL Injection Vulnerabilities
- Making Attacks More Difficult
- Identifying Existing Vulnerabilities in Your Code
Module 4 Servers Attacks and Exploits, DOS, BOF
Configuring security for HTTP services
- Managing software updates
- Restricting HTTP methods
Securing communication with SSL/TLS
- Obtaining and installing server certificates
- Enabling HTTPS on the web server
Module 5 Validation And Verification
Data Validation
- Understand the Business Logic for the Data You Accept
- Limit the Amount of Data You Are Willing to Accept
- Use a Whitelist to Sanitize Incoming Data
- Properly Handle Exceptions
- Reminder: The User Interface Can Always be Bypassed
- Working With Encoded Data
- Data Validation Checklist
Module 6 Security Controls and Countermeasures
Detecting unauthorized modification of content
- Configuring permissions correctly
- Scanning for file–system changes
Module 7 Mobile Application Secure Coding
Android Application Security Overview
- Types of Android Apps
- Introduction to Java
- Android Studio
Android Security Model
- Android Stack
- Rooting
- Google Store Review
- Application Permissions
- Possible Attack Surfaces
- Android Device Encryption
- Android Fingerprint API
- Authentication Callback Function
Module 8 Security Standards and Testing
Testing for Software Security
- Assets to be protected
- Threats Expected
- Security Imperatives (int&external)
- Organization's Risk Appetite
- Static Analysis
- Dynamic Analysis
- Risk-Based Security testing
- Fuzz Testing (Whitebox vs Blackbox)
- Penetration Testing (Whitebox vs Blackbox)
- Attack Surface Review
- Code audits
- Independent Security Review
Programme scope, delivery arrangements and suitability are confirmed during enquiry.