Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
1. IT security and secure coding
- Core Security Principles: Applying Confidentiality, Integrity, and Availability (CIA) within Java application contexts.
- Secure Software Development Lifecycle (SSDLC): Embedding security considerations from requirements gathering through to deployment.
- Secure Coding Methodologies: Implementing defense in depth, least privilege, and fail-safe defaults.
- Vulnerability Classification Standards: Gaining a clear understanding of CWE (Common Weakness Enumeration) and OWASP frameworks.
2. Web application security
- OWASP Top Ten In-Depth: Thorough examination of Injection, Broken Authentication, and Sensitive Data Exposure issues.
- Cross-Site Scripting (XSS): Handling Reflected, Stored, and DOM-based XSS scenarios in Java/JSP environments.
- Cross-Site Request Forgery (CSRF): Understanding attack mechanics and implementing Anti-CSRF token strategies.
- Session Management: Ensuring cookie security, preventing session fixation, and managing timeouts.
- API Security: Protecting REST and SOAP endpoints from unauthorized usage and abuse.
3. Security of Web services
- Web Services vs. Standard Web Apps: Differentiating the distinct attack surfaces.
- Transport Layer Security: Configuring SSL/TLS for Java clients and servers.
- Message Security: Ensuring integrity and confidentiality at the payload level.
- Authentication Protocols: Implementing OAuth 2.0, OpenID Connect, and JWT (JSON Web Tokens).
4. XML security
- XML Parsing Risks: Preventing XML External Entity (XXE) attacks.
- XML Schema Validation: Best practices for enforcing strict schema compliance.
- XML Digital Signatures: Implementing signatures to guarantee non-repudiation.
- XML Encryption: Standard methods for encrypting XML content.
5. Foundations of Java security
- The Java Security Framework: The
java.securitypackage and its provider architecture. - Security Providers: Installing and configuring providers such as Bouncy Castle.
- Access Control: Managing policy files, permissions, and the Security Manager (evolution from legacy to modern approaches).
- KeyStore Administration: Creating and managing keystores and truststores for certificate handling.
6. Practical cryptography
- Cryptographic Algorithms: Overview of Symmetric (AES), Asymmetric (RSA, ECC), and Hashing (SHA-256/512) methods.
- Random Number Generation: Understanding the risks of
java.util.Randomcompared tojava.security.SecureRandom. - Key Management: Strategies for key generation, storage, and rotation.
- Java Cryptography Architecture (JCA): Utilizing
Cipher,MessageDigest, andMacclasses. - Java Cryptography Extension (JCE): Navigating policy files and unlimited strength jurisdiction rules.
7. Java security services
- SSL/TLS in Java: Utilizing
SSLSocketFactoryandHttpsURLConnection. - Trust Managers: Customizing trust verification for private PKI environments.
- Authenticators: Performing programmatic authentication via
Authenticator.getDefault(). - Certificate Parsing: Programmatically reading and analyzing X.509 certificates.
8. Java EE security
- Declarative Security: Applying Role-based access control (RBAC) using
web.xmland annotations. - Programmatic Security: Leveraging
HttpServletRequest.isUserInRole()andgetRemoteUser(). - JAAS (Java Authentication and Authorization Service): Configuring
login.confand implementingLoginModules. - Servlet Security: Managing container security constraints and authentication methods (FORM, BASIC, DIGEST).
9. Common coding errors and vulnerabilities
- Insecure Deserialization: Addressing risks associated with
ObjectInputStreamand bypassing security checks. - Command Injection: Mitigating OS-level execution vulnerabilities.
- Path Traversal: Sanitizing file system inputs to block directory traversal.
- Reflection Abuse: Managing risks linked to
java.lang.reflectand access control bypasses. - Hardcoded Credentials: Identifying and eliminating secrets from source code.
- Cryptography Implementation Errors: Avoiding the use of ECB mode, weak keys, or static IVs.
10. Knowledge sources
- Static Analysis Tools: Employing SonarQube, Checkmarx, and Fortify for automated scanning.
- Dynamic Analysis Tools: Overview of Burp Suite and OWASP ZAP.
- CVE Databases: Tracking and responding to emerging Java framework vulnerabilities.
- Recommended Resources: A curated list of books, documentation, and secure coding checklists.
Requirements
No prior prerequisites are required.
21 Hours
Testimonials (4)
the knowledge of the trainer was very high - he knew what he was talking about, and knew the answers to our questions
Adam - Fireup.PRO
Course - Advanced Java Security
Practical exercises
Olek - Fireup.PRO
Course - Advanced Java Security
coding excercies
Mirek - Fireup.PRO
Course - Advanced Java Security
It opens up a lot and gives lots of insight what security
