SECURE JEE WEB APPLICATION DEVELOPMENT (TT8120-JEE)

1. Foundation

• Misconceptions
  • Thriving Industry of Identify Theft
  • Dishonor Roll of Data Breaches
  • TJX: Anatomy of a Disaster
  • Heartland: What? Again?
• Security Concepts
  • Terminology and Players
  • Assets, Threats, and Attacks
  • OWASP
  • CWE/SANS Top 25 Programming Errors
  • Categories
  • What They Mean to Your Services
• Defensive Coding Principles
  • Security Is a Lifecycle Issue
  • Minimize Attack Surface
  • Manage Resources
  • Application States
  • Compartmentalize
  • Defense in Depth Layered Defense
  • Consider All Application States
  • Not Trusting the Untrusted
  • Security Defect Mitigation
  • Leverage Experience
• Reality
  • Recent, Relevant Incidents
  • Find Security Defects in Web Application

2. Top Security Vulnerabilities

• Unvalidated Input
  • Description with Working Example
  • Defenses
  • Identifying Trust Boundaries
  • Qualifying Untrusted Data
  • Implementing an Effect, Layered Defense
  • Designing an Appropriate Response
  • Testing Defenses and Responses
• Overview of Regular Expressions
  • Description with Working Example
• Broken Access Control
  • Description with Working Example
  • Defenses
  • Authorization Security Overview
  • Defending Special Privileges such as Administrative Functions
  • Application Authorization Best Practice
• Broken Authentication And Session Management
  • Description with Working Example
  • Defenses
  • Multi-Layered Defenses of Authentication Services
  • Password Management Strategies
  • Password Handling with Hashing
  • Mitigating Password Caching
  • Testing Defenses and Responses for Weaknesses
  • Alternative Authentication Mechanisms
  • Best Practices for Session Management
  • Defending Session Hijacking Attacks
  • Best Practices for Single Sign-On (SSO)
• Cross-Site Scripting (XSS) Flaws
  • Description with Working Example
  • Defenses
  • Character Encoding Complications
  • Blacklisting
  • Whitelisting
  • HTML/XML Entity Encoding
  • Trust Boundary Definition
  • Implementing an Effective Layered Defense
  • Designing an Appropriate Response
  • Cross-Site Request Forgeries (CSRF)
  • Understanding CSRF
  • Defending Against CSRF
  • Output Encoding Why
  • Output Encoding How
  • Output Encoding Best Practices
• Injection Flaws
  • Description with Working Example
  • Defenses
  • Qualifying Untrusted Data
  • Hibernate Best Practices
  • XML Best Practices
  • Third-Party APIs
  • Implementing an Effective Layered Defense
  • Designing an Appropriate Response
• Error Handling and Information Leakage
  • Description with Working Example
  • Defenses
  • Web Application Exception Handling Framework
  • Error Response Best Practices
  • Error, Auditing, and Logging Content Management
  • Error, Auditing, and Logging Service Management
  • Best Practices for Supporting Web Attack Forensics
• Insecure Storage
  • Description with Working Example
  • Defenses
  • Data Leakage
  • Risk Minimization
  • Cryptography Overview
  • Data Encryption
  • Partial/Complete
  • Property/Deployment/Configuration Files
• Insecure Management Of Configuration
  • Description with Working Example
  • Defenses
  • System Hardening
  • Server Configuration "Gotchas!"
  • Hardening Software Installation
• Direct Object Access
  • Description with Working Example
  • Defenses
  • XML/DTD/Schema/XSLT Best Practices
• Spoofing
  • Description with Working Example
  • Defenses
  • Protecting Your Clients
  • Defending Against Cross-Site Request Forgeries
  • Phishing Defenses

3. Best Practices

• Defensive Coding Principles Revisited
• Java Best Practices
  • Code Obfuscation
  • JAAS Usage
  • Java 2 Security and Policy Files
  • Signing JAR Files

4. Defending XML Processing

• Defending XML
  • Understanding Common Attacks and How to Defend
  • Operating in Safe Mode
  • Using Standards-Based Security
  • XML-Aware Security Infrastructure
• Defending Web Services
  • Security Exposures
  • Transport-Level Security
  • Message-Level Security
  • WS-Security
  • Attacks and Defenses
• Defending Ajax
  • Ajax Security Exposures
  • Attack Surface Changes
  • Injection Threats and Concerns
  • Effective Defenses and Practices

5. Secure Software Development (SSD)

• SSD Process Overview
  • CLASP Define
  • CLASP Applied
• Asset, Boundary, and Vulnerability Identification
• Vulnerability Response
• Design and Code Reviews
• Applying Processes and Practices
• Risk Analysis

6. Security Testing

• Testing as Lifecycle Process
• Testing Planning and Documentation
• Testing Tools and Processes
  • Principles
  • Reviews
  • Testing
  • Tools
• Static and Dynamic Code Analysis
• Testing Practices
  • Authentication Testing
  • Session Management Testing
  • Data Validation Testing
  • Denial of Service Testing
  • Web Services Testing
  • Ajax Testing

Appendix: Security Design Patterns

• Design Patterns Introduction
• JEE Web Application Security Design Patterns
  • Authentication Enforcer
  • Authorization Enforcer
  • Intercepting Validator
  • Secure Base Action
  • Secure Logger
  • Secure Pipe
  • Secure Service Proxy
  • Intercepting Web Agent

• Potential sources for untrusted data
• Consequences for not properly handling untrusted data such as denial of service, cross-site scripting, and injections
• Test web applications with various attack techniques to determine the existence of and effectiveness of layered defenses
• Prevent and defend the many potential vulnerabilities associated with untrusted data
• Vulnerabilities associated with authentication and authorization
• Detect, attack, and implement defenses for authentication and authorization functionality and services
• Dangers and mechanisms behind Cross-Site Scripting (XSS) and Injection attacks
• Detect, attack, and implement defenses against XSS and Injection attacks
• Concepts and terminology behind defensive, secure coding
• Using Threat Modeling as a tool in identifying software vulnerabilities based on realistic threats against meaningful assets
• Perform both static code reviews and dynamic application testing to uncover vulnerabilities in Java-based web applications
• Design and develop strong, robust authentication and authorization implementations within the context of JEE
• Fundamentals of Java Cryptography (JCA) and Encryption (JCE) and where they fit in the overall security picture
• Fundamentals of XML Digital Signature and XML Encryption as well as how they are used within the web services arena
• Detect, attack, and implement defenses for XML-based services and functionality
• Techniques and measures to harden web and application servers as well as other components in your infrastructure
• Processes and measures associated with the Secure Software Development (SSD)
• Skills, tools, and best practices for design and code reviews as well as testing initiatives
• Basics of security testing and planning
• Work through a comprehensive testing plan for recognized vulnerabilities and weaknesses

This intermediate-level and beyond JEE course is designed for developers who wish to get up and running on developing well-defended web applications.