Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
1. IT Security and Secure Coding
- Core Security Principles: Applying Confidentiality, Integrity, and Availability (CIA) specifically to Java applications.
- Secure Software Development Lifecycle (SSDLC): Embedding security considerations from requirements gathering through to deployment.
- Secure Coding Paradigms: Implementing defence in depth, least privilege, and fail-safe defaults.
- Vulnerability Classifications: Interpreting CWE (Common Weakness Enumeration) and OWASP standards.
2. Web Application Security
- OWASP Top Ten Analysis: In-depth examination of Injection, Broken Authentication, and Sensitive Data Exposure.
- Cross-Site Scripting (XSS): Managing Reflected, Stored, and DOM-based XSS scenarios in Java/JSP environments.
- Cross-Site Request Forgery (CSRF): Understanding attack mechanisms and implementing Anti-CSRF tokens.
- Session Management: Securing cookies, preventing session fixation, and managing timeouts.
- API Security: Protecting REST and SOAP endpoints from abuse.
3. Web Services Security
- Comparative Analysis: Distinguishing attack surfaces between web services and traditional web applications.
- Transport Layer Security: Configuring SSL/TLS for Java clients and servers.
- Message Security: Ensuring integrity and confidentiality at the payload level.
- Authentication Standards: Implementing OAuth 2.0, OpenID Connect, and JWT (JSON Web Tokens).
4. XML Security
- XML Parsing Risks: Preventing XML External Entity (XXE) attacks.
- Schema Validation: Adopting best practices for strict XML schema enforcement.
- Digital Signatures: Implementing XML signatures to ensure non-repudiation.
- XML Encryption: Utilising standard approaches for encrypting XML content.
5. Foundations of Java Security
- Java Security Architecture: Exploring the
java.securitypackage and provider model. - Security Providers: Installing and configuring providers such as Bouncy Castle.
- Access Control: Managing policy files, permissions, and the Security Manager (comparing legacy vs. modern approaches).
- KeyStore Management: Creating and maintaining keystores and truststores for certificates.
6. Practical Cryptography
- Cryptographic Algorithms: Overview of Symmetric (AES), Asymmetric (RSA, ECC), and Hashing (SHA-256/512) methods.
- Random Number Generation: Evaluating the risks of
java.util.Randomversusjava.security.SecureRandom. - Key Management: Strategies for key generation, secure storage, and rotation.
- Java Cryptography Architecture (JCA): Utilising
Cipher,MessageDigest, andMacclasses. - Java Cryptography Extension (JCE): Understanding policy files and unlimited strength jurisdictions.
7. Java Security Services
- SSL/TLS in Java: Applying
SSLSocketFactoryandHttpsURLConnection. - Trust Managers: Customising trust verification for private PKI environments.
- Authenticators: Implementing programmatic authentication via
Authenticator.getDefault(). - Certificate Analysis: Programmatically reading and analysing X.509 certificates.
8. Java EE Security
- Declarative Security: Implementing role-based access control (RBAC) using
web.xmland annotations. - Programmatic Security: Utilising
HttpServletRequest.isUserInRole()andgetRemoteUser(). - JAAS (Java Authentication and Authorization Service): Configuring
login.confand implementingLoginModules. - Servlet Security: Managing container-security constraints and authentication methods (FORM, BASIC, DIGEST).
9. Common Coding Errors and Vulnerabilities
- Insecure Deserialisation: Assessing the risks of
ObjectInputStreamand potential security check bypasses. - Command Injection: Mitigating operating system-level execution vulnerabilities.
- Path Traversal: Sanitising file system inputs to prevent directory traversal attacks.
- Reflection Abuse: Addressing risks associated with
java.lang.reflectand access control bypasses. - Hardcoded Credentials: Identifying and removing sensitive secrets from source code.
- Cryptography Implementation Errors: Avoiding the use of ECB mode, weak keys, or static Initialisation Vectors (IVs).
10. Knowledge Resources
- Static Analysis Tools: Leveraging SonarQube, Checkmarx, and Fortify for automated scanning.
- Dynamic Analysis Tools: Overview of Burp Suite and OWASP ZAP.
- CVE Databases: Strategies for tracking and responding to new Java framework vulnerabilities.
- Recommended Readings: Curated list of books, documentation, and secure coding checklists.
Requirements
None.
21 Hours
Testimonials (4)
the knowledge of the trainer was very high - he knew what he was talking about, and knew the answers to our questions
Adam - Fireup.PRO
Course - Advanced Java Security
Practical exercises
Olek - Fireup.PRO
Course - Advanced Java Security
coding excercies
Mirek - Fireup.PRO
Course - Advanced Java Security
It opens up a lot and gives lots of insight what security
