Building a secure networked application can be challenging, even for developers who have previously utilised various cryptographic building blocks (such as encryption and digital signatures). To help participants grasp the role and application of these cryptographic primitives, the course first establishes a solid foundation regarding the core requirements of secure communication—specifically secure acknowledgment, integrity, confidentiality, remote identification, and anonymity. It also outlines typical threats that can compromise these requirements, alongside practical real-world solutions.
Given that cryptography is a critical component of network security, the course examines the most important cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. Rather than delving into complex mathematical theory, these topics are explored from a developer’s perspective, featuring typical use-case examples and practical considerations related to cryptography, such as public key infrastructures. Security protocols across various domains of secure communication are introduced, with an in-depth discussion of widely-used protocol families including IPSEC and SSL/TLS.
The course also addresses common cryptographic vulnerabilities, both concerning specific crypto algorithms and cryptographic protocols. Examples include BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and similar threats, as well as RSA timing attacks. For each issue, the practical implications and potential consequences are described, again avoiding deep mathematical analysis.
Finally, as XML technology is central to data exchange for networked applications, the security aspects of XML are detailed. This covers the use of XML within web services and SOAP messages, along with protection measures such as XML signature and XML encryption. The course also highlights weaknesses in these protection measures and XML-specific security issues, such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.
Participants attending this course will
- Understand fundamental concepts of security, IT security, and secure coding
- Understand the requirements of secure communication
- Learn about network attacks and defenses at different OSI layers
- Gain a practical understanding of cryptography
- Understand essential security protocols
- Understand some recent attacks against cryptosystems
- Gain information about some recent related vulnerabilities
- Understand security concepts of Web services
- Access sources and further readings on secure coding practices
Audience
Developers, Professionals
Read more...
