Advanced Java, JEE and Web Application Security

#text-block-10 { margin-bottom:0px; text-align:left; }

IT security and secure coding

* Nature of security
* IT security related terms
* Definition of risk
* Different aspects of IT security
* Requirements of different application areas
* IT security vs. secure coding
* From vulnerabilities to botnets and cybercrime
* Classification of security flaws

Web application vulnerabilities

* SQL Injection
* Other injection flaws
* Cross-Site Scripting (XSS)
* Broken authentication and session management
* Cross Site Request Forgery (CSRF)
* Insecure direct object reference
* Unvalidated file upload
* Security misconfiguration
* Failure to restrict URL access
* Transport layer security issues
* Unvalidated redirects and forwards

Using security testing tools

* Web vulnerability scanners
* SQL injection tools
* Google hacking
* Proxy servers and sniffers
* Exercise – Capturing network traffic
* Static code analysis

Advices and principles

* Matt Bishop’s principles of robust programming
* The security principles of Saltzer and Schroeder

Foundations of Java security

* The Java environment
* Java security
* Low-level security – the Java language
* High-level security – access control

#text-block-11 { margin-bottom:0px; text-align:left; }

Basics of cryptography

* Cryptosystems
* Symmetric-key cryptography
* Other cryptographic algorithms
* Asymmetric (public-key) cryptography
* Public Key Infrastructure (PKI)

Java security services

* Java security services – architecture
* Authentication and authorization
* Cryptographic services
* Secure communication

Java specific vulnerabilities

* Input validation
* Improper use of security features
* Improper error and exception handling
* Time and state problems
* Code quality problems
* Mobile code

Java EE security

* Java EE multi-tier architecture
* Roles and responsibilities
* Java EE container-based security
* Basic concepts: user, group, role, realm
* Security of the Web/Presentation tier
* Security of the EJB/Business tier

Security of RESTful web services

* Security of RESTfulweb services
* REST-related technologies for security
* REST-related vulnerabilities

Client-side security

* JavaScript security
* Ajax security
* HTML5 Security

Knowledge sources

* Secure coding sources – a starter kit
* Vulnerability databases