Combined C/C++/C#, ASP.NET and Web Application Security

#text-block-10 { margin-bottom:0px; text-align:left; }

IT security and secure coding

* Nature of security
* IT security related terms
* Definition of risk
* Different aspects of IT security
* Requirements of different application areas
* IT security vs. secure coding
* From vulnerabilities to botnets and cybercrime
* Classification of security flaws

Web application vulnerabilities

* Injection
* Broken authentication and session management
* Cross-Site Scripting (XSS)
* Insecure direct object reference
* Missing function level access control
* Cross Site Request Forgery (CSRF)
* Unvalidated redirects and forwards

Client-side security

* JavaScript security
* Ajax security
* HTML5 Security

.NET security architecture and services

* .NET architecture
* Code Access Security
* Role-based security

Basics of cryptography

* Cryptosystems
* Symmetric-key cryptography
* Other cryptographic algorithms
* Asymmetric (public-key) cryptography
* Public Key Infrastructure (PKI)
* Cryptography in .NET

ASP.NET security architecture

* ASP.NET basics
* ASP.NET features
* ASP.NET authentication and identity management
* ASP.NET authorization

#text-block-11 { margin-bottom:0px; text-align:left; }

ASP.NET security features and vulnerabilities

* Custom protected configuration providers
* Postback validation
* Viewstate protection
* Viewstate protection
* Event validation
* Accessing disabled and hidden controls
* Control sequence attacks
* NULL byte termination vulnerability
* Real life example – Forms Authentication Bypass
* Denial of service possibilities

Security of Web services

* Web services – Introduction
* Transport layer security
* Message level security
* Signing XML documents – spot the bug!
* XML security
* XML Digital Signature
* XML Encryption
* XML Security with Username/Password
* Security of RESTfulweb services
* REST-related vulnerabilities

Security relevant C/C++ programming bugs and flaws

* x86 machine code, memory layout, stack operations

Buffer overflow

* Buffer overflow
* Stack overflow
* Protection principles
* Stack smashing protection
* Address Space Layout Randomization (ASLR)
* Non executable memory areas – the NX bit
* Return-to-libc attack – Circumventing the NX bit
* Return oriented programming (ROP)
* Heap overflow
* Some additional native code-related vulnerabilities
* Input validation
* Improper use of security features
* Improper error and exception handling
* Time and state problems
* Code quality problems

Using security testing tools

* Web vulnerability scanners
* SQL injection tools
* Static code analysis

Knowledge sources

* Secure coding sources – a starter kit
* Vulnerability databases