Combined Java, PHP and Web Application Security

#text-block-10 { margin-bottom:0px; text-align:left; }

IT security and secure coding

* Nature of security
* IT security related terms
* Definition of risk
* Different aspects of IT security
* Requirements of different application areas
* IT security vs. secure coding
* From vulnerabilities to botnets and cyber crime
* Classification of security flaws

Web application vulnerabilities Client-side security
* JavaScript security
* Ajax security
* HTML5 Security

Foundations of Java security

* The Java environment
* Java security
* Low-level security – the Java language
* High-level security – access control

Basics of cryptography

* Cryptosystems
* Symmetric-key cryptography
* Other cryptographic algorithms
* Asymmetric (public-key) cryptography
* Public Key Infrastructure (PKI)

Java security services

* Java security services – architecture
* Authentication and authorization
* Cryptographic services
* Secure communication

PHP security services

* Cryptography extensions in PHP
* Input validation APIs

PHP Environment

* Server configuration
* Securing PHP configuration
* Environment security
* Hardening
* Configuration management

#text-block-11 { margin-bottom:0px; text-align:left; }

Java EE security

* Java EE multi-tier architecture
* Roles and responsibilities
* Java EE container-based security
* Basic concepts: user, group, role, realm
* Security of the Web/Presentation tier
* Security of the EJB/Business tier

Security of RESTful web services

* Security of RESTfulweb services
* REST-related technologies for security
* REST-related vulnerabilities

Using security testing tools

* Web vulnerability scanners
* SQL injection tools
* Static code analysis

Input validation

* Input validation concepts
* Remote PHP code execution
* Variable scope errors in PHP

Improper use of security features

* Problems related to the use of security features
* Insecure randomness
* Weak PRNGs in PHP
* Stronger PRNGs we can use in PHP
* Insecure randomness in Java
* Using random numbers in Java – spot the bug!
* Password management – stored passwords
* Some usual password management problems
* Accessing private fields with reflection in Java
* Improper error and exception handling

Time and state problems

* Concurrency and threading
* Concurrency in PHP
* Preventing file race condition
* PHP session handling
* A PHP design flaw – open_basedir race condition
* Database race condition
* Hashtable collision attack
* Code quality problems
* Mobile code

Knowledge sources