Securing Java Web Application
DESCRIPTION
Pada training ini akan membahas mengenai memahami ancaman paling umum terhadap aplikasi web
saat ini. Training juga akan mempelajari berbagai teknik pertahanan untuk membantu anda
membangun aplikasi web Java yang mencegah serangan ini menjadi sukses. Pada training ini peserta
akan mempelajari web application security basics, authentication and session management, access
control, cross-site scripting defense, cross-site request forgery defense and clickjacking, protecting
sensitive data, sql injection and other injection attacks, safe file upload and file I/O, logging, error
handling, and intrusion detection, dan secure software development lifecycle.
TARGET AUDIENCE
1. Programmer
2. Java Developer
3. Java Web developer
CONTENT
1. Web Application Security Basics
1.1. What Is Untrusted Data?
1.2. HTTP Security Considerations
1.3. Anti-Patterns and Weaknesses
1.4. Security Controls and Positive Patterns
1.5. Input Validation
2. Project Planning Authentication and Session Management
2.1. Registration of New Users
2.2. The Basic Flow of the Login Process
2.3. Attacks Against Authentication
2.4. Secure Cookie Properties for Session Management
2.5. Credential Security
2.6. Username Harvesting
2.7. Brute Force Attacks, Account Lockout, and Multi-Factor Revisited
2.8. Remember Me Feature
2.9. Multi-Factor Authentication
2.10. Federated Identity and SAML
2.11. OAuth Basics
2.12. Additional Reading
3. Access Control
3.1. Identity and Access Control
3.2. RBAC Struggles: Data-Specific/Contextual Access Control
3.3. Multitenancy and Access Control
3.4. Contextual Access Control
3.5. Spring Security 3.0 ACLs
3.6. ABAC Attribute-Based Access Control
3.7. RBAC vs. ABAC
4. Cross-Site Scripting Defense
4.1. Content Spoofing
4.2. Defending Against XSS
4.3. Resources
5. Cross-Site Request Forgery Defense and Clickjacking
5.1. How Does CSRF Work?
5.2. How to Combat CSRF
5.3. Clickjacking
5.4. How to Combat Clickjacking
6. Protecting Sensitive Data
6.1. Securing Data in Transit
6.2. Securing Data at Rest
6.3. Secure Random Numbers
7. SQL Injection and Other Injection Attacks
7.1. What Is SQL Injection?
7.2. Other SQL Injection Examples
7.3. Query Parameterization
7.4. SQL Injection and Stored Procedures
7.5. Defense in Depth
7.6. Input Validation and Type Safety
7.7. DAO Pattern and Access Control Considerations
7.8. SQL Injection and Object
7.9. SQL Injection and Object Relational Mapping
7.10. Other Forms of Injection
7.11. Dangerous Characters in Input
8. Safe File Upload and File I/O
8.1. Anti-Patterns and Design Flaws
8.2. File Upload Security
8.3. Patterns of Attack
8.4. Summary
8.5. Resources
9. Logging, Error Handling, and Intrusion Detection
9.1. Logging Basics
9.2. Logging Frameworks for Security
9.3. Safe Error Handling
9.4. App Layer Intrusion Detection
