Course Objectives

This course will:

• Familiarize you with .Net Application Security, ASP.Net Security Architecture and help you understand the need for application security and common security threats to .Net framework
• Discuss security attacks on .Net framework and explain the secure software development life cycle
• Help you to understand common threats to .Net assemblies and familiarize you with stack walking processes
• Discuss the need for input validation, various input validation approaches, common input validation attacks, validation control vulnerabilities, and best practices for input validation
• Familiarize you with authorization and authentication processes and common threats to authorization and authentication
• Discuss various security principles for session management tokens, common threats to session management, ASP.Net session management techniques, and various session attacks
• Cover the importance of cryptography in .Net, different types of cryptographic attacks in .Net, and various .Net cryptography namespaces
• Explain symmetric and asymmetric encryption, hashing concepts, digital certificates, digital and XML signatures
• Describe the principles of secure error handling, different levels of exception handling, and various .Net logging tools
• Examine file handling concepts, file handling security concerns, path traversal attacks on file handling, and defensive techniques against path traversal attack

What Will You Learn?

• Students in this course will acquire knowledge in the following areas:
• Java security principles and secure coding practices Java Security Platform, Sandbox, JVM, Class loading, Bytecode verifier, Security Manager, security policies, and Java Security Framework
• Secure Software Development Lifecycle, threat modelling, software security frameworks, and secure software architectures
• Best practices and standards and guidelines for secure file input/output and serialization
• Java input validation techniques, validation errors, and best practices
• Java exceptions, erroneous behaviors, and the best practices to handle or avoid them
• Secure authentication and authorization processes
• Java Authentication and Authorization Service (JAAS), its architecture, Pluggable Authentication Module (PAM) Framework, and access permissions through Java Security Model
• Secure Java concurrency and session management that includes Java Memory Model, Java Thread Implementation methods, secure coding practices, and guidelines for handling threads, race conditions, and deadlocks
• Core security coding practices of Java Cryptography that includes Encryption, KeyGenerator, implementation of Cipher Class,
• Digital Signatures, Secret Keys, and key management
• Various Java application vulnerabilities such as Cross-Site Scripting (XSS), Cross Site Request Forgery (CSRF), Directory Traversal vulnerability, HTTP Response Splitting attack, Parameter Manipulation, Injection Attacks and their countermeasures Coding testing and review techniques and practices