Security isec203 java secure coding practice

COURSE OVERVIEW
The Java platform provides a number of features designed for improving the securityof Java applications. This includes enforcing runtime constraints through the use of the Java Virtual Machine (JVM), a security manager that sandboxes untrusted code from the rest of the operating system, and a suite of security APIs that Java developers can utilize. Despite this, criticism has been directed at the programming language, and Oracle, due to an increase in malicious programs that revealed security vulnerabilities in the JVM, which were subsequently not properly addressed by Oracle in a timely manner. This is a four day in depth course that covers best practices in Java security for designers, developers and testers

COURSE MATERIAL
Soft Copy and Online reference
DAY 1
HTTP/HTTPS PROTOCOL BASICS
UNDERSTANDING WEB APPLICATION ARCHITECTURES
LAB SETUP AND TOOLS OF THE TRADE
CONVERTING YOUR BROWSER INTO AN ATTACK PLATFORM
TRAFFIC INTERCEPTION AND MODIFICATION USING PROXIES
JAVA LANGUAGE BASICS REVISION
WEB APPLICATION ATTACKS – DEEP DIVE
WEB APPLICATION PROXIES
INPUT VALIDATION
OUTPUT ENCODING
BLACKLISTING AND WHITELISTING
VALIDATION TECHNIQUES
REGULAR EXPRESSIONS
SERVLET FILTERS
CONTENT SECURITY POLICY
PREPARED STATEMENTS
CSRF DEFENSE
DAY 2

AUTHENTICATION FACTORS
AUTHENTICATION ATTACKS
JAVA EE AUTHENTICATION
BASIC AUTHENTICATION
FORM-BASED AUTHENTICATION
CLIENT CERTIFICATES
USING SSL
SECURE PASSWORD STORAGE
AUTHORIZATION
WEB AND ENTERPRISE JAVABEAN ACCESS CONTROL
AUTHORIZATION ATTACKS
ACCESS CONTROL BYPASS
INVALIDATED FORWARDS AND REDIRECTS
STATE MANAGEMENT ATTACKS
SESSION HIJACKING
SESSION FIXATION
CLICKJACKING
USING X-FRAME-OPTIONS

JAVA SECURITY MANAGER
PERMISSIONS
POLICY FILE
JAR SIGNING
CLASS SECURITY
ERROR HANDLING
EXCEPTIONS
USING TRY/CATCH/FINALLY
LOGGING
LOGGING FRAMEWORKS
ESAPI LOGGING
ENCRYPTION
JAVA SECURE SOCKETS EXTENSION (JSSE)
JAVA CRYPTOGRAPHY ARCHITECTURE (JCA)
INTEGER AND DOUBLE OVERFLOWS
THREAD SAFETY
RACE CONDITIONS
REST SECURITY
OAUTH

SECURITY AND THE SDLC
CONDUCTING A SECURE CODE REVIEW
MANUAL CODE REVIEW
USING A STATIC ANALYSIS TOOL
USING FINDBUGS
INTEGRATING CODE REVIEW INTO THE SDLC
SECURITY TESTING
EXPLOITING XSS, CSRF, AND SQL INJECTION
SECURE CODING
FIXING WEAKNESSES IN A RUNNING APPLICATION