CASE.JAVA: Certified Application Security Engineer (CASE) Java

Course Information

Course Name

CASE.JAVA: Certified Application Security Engineer (CASE) Java

Exam code

312-94

Duration

3 Days

Certification

Certified Application Security Engineer (CASE) Java

Overview

The Certified Application Security Engineer (CASE) credential is developed in partnership with large application and software development experts globally.

The CASE certified training program is developed concurrently to prepare software professionals with the necessary capabilities that are expected by employers and academia globally.

It is designed to be a hands-on, comprehensive application security course that will help software professionals create secure applications.

The training program encompasses security activities involved in all phases of the Software Development Lifecycle (SDLC): planning, creating, testing, and deploying an application.

Unlike other application security trainings, C❘ASE goes beyond just the guidelines on secure coding practices and includes secure requirement gathering, robust application design, and handling security issues in post development phases of application development.

The Purpose of C|ASE Is

·       To ensure that application security is no longer an afterthought but a foremost one.

·       To lay the foundation required by all application developers and development organizations, to produce secure applications with greater stability and fewer security risks to the consumer, therefore, making security a foremost thought.

·       To ensure that the organizations mitigate the risk of losing millions due to security compromises that may arise with every step of application development process.

·       To help individuals develop the habit of giving importance to security sacrosanct of their job role in the SDLC, therefore opening security as the main domain for testers, developers, network administrator etc.

Audience Profile

Individuals involved in the role of developing, testing, managing, or protecting wide area of applications

Prerequisites

Java Developers with a minimum of 2 years of experience  and individuals who want to become application security engineers/analysts/testers

At Course Completion

·       Immediate Credibility: The CASE program affirms that you are indeed an expert in application security. It also demonstrates the skills that you possess for employers globally.

·       Pertinent Knowledge: Through the CASE certification and training program, you will be able to expand your application security knowledge.

·       Multifaceted Skills: CASE can be applied to a wide variety of platforms, such as, mobile applications, web applications, IoT devices, and many more.

·       A Holistic Outlook: Ranging from pre-deployment to post-deployment security techniques, covering every aspect of secure – software development life cycle, CASE arms you with the necessary skills to build a secure application.

·       Better Protect and Defend: By making an application more secure you are also helping defend both organizations and individuals globally. As a CASE, it is in your hands to protect and defend and ultimately help build a safer world.

Course Outline

Module 1: Understanding Application Security, Threats, and Attacks

·       What is a Secure Application

·       Need for Application Security

·       Most Common Application Level Attacks

o   SQL Injection Attacks

o   Cross-site Scripting (XSS) Attacks

o   Parameter Tampering

o   Directory Traversal

o   Cross-site Request Forgery (CSRF) Attack

o   Denial-of-Service (DoS) Attack

·       Denial-of-Service (DoS): Examples

o   Session Attacks

·       Cookie Poisoning Attacks

·       Session Fixation

·       Why Applications become Vulnerable to Attacks

o   Common Reasons for Existence of Application Vulnerabilities

o   Common Flaws Existed due to Insecure Coding Techniques

o   Improper Input Validation

o   Insufficient Transport Layer Protection

o   Improper Error Handling

o   Insecure Cryptographic Storage

o   Broken Authentication and Session Management

o   Unvalidated Redirects and Forwards

o   Insecure Direct Object References

o   Failure to Restrict URL Access

·       What Constitutes a Comprehensive Application Security?

o   Application Security Frame

o   3W’s in Application Security

·       Insecure Application: A Software Development Problem

o   Solution: Integrating Security in Software Development Life Cycle (SDLC)

o   Functional vs Security Activities in SDLC

o   Advantages of Integrating Security in SDLC

o   Microsoft Security Development Lifecycle (SDL)

·       Software Security Standards, Models, and Frameworks

o   The Open Web Application Security Project (OWASP)

o   OWASP TOP 10 Attacks-2017

o   The Web Application Security Consortium (WASC)

o   WASC Threat Classification

o   Software Security Framework

·       Software Assurance Maturity Model (SAMM)

·       Building Security in Maturity Model (BSIMM)

o   BSIMM vs OpenSAMM

Module 2: Security Requirements Gathering

·       Importance of Gathering Security Requirements

o   Security Requirements

o   Gathering Security Requirements

o   Why We Need Different Approach for Security Requirements Gathering

o   Key Benefits of Addressing Security at Requirement Phase

o   Stakeholders Involvement in Security Requirements Gathering

o   Characteristics of Good Security Requirement: SMART

o   Types of Security Requirements

o   Functional Security Requirements

o   Security Drivers

·       Security Requirement Engineering (SRE)

·       SRE Phases

o   Security Requirement Elicitation

o   Security Requirement Analysis

o   Security Requirement Specification

o   Security Requirement Management

·       Common Mistakes Made in Each Phase of SRE

·       Different Security Requirement Engineering Approaches/Model

·       Abuse Case and Security Use Case Modeling

·       Abuse Cases

·       Threatens Relationship

·       Abuse Case Modeling Steps

·       Abuse Cases: Advantages and Disadvantages

·       Abuse Case Template

·       Security Use Cases

·       Security Use Cases are Abuse Case Driven

·       Modeling Steps for Security Use Cases

·       Mitigates Relationship

·       Abuse Case vs Security Use Case

·       Security Use Case: Advantages and Disadvantages

·       Security Use Case Template

·       Security Use Case Guidelines

·       Example 1: Use Case for Online Bidding System

·       Example 1: Abuse Case for Online Bidding System

·       Example 1: Security Use Case for Online Bidding System

·       Example 2: Use Case for ATM System

·       Example 2: Abuse Case for ATM System

·       Example 2: Security Use Case for ATM System

·       Example 3: Use Case for E-commerce System

·       Example 3: Abuse Case for E-commerce System

·       Example 3: Security Use Case for E-commerce System

·       Effectiveness of Abuse and Security Case

·       Abuser and Security Stories

·       Textual Description Template: Abuser Stories and Security Stories

·       Examples: Abuser Stories and Security Stories

·       Effectiveness of Abuser and Security Stories

·       Abuser Stories: Advantages and Disadvantages

·       Security Quality Requirements Engineering (SQUARE)

o   SQUARE Effectiveness

o   SQUARE Process

o   SQUARE: Advantages and Disadvantages

·       Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)

o   OCTAVE Effectiveness

o   OCTAVE Steps

o   OCTAVE: Advantages and Disadvantages

Module 3: Secure Application Design and Architecture

·       Relative Cost of Fixing Vulnerabilities at Different Phases of SDLC

·       Secure Application Design and Architecture

·       Goal of Secure Design Process

·       Secure Design Actions

·       Security Requirement Specifications

·       Secure Design Principles

·       Threat Modeling

·       Secure Application Architecture

·       Secure Design Principles

·       Define Secure Design principles

·       Secure Design Principles

·       Security through obscurity

·       Secure the Weakest Link

·       Use Least Privilege Principle

·       Secure by Default

·       Fail Securely

·       Apply Defense in Depth

·       Do Not Trust User Input

·       Reduce Attack Surface

·       Enable Auditing and Logging

·       Keep Security Simple

·       Separation of Duties

·       Fix Security Issues Correctly

·       Apply Security in Design Phase

·       Protect Sensitive Data

·       Exception Handling

·       Secure Memory Management

·       Protect Memory or Storage Secrets

·       Fundamentals of Control Granularity

·       Fault Tolerance

·       Fault Detection

·       Fault Removal

·       Fault Avoidance

·       Loose Coupling

·       High Cohesion

·       Change Management and Version Control

·       Threat Modeling

·       Threat Modeling Phases

·       Attack Surface Evaluation

·       Threat Identification

·       Impact Analysis

·       Control Recommendations

·       Threat Modeling Process

·       Identify Security Objective

·       Application Overview

·       Decompose Application

·       Identify Threats

·       Identify Vulnerabilities

·       Identify Security Objective

·       How to Identify Security Objectives

·       Create an Application Overview

·       Draw the End-to-End Deployment Architecture

·       Identify Various User Roles

·       Identify Use Cases Scenarios

·       Identify Technologies

·       Identify Application Security Mechanisms

·       Decompose Application

o   Prepare and Document Threat Model Information

·       Example: Threat Model Information

o   Identify the External Dependencies

·       External Dependencies: Example

o   Identify the Entry Points

·       Entry Points: Example

o   Identify the Assets

·       Assets: Example

o   Identify the Trust Levels

·       Trust Levels: Example

o   Define Trust Levels to Entry points

o   Define Trust Levels to Assets

o   Perform Application Modelling using Data Flow Diagrams (DFDs)

o   Determine the Threats: Identify the Goal of an Attacker and Create Threat Profile

·       Example: Attacker’s Goal/Threat Profile and Vulnerabilities Associated

o   Determine the Threats: Create a Security Profile

o   Identify the Threats

·       The STRIDE Model

o   Example: Threat Categorized and Identified using STRIDE

·       Determine Countermeasures and Mitigation Security Controls

·       Document the Threats

·       Rating the Threats

·       Rating the Threats: DREAD Model

·       Secure Application Architecture

·       Design Secure Application Architecture

Module 4: Secure Coding Practices for Input Validation

·       Input Validation

·       Why Input Validation?

·       Input Validation Specification

·       Input Validation Approaches

·       Validation and Security Issues

·       Impact of Invalid Data Input

·       Data Validation Techniques

·       Input Validation using Frameworks and APIs

·       Open Source Validation Framework for Java

·       Servlet Filters

·       Validation Filters for Servlet

·       Data Validation using OWASP ESAPI

·       Data Validation: Struts Framework

·       Struts Validator

·       Struts Validation and Security

·       Data Validation using Struts Validator

·       Avoid Duplication of Validation Forms

·       Secure and Insecure Struts Validation Code

·       Struts Validator Class

·       Secure and Insecure Code for Struts Validator Class

·       Enable the Struts Validator

·       Secure and Insecure Struts Validator Code

·       Struts 2 Framework Validator

·       Struts 2 Framework: Built-in Data Validators

·       Struts 2 Framework Annotation Based Validators

·       Struts 2 Custom Validation: Workflow Interceptor

·       Struts 2 Ajax Validation: jsonValidation Interceptor

·       Data Validation: Spring Framework

·       Spring Validator

·       Data Validation: Spring MVC Framework

·       Implementing Validator

·       JSR 380 Bean Validator API

·       Configuring JSR 380

·       Custom Validator Implementation in Spring

·       Spring Validation and Security

·       Input Validation Errors

·       Improper Sanitization of Untrusted Data

·       Improper Validation of Strings

·       Improper Logging of User Inputs

·       Improper Incorporation of Malicious Inputs into Format Strings

·       Inappropriate Use of Split Characters in Data Structures

·       Improper Validation of Non-Character Code Points

·       Improper Use of String Modification

·       Improper Comparison of Locale-dependent Data

·       Best Practices for Input Validation

·       Common Secure Coding Practices

·       SQL Injection

·       Prepared Statement

·       Stored Procedures

·       Vulnerable and Secure Code for Stored Procedures

·       Stored Procedure for Securing Input Validation

·       Cross-site Scripting (XSS)

·       Whitelisting vs Blacklisting

·       Vulnerable and Secure Code for Blacklisting & Whitelisting

·       Regular Expressions

·       Vulnerable and Secure Code for Regular Expressions

·       Character Encoding

·       Vulnerable and Secure Code for Character Encoding

·       Checklist for Character Encoding

·       Cross-site Scripting (XSS) Countermeasures

·        HTML Encoding

·       Vulnerable and Secure Code for HTML Encoding

·       HTML Encoding using ESAPI Encoder

·       Cross-site Request Forgery (CSRF)

·       Cross-site Request Forgery (CSRF) Countermeasures

·       Directory Traversal

·       Directory Traversal Countermeasures

·       HTTP Response Splitting

·       HTTP Response Splitting Countermeasures

·       Parameter Manipulation and Countermeasures

·       Protecting Application from Log Injection Attack

·       XML Injection

·       Command Injection

·       LDAP Injection

·       XML External Entity Attack

·       Unrestricted File Upload Attack

·       Prevent Unrestricted File Upload: Validate File Extension

·       Injection Attacks Countermeasures

·       CAPTCHA

·       Sample Code for Creating CAPTCHA

·       Sample Code for CAPTCHA Verification

·       Sample Code for Displaying CAPTCHA

Best Practices for Input Validation

Module 5: Secure Coding Practices for Authentication and Authorization

·       Introduction to Authentication

·       Java Container Authentication

·       Authorization Mechanism Implementation

·       Types of Authentication

·       Declarative vs Programmatic Authentication

·       Declarative Security Implementation

·       Programmatic Security Implementation

·       Java EE Authentication Implementation Example

·       Basic Authentication

·       How to Implement Basic Authentication?

·       Form-based Authentication

·       Form-based Authentication Implementation

·       Implementing Kerberos-Based Authentication

·       Secured Kerberos Implementation

·       Client Certificate Authentication

·       Certificate Generation with Keytool

·       Implementing Encryption and Certificates in Client Application

·       Authentication Weaknesses and Prevention

·       Brute Force Attack

·       Web-based Enumeration Attack

·       Weak Password Attacks

·       Introduction to Authorization

·       JEE Based Authorization

·       Declarative

·       Programmatic

·       Access Control Model

·       Discretionary Access Control (DAC)

·       Mandatory Access Control (MAC)

·       Role-based Access Control (RBAC)

·       Servlet Container

·       Authorizing Users by Servlets

·       EJB Authorization

·       EJB Authorization Controls

·       Declarative Security with EJBs

·       Programmatic Security with EJBs

·       Java Authentication and Authorization (JAAS)

·       JAAS Features

·       JAAS Architecture

·       Pluggable Authentication Module (PAM) Framework

·       JAAS Classes

·       JAAS Subject and Principal

·       Authentication in JAAS

·       Authentication Steps in JAAS

·       Authorization in JAAS

·       Authorization Steps in JAAS

·       Subject Methods doAs() and doAsPrivileged()

·       Impersonation in JAAS

·       JAAS Permissions

·       LoginContext in JAAS

·       Creating LoginContext

·       LoginContext Instantiation

·       JAAS Configuration

·       Locating JAAS Configuration File

·       JAAS CallbackHandler and Callbacks

·       Login to Standalone Application

·       JAAS Client

·       LoginModule Implementation in JAAS

·       Methods Associated with LoginModule

·       LoginModule Example

·       Phases in Login Process

·       Java EE Security

·       Java EE Application Architecture

·       Java EE Servers as Code Hosts

·       Declaring Roles

·       HTTP Authentication Schemes

·       Authorization Common Mistakes and Countermeasures

·       Common Mistakes

·       Authentication and Authorization in Spring Security Framework

·       Spring Security Framework

·       Spring Security Modules

·       Spring Authentication

·       Storing Username and Password

·       Securing Authentication Provider

·       Implementing HTTP Basic Authentication

·       Form-based Authentication

·       Implementing Digest Authentication

·       Security Expressions

·       URL-based Authorization

·       JSP Page Content Authorization

·       JSP Page Content Authorization with Domain Object’s ACL

·       Method Authorization

·       Configuring Anonymous Login

·       Logout Feature Configuration

·       Remember-Me Authentication

·       Integrating Spring Security with JAAS

·       Spring JAAS Implementation

·       Defensive Coding Practices against Broken Authentication and Authorization

·       Do Not Store Password in Java String Object

·       Avoid Cookie based Remember-Me Use Persistent Remember-Me

·       Implement Appropriate Session Timeout

·       Prevent Session Stealing by Securing SessionID Cookie

·       Secure Development Checklists: Broken Authentication and Session Management

Module 6: Secure Coding Practices for Cryptography

·       Java Cryptography

·       Need for Java Cryptography

·       Java Security with Cryptography

·       Java Cryptography Architecture (JCA)

·       Java Cryptography Extension (JCE)

·       Encryption and Secret Keys

·       Attack Scenario: Inadequate/Weak Encryption

·       Encryption: Symmetric and Asymmetric Key

·       Encryption/Decryption Implementation Methods

·       SecretKeys and KeyGenerator

·       Implementation Methods of KeyGenerator Class

·       Creating SecretKeys with KeyGenerator Class

·       Cipher Class

·       The Cipher Class

·       Implementation Methods of Cipher Class

·       Insecure Code for Cipher Class using DES Algorithm

·       Secure Code for Cipher Class using AES Algorithm

·       Digital Signatures

·       Attack Scenario: Man-in-the-Middle Attack

·       Digital Signatures

·       The Signature Class

·       Implementation Methods of Signature Class

·       The SignedObjects

·       Implementing Methods of SignedObjects

·       The SealedObjects

·       Implementation Methods of SealedObject

·       Insecure and Secure Code for Signed/Sealed Objects

·       Java XML Digital Signature

·       Secure Socket Layer (SSL)

·       Java Secure Socket Extension (JSSE)

·       SSL and Security: Example 1

·       SSL and Security: Example 2

·       JSSE and HTTPS

·       Insecure HTTP Server Code

·       Secure HTTP Server Code

·       Key Management

·       Attack Scenario: Poor Key Management

·       Keys and Certificates

·       Key Management System

·       KeyStore

·       Implementation Method of KeyStore Class

·       KeyStore: Persistent Data Stores

·       Key Management Tool: KeyTool

·       Digital Certificates

·       Certification Authorities

·       Signing Jars

·       Signing JAR Tool: Jarsigner

·       Signed Code Sources

·       Insecure Code for Signed Code Sources

·       Secure Code for Signed Code Sources

·       Hashing

·       Hashing Algorithms

·       Securing Hashed Password with Salt

·       Implementing Hashing with Salt in Spring Security

·       Java Card Cryptography

·       Spring Security: Crypto Module

·       Crypto Module

·       Spring Security Crypto Module

·       Key Generators

·       PasswordEncoder

·       Implementing BCryptPasswordEncoder()

·       Configuring BCryptPasswordEncoder() in Spring Security

·       JavaScript Object Signing and Encryption (JOSE)

·       Attacks against JWT, JWS and JWE

·       Implementing JWS using Jose4J

·       Implementing JWE using Jose4J

·       Implementing JWK using Jose4J

·       Dos and Don’ts in Java Cryptography

·       Dos and Don’ts

·       Avoid using Insecure Cryptographic Algorithms

·       Avoid using Statistical PRNG, Inadequate Padding and Insufficient Key Size

·       Implement Strong Entropy

·       Implement Strong Algorithms

·       Best Practices for Java Cryptography

Module 7: Secure Coding Practices for Session Management

·       Session Management

·       Session Tracking

·        Session Tracking Methods

·       HttpSession

·       Cookies

– Setting a Limited Time Period for Session Expiration

– Preventing Session Cookies from Client-Side Scripts Attacks

·       URL Rewriting

– Example Code for URL Rewriting

·       Hidden Fields

·       Session Objects

·       Session Management in Spring Security

·       Spring Session Management

·       Session Management using Spring Security

·       Restricting Concurrent Sessions per User using Spring Security

·       Controlling Session Timeout

·       Prevent using URL Parameters for Session Tracking

·       Prevent Session Fixation with Spring Security

·       Use SSL for Secure Connection

·       Session Vulnerabilities and their Mitigation Techniques

·       Session Vulnerabilities

·       Types of Session Hijacking Attacks

·       Countermeasures for Session Hijacking

·       Countermeasures for Session ID Protection

·       Best Practices and Guidelines for Secured Sessions Management

·       Best Coding Practices for Session Management

·       Checklist to Secure Credentials and Session IDs

Guidelines for Secured Session Management

Module 8: Secure Coding Practices for Error Handling

·       Introduction to Exceptions

·       Exception and Error Handling

·       Checked Exceptions

·       Unchecked Exceptions

·       Example of an Exception

·       Handling Exceptions in Java

·       Exception Classes Hierarchy

·       Exceptions and Threats

·       Erroneous Exceptional Behaviors

·       Suppressing or Ignoring Checked Exceptions

·       Disclosing Sensitive Information

·       Logging Sensitive Data

·       Restoring Objects to Prior State, if a Method Fails

·       Avoid using Statements that Suppress Exceptions

·       Prevent Access to Untrusted Code that Terminates JVM

·       Never Catch java.lang.NullPointerException

·       Never Allow methods to Throw RuntimeException, Exception, or Throwable

·       Never Throw Undeclared Checked Exceptions

·       Never Let Checked Exceptions Escape from Finally Block

·       Dos and Don’ts in Error Handling

·       Dos and Don’ts in Exception Handling

·       Avoid using Log Error and Throw exception at Same Time

·       Spring MVC Error Handling

·       Handling Controller Exceptions with @ExceptionHandler Annotation

·       Handling Controller Exceptions with HandlerExceptionResolver

·       Spring MVC: Global Exception Handling

·       Global Exception Handling: HandlerExceptionResolver

·       Mapping Custom Exceptions to Statuscode with @ResponseStatus

·       Configure Custom Error Page in Spring MVC

·       Exception Handling in Struts 2

·       Exception Handling: Struts 2

·       Best Practices for Error Handling

·       Best Practices for Handling Exceptions in Java

·       Introduction to Logging

·       Logging in Java

·       Example for Logging Exceptions

·       Logging Levels

·       Logging using Log4j

·       Log4j and Java Logging API

·       Java Logging using Log4j

·       Secure Coding in Logging

·       Vulnerabilities in Logging

·       Logging: Vulnerable Code and Secure Code

·       Secured Practices in Logging

Module 9: Static and Dynamic Application Security Testing (SAST & DAST)

·       Static Application Security Testing

·       Static Application Security Testing (SAST)

·       Objectives of SAST

·       Why SAST

·       Skills required for SAST

·       What to look for in SAST

·       Common Vulnerabilities Identified Through SAST

·       Types of SAST

·       Automated Source Code Analysis

·       Manual Source Code Review

·       Where does Secure Code Review Fit in SDLC?

·       SAST Steps

·       SAST Activities-flow Chart

·       Recommendation for Effective SAST

·       SAST Deliverable

·       Automated Source Code Analysis

·       Static Code Analysis Using Checkmarx Static Code Analysis

·       Static Code Analysis Using Visual Code Grepper (VCG)

·       Static Code Analysis Using HP Fortify

·       Static Code Analysis Using Rational AppScan Source Edition

·       Selecting Static Analysis Tool

·       Manual Secure Code Review

·       Manual Secure Code Review for Most Common Vulnerabilities

·       Code Review for PCI DSS Compliance

·       Code Review for Blacklisting Validation Approach

·       Code Review for Client Side Validation Approach

·       Code Review for Non-parametrized SQL Query

·       Review Code for Non-parameterized Stored Procedure

·       Code Review for XSS Vulnerability

·       Review Code for Unvalidated Redirects and Forwards

·       Code Review for Weak Password Authentication

·       Code Review for Hard-Coded Passwords

·       Code Review for Clear-text credentials in for Authentication

·       Code Review for Unencrypted Form Authentication Tickets

·       Code Review for Clear-text Connection strings

·       Code Review for Weak Password Length

·       Code Review for Inappropriate Authorization

·       Code Review for use of Weak Hashing Algorithm

·       Code Review for use of Weak Encryption Algorithm

·       Code Review for Use of SSL

·       Code Review for use of URL for Storing Session Tokens

·       Code Review for Cookies Persistence

·       Code Review for Allowing More Number of Failed Login attempts

·       Code Review for providing Relative path to Redirect Method

·       Code Review for Use of Server.Transfer() Method

·       Code Review for Keeping both Public and Restricted pages in Same folder

·       Code Review for use of Weak Encryption Algorithm

·       Code Review for use of ECB Cipher Mode

·       Code Review for use of Zero Padding

·       Code Review for use of Small Key Size

·       Code Review for use of Small Block Size

·       Code Review for Cryptographic Keys Generation Mechanism

·       Code Review for Sensitive Information Leakage

·       Code Review for Generic Exception Throwing and Catching

·       Code Review for use of Unencrypted Cookies

·       Code Review for Overly Long Sessions

·       Code Review for Cookieless Sessions

·       Code Review for regeneration of Expired Sessions

·       Code Review for weak Session Key Generation Mechanism

·       Code Review for Cookies Vulnerable to Client-side Scripts attacks

·       Code Review for Cookies Vulnerable to CSRF Attacks

·       Code Review for ViewState Security

·       Code Review for allowOverride Attribute

·       Code Review for Enabling Trace feature

·       Code Review for Enabling Debug feature

·       Code Review for Validate Request §

·       Code Review: Check List Approach

·       Sample Checklist

·       Imput Validation

·       Authentication

·       Authorization

·       Session Management

·       Cryptography o Exception Handling

·       Logging

·       SAST Finding

·       SAST Report

·       SAST Reporting

·       Dynamic Application Security Testing

·       Types of DAST

·       Automated Application Vulnerability Scanning

·       Manual Application Penetration Testing

·       SAST vs DAST

·       Automated Application Vulnerability Scanning Tools

·       Web Application Security Scanners

·       WebInspect

·       IBM SecurityAppScan

·       Additional Web Application Vulnerability Scanners §

·       Proxy-based Security Testing Tools ·

·       Burp Suite

·       OWASP Zed Attack Proxy (ZAP)

·       Additional Proxy-based Security Testing Tools

·       Choosing Between SAST and DAST

Module 10: Secure Deployment and Maintenance

·       Secure Deployment

·       Prior Deployment Activity

·       Check the Integrity of Application Package Before Deployment

·       Review the Deployment Guide Provided by the Software Vendor

·       Deployment Activities: Ensuring Security at Various Levels

·       Host Level Deployment Security

·       IIS level Deployment Security

·       SQL Server Level Deployment Security §

·       Ensuring Security at Host Level

·       Check and Configure the Security of Machine Hosting Web Server, Application Server, Database Server and Network Devices

·       Physical Security

·       Host Level Security

·       Ensuring Security at Network Level

·       Network level Security

·       Router

·       Firewall

·       Switch

·       Ensuring Security at Application Level §

·       Web Application Firewall (WAF)

·       Benefits of WAF

·       WAF Limitations

·       WAF Vendors

·       Ensuring Security at Web Container Level

·       Install and Configure Tomcat Securely

·       Remove Server Banner

·       Start Tomcat with Security Manager

·       Configure Default Servlet Not to Serve Index Pages

·       Replace Default Error Page

·       Replace Default server.xml

·       Protect Shutdown Port

·       Restrict Access to Tomcat Manager Applications

·       Protecting Resources with Realms

·       Store Passwords as Digest

·       Do Not Run Tomcat as Root

·       Configure Restricted Datasets

·       Session Handling using App Mode in Tomcat

·       Role Based Security

·       Securing Tomcat at Network level

·       Java Runtime Security Configurations

·       Tomcat General Security Setting

·       Verify Trace Element Setting in sever.xml

·       Verify CustomError Settings in web.xml

·       Verify maxPostSize Setting

·       Tomcat Security Checklist

·       Checklist for Security Configuration in server.xml File in Apache Tomcat

·       Tomcat High Availability

·       Best Practices for Securing Tomcat

·       Ensuring Security in Oracle

·       Oracle Database General Security Overview

·       Methods of Authentication in Oracle

·       Authentication by Oracle Database

·       Oracle Security Features

·       Default Database Installation and Configuration Security

·       Managing User Accounts Securely for the Site

·       Securing User Accounts

·       Password Management

·       Lock all Expired Accounts

·       Assign Users to Password Profile

·       Disable Remote Operating System Authentication

·       Securing Data

·       Restrict Access to Operating System Directories

·       Securing Database Installation and Configuration

·       Securing Network

·       How to Configure Encryption on the Client and the Server

·       Control Access Data

·       Virtual Private Database

·       Oracle Label Security

·       Database Vault

·       Management and Reports

·       Disabling the Recycle Bin

·       Audit Vault

·       Built-in Audit Tools

·       Standard Database Auditing

§          – Standard Auditing Enable Network Auditing

·       Value Based Auditing

·       Fine Grained Auditing (FGA)

·       Recommended Audit Settings

·       Security Maintenance and Monitoring

·       Post Deployment Activities: Security Maintenance and Monitoring

·       Security Maintenance Activities at OS Level

·       Security Maintenance Activities at Web Container Level

·       Security Maintenance Activities at Application Level

All EC-Council certification courses are conducted by certified trainers from Iverson.

Digital Methods acts as the official training partner and assists with program consultation, registration, coordination, scheduling, and administrative arrangements to ensure a smooth and professionally managed training experience.