Szkolenia SCADEMY

Cel szkolenia szkolenie zdalne - dlearning

kod: CL-ANW | wersja: 1.0

Implementing a secure networked application can be difficult, even for developers who may have used various cryptographic building blocks (such as encryption and digital signatures) beforehand. In order to make the participants understand the role and usage of these cryptographic primitives, first a solid foundation on the main requirements of secure communication – secure acknowledgement, integrity, confidentiality, remote identification and anonymity – is given, while also presenting the typical problems that may damage these requirements along with real-world solutions.

As a critical aspect of network security is cryptography, the most important cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement are also discussed. Instead of presenting an in-depth mathematical background, these elements are discussed from a developer's perspective, showing typical use-case examples and practical considerations related to the use of crypto, such as public key infrastructures. Security protocols in many different areas of secure communication are introduced, with an in-depth discussion on the most widely-used protocol families such as IPSEC and SSL/TLS.

Finally, as XML technology is central for data exchange by networked applications, the security aspects of XML are described. This includes the usage of XML within web services and SOAP messages alongside protection measures such as XML signature and XML encryption – as well as weaknesses in those protection measures and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will:

  • Understand basic concepts of security, IT security and secure coding
  • Understand the requirements of secure communication
  • Learn about network attacks and defenses at different OSI layers
  • Have a practical understanding of cryptography
  • Understand essential security protocols
  • Understand some recent attacks against cryptosystems
  • Learn about typical coding mistakes and how to avoid them
  • Get information about some recent vulnerabilities in the Java framework
  • Learn about XML security
  • Get information about some recent related vulnerabilities
  • Get sources and further readings on secure coding practices

Audience:

Network engineers and developers

Plan szkolenia Rozwiń listę

  1. IT security and secure coding
    • Nature of security
    • What is risk?
    • IT security vs. secure coding
    • From vulnerabilities to botnets and cybercrime
      • Nature of security flaws
      • Reasons of difficulty
      • From an infected computer to targeted attacks
      • The Seven Pernicious Kingdoms
      • OWASP Top Ten 2017
  2. Requirements of secure communication
    • Security levels
    • Secure acknowledgment
      • Malicious message absorption
        • Feasibility of secure acknowledgment
        • The solution: Clearing Centers
      • Inadvertent message loss
    • Integrity
      • Error detection - Inadvertent message distortion (noise)
        • Modeling message distortion
        • Error detection and correction codes
      • Authenticity - Malicious message manipulation
        • Modeling message manipulation
        • Practical integrity protection (detection)
      • Non-repudiation
        • Non-repudiation
      • Summary
        • Detecting integrity violation
    • Confidentiality
      • Model of encrypted communication
      • Encryption methods in practice
      • Strength of encryption algorithms
    • Remote identification
      • Requirements of remote identification
    • Anonymity and traffic analysis
      • Model of anonymous communication
      • Traffic analysis
      • Theoretically strong protection against traffic analysis
      • Practical protection against traffic analysis
    • Summary
      • Relationship between the requirements
  3. Network security
    • Overview
      • The TCP/IP stack
    • Data Link layer
      • Sniffing attacks
        • What is a sniffer?
        • A revision on hubs and switches
        • MAC flooding
      • Spoofing
        • Spoofing attacks
        • Address Resolution Protocol (ARP)
        • ARP spoofing
        • Dynamic Host Configuration Protocol (DHCP)
        • DHCP starvation
      • Man-in-the-Middle
        • Man-in-the-Middle
        • Man-in-the-Middle with ARP poisoning
        • Rogue DHCP server
      • Attacks against VLANs
        • VLANs, Native VLANs, DTP
        • VLAN hopping, Switch spoofing
        • Double tagging
      • Data Link layer protections
        • Segmentation
        • Detecting sniffing tools
        • VLAN security
        • Port Security
        • DHCP snooping
        • Dynamic ARP Inspection (DAI)
        • Private VLANs
  4. Network security
    • Network layer
      • IP address spoofing
      • Maximum Transmission Unit
      • Fragmentation attack
      • ICMP attacks
        • Internet Control Message Protocol (ICMP)
        • Smurf attack
        • Ping of death
        • Route hijacking
      • Network layer protections
        • Ingress filtering, Egress filtering
        • IP Source Guard
        • Firewalls
        • Packet filtering firewalls
        • Intrusion Detection/Prevention Systems
    • Transport layer
      • Transmission Control Protocol (TCP)
        • Transmission Control Protocol
        • SYN flood
        • TCP session hijacking
      • User Datagram Protocol (UDP)
        • User Datagram Protocol
        • UDP flooding
      • Routing protocols
        • Routing protocols
      • Fingerprinting and service detection
        • connect() scan
        • SYN scan
        • FIN scan
        • X-mas scan
      • Transport layer protection
        • SYN proxy
        • SYN cookies
        • Stateful firewalls
        • Routing protocol security
    • Application layer
      • Domain Name System
      • DNS Spoofing
      • Application layer protections
        • Application-level firewalls
        • Application layer security solutions
        • Secure protocols
  5. Practical cryptography
    • Rule #1 of implementing cryptography
    • Cryptosystems
      • Elements of a cryptosystem
      • Java Cryptography Architecture / Extension (JCA/JCE)
      • Using Cryptographic Service Providers
    • Symmetric-key cryptography
      • Providing confidentiality with symmetric cryptography
      • Symmetric encryption algorithms
      • Modes of operation
      • Private (symmetric) key cryptography in Java
    • Other cryptographic algorithms
      • Hash or message digest
      • Hash algorithms
      • SHAttered
      • Hashing in Java: MessageDigest class
      • MAC and password-based encryption in Java: Mac class
      • Message Authentication Code (MAC)
      • Providing integrity and authenticity with a symmetric key
      • Random number generation
        • Random numbers and cryptography
        • Cryptographically-strong PRNGs
        • Weak and strong PRNGs in Java
        • Hardware-based TRNGs
        • Exercise RandomTest
        • Using random numbers in Java – spot the bug!
        • Testing random number generators
        • Exercise – Testing random number generators
    • Asymmetric (public-key) cryptography
      • Providing confidentiality with public-key encryption
      • Rule of thumb – possession of private key
      • The RSA algorithm
        • Introduction to RSA algorithm
        • Encrypting with RSA
        • Combining symmetric and asymmetric algorithms
        • Digital signing with RSA
        • Exercise Sign
    • Public Key Infrastructure (PKI)
      • Man-in-the-Middle (MitM) attack
      • Digital certificates against MitM attack
      • Certificate Authorities in Public Key Infrastructure
      • X.509 digital certificate
      • The Java Keystore (JKS)
      • Java Certification Path (CertPath)
    • Web of Trust (WoT)
      • Web of Trust (WoT) – introduction
      • WoT example
      • Challenges of Web of Trust
  6. Security protocols
    • Secure network protocols
    • Specific vs. general solutions
    • IPSEC protocol family
      • IPSEC standards
      • Security Association (SA)
      • Message formats
      • AH packet structure
      • ESP packet structure
      • Protected channels
      • More complex set-ups
      • Traffic control
      • SA structure
      • Key management
    • The TLS protocol
      • SSL and TLS
      • Usage options
      • Security services of TLS
      • SSL/TLS handshake
      • Java Secure Socket Extension (JSSE)
  7. Cryptographic vulnerabilities
    • Protocol-level vulnerabilities
      • BEAST
      • FREAK
      • FREAK – attack against SSL/TLS
      • Logjam attack
    • Padding oracle attacks
      • Adaptive chosen-ciphertext attacks
      • Padding oracle attack
      • CBC decryption
      • Padding oracle example
      • Lucky Thirteen
      • POODLE
  8. Common coding errors and vulnerabilities
    • Input validation
      • Input validation concepts
      • XML security
      • XML injection
        • (Ab)using CDATA to store XSS payload in XML
        • Exercise – XML injection
        • Protection through sanitization and XML validation
      • Abusing XML Entity
        • XML Entity introduction
        • XML bomb
        • Exercise – XML bomb
        • XML external entity attack (XXE) – resource inclusion
        • XML external entity attack – URL invocation
        • XML external entity attack – parameter entities
        • Exercise – XXE attack
        • Preventing entity-related attacks
        • Case study – XXE in Google Toolbar
      • Integer problems
        • Representation of negative integers
        • Integer overflow
        • Exercise IntOverflow
        • What is the value of Math.abs(Integer.MIN_VALUE)?
        • Integer problem – best practices
    • Improper use of security features
      • Typical problems related to the use of security features
      • Password management
        • Exercise – Weakness of hashed passwords
        • Password management and storage
        • Special purpose hash algorithms for password storage
        • Argon2 and PBKDF2 implementations in Java
        • bcrypt and scrypt implementations in Java
        • Password audit
        • Exercise – using John the Ripper
        • Case study – the Ashley Madison data breach
        • Typical mistakes in password management
        • Exercise – Hard coded passwords
    • Some well-known implementation problems
      • Case study – Heartbleed
        • TLS Heartbeat Extension
        • Heartbleed – information leakage in OpenSSL
        • Heartbleed – fix in v1.0.1g
  9. Knowledge sources
    • Secure coding sources – a starter kit
    • Vulnerability databases
    • Java secure coding sources
    • Recommended books – Java
    • Recommended books – cloud security
Pobierz konspekt szkolenia w formacie PDF

Dodatkowe informacje

Wymagania wstępne

Network engineering, general software development

Poziom trudności
Czas trwania 3 dni
Certyfikat

The participants will obtain certificates signed by SCADEMY (course completion).
Prowadzący

Authorized SCADEMY Trainer.
Informacje dodatkowe

Training come with a number of easy-to-understand exercises providing live hacking fun. By accomplishing these exercises with the lead of the trainer, participants can analyze vulnerable code snippets and commit attacks against them in order to fully understand the root causes of certain security problems. All exercises are prepared in a plug-and-play manner by using a pre-set desktop virtual machine, which provides a uniform development environment.

SCADEMY together with online application security educational platform AVATAO (more about AVATAO www.avatao.com) for each of participant SCADEMYs authorized training adds the 30 days business AVATAO trial holds the following package:

  • 30-day customized free trial

Pozostałe szkolenia SCADEMY | WEB

Wszystkie szkolenia SCADEMY
Szkolenia powiązane tematycznie

Sieci komputerowe

Campus Access | Aruba

Switches | Aruba

Security | Aruba

Design | Aruba

SD-WAN | Aruba

Management & Operations | Aruba

Network Security | Broadcom

Testy penetracyjne | Compendium CE

Fortinet | Compendium CE

Sieci | Compendium CE

Network+ | CompTIA

Wireless | CWNP

Wireless IoT | CWNP

Campus Fabric | Extreme Networks

Extreme Switching | Extreme Networks

ExtremeWireless Cloud | Extreme Networks

ExtremeControl | Extreme Networks

ExtremeCloud™ IQ – Site Engine | Extreme Networks

ExtremeCloud™ IQ – Controller | Extreme Networks

Extreme Certified Specialist (ECS) | Extreme Networks

Administering BIG IP | F5 Networks

Troubleshooting BIG IP | F5 Networks

Local Traffic Manager (LTM) | F5 Networks

Application Security Manager (ASM) | F5 Networks

Advanced WAF (AWAF) | F5 Networks

Domain Name System (DNS) | F5 Networks

Access Policy Manager (APM) | F5 Networks

Advanced Firewall Manager (AFM) | F5 Networks

VIPRION | F5 Networks

iRules | F5 Networks

FortiGate Configuration and Administration | Fortinet

Management and Analysis | Fortinet

Advanced Products | Fortinet

Diagnostics and Troubleshooting | Fortinet

HPE Networking | HPE

Routing & Switching | Huawei

NetMRI | Infoblox

Network Security | Palo Alto Networks

SASE | Palo Alto Networks

Security Operations | Palo Alto Networks

LinkProof | Radware

DefensePro | Radware

AppDirector | Radware

Alteon | Radware

E-learning | The Linux Foundation

Bezpieczeństwo

Security | Aruba

Network Security | Broadcom

Java Programming | Capstone Courseware

Java EE | Capstone Courseware

Open-Source Frameworks | Capstone Courseware

XML and Web Services | Capstone Courseware

Core Training | Check Point

Product Training | Check Point

Testy penetracyjne | Compendium CE

Informatyka śledcza | Compendium CE

Kryptografia | Compendium CE

Fortinet | Compendium CE

Security Awareness | Compendium CE

Bezpieczeństwo ICS/OT | Compendium CE

Security+ | CompTIA

CySA+ | CompTIA

PenTest+ | CompTIA

CASP+ | CompTIA

Application Security Manager (ASM) | F5 Networks

Advanced WAF (AWAF) | F5 Networks

Access Policy Manager (APM) | F5 Networks

Advanced Firewall Manager (AFM) | F5 Networks

FortiGate Configuration and Administration | Fortinet

Management and Analysis | Fortinet

Advanced Products | Fortinet

Diagnostics and Troubleshooting | Fortinet

Veeam | HPE

Data Protection | HPE

Cyber security | ISC2

Microsoft 365 | Microsoft

Windows Server Technologies | Microsoft

Security | Microsoft

Pen Testing & Ethical Hacking | Mile2

Cyber Threat Analyst | Mile2

IS Management Leadership | Mile2

Incident Handling | Mile2

Web Application Security | Mile2

Cloud Security | Mile2

Forensics | Mile2

Disaster Recovery | Mile2

Healthcare | Mile2

IS Management | Mile2

Auditing | Mile2

Cyber Range | Mile2

Security Awareness | Mile2

Network Security | Palo Alto Networks

SASE | Palo Alto Networks

Security Operations | Palo Alto Networks

Information Security | PECB®

LinkProof | Radware

DefensePro | Radware

AppDirector | Radware

Alteon | Radware

Fundamentals | SCADEMY

C# | SCADEMY

C/C++ | SCADEMY

Java | SCADEMY

PHP | SCADEMY

Python | SCADEMY

WEB | SCADEMY

Cloud | SCADEMY

Cryptography | SCADEMY

Finance | SCADEMY

Healthcare | SCADEMY

Telecome | SCADEMY

Software design | SCADEMY

Software testing | SCADEMY

Dark Web | SECO-Institute

Cyber Defence | SECO-Institute

Crisis Management | SECO-Institute

Data Protection | SECO-Institute

Linux | The Linux Foundation

E-learning | The Linux Foundation

Exam | The Linux Foundation

Security

Security | Aruba

Network Security | Broadcom

Java Programming | Capstone Courseware

Java EE | Capstone Courseware

Open-Source Frameworks | Capstone Courseware

XML and Web Services | Capstone Courseware

Core Training | Check Point

Product Training | Check Point

Testy penetracyjne | Compendium CE

Informatyka śledcza | Compendium CE

Kryptografia | Compendium CE

Fortinet | Compendium CE

Security Awareness | Compendium CE

Bezpieczeństwo ICS/OT | Compendium CE

Security+ | CompTIA

CySA+ | CompTIA

PenTest+ | CompTIA

CASP+ | CompTIA

Application Security Manager (ASM) | F5 Networks

Advanced WAF (AWAF) | F5 Networks

Access Policy Manager (APM) | F5 Networks

Advanced Firewall Manager (AFM) | F5 Networks

FortiGate Configuration and Administration | Fortinet

Management and Analysis | Fortinet

Advanced Products | Fortinet

Diagnostics and Troubleshooting | Fortinet

Veeam | HPE

Data Protection | HPE

Cyber security | ISC2

Microsoft 365 | Microsoft

Windows Server Technologies | Microsoft

Security | Microsoft