Training Capstone Courseware

Training goals

code: CC-121 | version: v7.0

Version 7.0

This course shows Java web developers how to secure their applications and to apply best practices with regard to secure enterprise coding. Authentication, authorization, and input validation are major themes, and students get good exposure to basic Java cryptography for specific development scenarios, as well as thorough discussions of HTTPS configuration and certificate management, error handling, logging, and auditing.

Perhaps the most eye-opening parts of the course concern common web "hacks," or attack vectors. Students see how easy it is to leave an application unguarded against cross-site scripting (XSS), cross-site request forgery (CSRF), SQL injection, and other attack types -- and learn that it's also easy to fix such vulnerabilities and the importance of a secure development process.

Learning Objectives

  • Generally, be prepared to develop secure Java web applications, or to secure existing applications by refactoring as necessary.
  • Define security constraints and login configurations that instruct the web container to enforce authentication and authorization policies.
  • Guard against common web attacks including XSS, CSRF, and SQL injection.
  • Validate user input aggressively, for general application health and specifically to foil injection and XSS attacks.
  • Configure a server and/or application to use one-way or two-way HTTPS.
  • Apply application-level cryptography where necessary.
  • Store sensitive information securely, hash user passwords, and understand the importance of salting and of using slow hashing algorithms and processes, to maximize the safety of stored credentials.
  • Secure log files and establish audit trails for especially sensitive information or actions.

Conspect Show list

  1. Chapter 1. Concerns for Web Applications
    • Threats and Attack Vectors
    • Server, Network, and Browser Vulnerabilities
    • Secure Design Principles
    • GET vs. POST
    • Container Authentication and Authorization
    • HTML Forms
    • Privacy Under /WEB-INF
    • HTTP and HTTPS
    • Other Cryptographic Practices
    • SOA and Web Services
    • The OWASP Top 10
  2. Authentication and Authorization
    • HTTP BASIC and DIGEST Authentication Schemes
    • Declaring Security Constraints
    • User Accounts
    • Safeguarding Credentials in Transit
    • Replay Attacks
    • Authorization Over URL Patterns
    • Roles
    • FORM Authentication
    • Login Form Design
    • Session Fixation
    • Protections
    • Programmatic Security
    • Programmatic Security in JSF
  3. Common Web Attacks
    • Forceful Browsing
    • Predictable Resource Locations
    • Using Random Numbers
    • Cross-Site Scripting
    • Output Escaping
    • Cross-Site Request Forgery
    • Synchronizer Tokens
    • Injection Attacks
    • Protections in JDBC and JPA
    • Session Management
    • Taking Care of Cookies
  4. Input Validation
    • Validating User Input
    • Validation Practices
    • Regular Expressions
    • Bean Validation (a/k/a JSR-303)
    • Constraint Annotations
    • Cross-Field Validation
    • Built-In Support in Java EE
    • Using a Validator
    • Producing Error Responses
    • JSF Validation
  5. HTTPS and Certificates
    • Digital Cryptography
    • Encryption
    • SSL and Secure Key Exchange
    • Hashing
    • Signature
    • Keystores
    • keytool
    • Why Keys Aren't Enough
    • X.509 Certificates
    • Certificate Authorities
    • Obtaining a Signed Certificate
    • Configuring HTTPS
    • Client-Side Certificates and Two-Way SSL
    • PKCS #12 and Trust Stores
    • CLIENT-CERT Authentication
  6. Application-Level Cryptography
    • The Java Cryptography Architecture
    • Secure Random Number Generation
    • The KeyStore API
    • Digital Signature
    • Hashing
    • Password Hashing
    • Why Hashing Isn't Enough
    • Salts
    • Key Lengthening and Key Strengthening
    • Slow Algorithms
    • The Java Cryptography Extensions
    • The SecretKey and KeyGenerator Types
    • Symmetric Encryption
    • Choosing Algorithms and Key Sizes
    • Dangerous Practices
    • Storing and Managing Keys
  7. Secure Development Practices
    • Secure Development Cycle
    • Penetration Testing
    • Secure Code Review
    • Error Handling and Information Leakage
    • Failing to a Secure Mode
    • Designing for Failure
    • Back Doors
    • Logging Practices
    • Appropriate Content for Logs
    • Auditing Strategies
Download conspect training as PDF

Additional information

Prerequisites
  • Java programming experience is essential -- Course 103 is excellent preparation.
  • Servlets programming experience is required -- Course 111.
  • JSP page-authoring experience is recommended but not required -- again, Course 111.
Difficulty level
Duration 4 days
Certificate

The participants will obtain certificates signed by Capstone Courseware.
Trainer

Authorized Capstone Courseware Trainer.

Other training Capstone Courseware | Java EE

Capstone Courseware show more courses
Training thematically related

Security

Security | Aruba

Network Security | Broadcom

Java Programming | Capstone Courseware

Java EE | Capstone Courseware

Open-Source Frameworks | Capstone Courseware

XML and Web Services | Capstone Courseware

Core Training | Check Point

Infinity Specializations | Check Point

ICS/OT security | Compendium CE

Security+ | CompTIA

CySA+ | CompTIA

PenTest+ | CompTIA

SecurityX (formerly CASP+) | CompTIA

Certified Ethical Hacker | EC-Council

Advanced WAF (AWAF) | F5

Access Policy Manager (APM) | F5

Advanced Firewall Manager (AFM) | F5

Fortinet Certified Professional (FCP) | Fortinet

Fortinet Certified Solution Specialist (FCSS) | Fortinet

Cyber security | ISC2

Microsoft 365 | Microsoft

Security | Microsoft

Pen Testing & Ethical Hacking | Mile2

Information Systems Management | Mile2

Incident Handling | Mile2

Web Application Security | Mile2

Cloud Security | Mile2

Forensics | Mile2

Disaster Recovery | Mile2

Healthcare | Mile2

Risk Management | Mile2

Auditing | Mile2

Cyber Range | Mile2

Security Awareness | Mile2

Cyber Threat Analyst | Mile2

Network Security | Palo Alto Networks

SASE | Palo Alto Networks

Security Operations | Palo Alto Networks

ISO/IEC 27001 Information Security Management Systems | PECB®

LinkProof | Radware

DefensePro | Radware

AppDirector | Radware

Alteon | Radware

Fundamentals | SCADEMY

C# | SCADEMY

C/C++ | SCADEMY

Java | SCADEMY

PHP | SCADEMY

Python | SCADEMY

WEB | SCADEMY

Cloud | SCADEMY

Cryptography | SCADEMY

Finance | SCADEMY

Healthcare | SCADEMY

Telecome | SCADEMY

Software design | SCADEMY

Software testing | SCADEMY

Dark Web | SECO-Institute

Cyber Defence | SECO-Institute

Crisis Management | SECO-Institute

Data Protection | SECO-Institute

Kubernetes | SUSE

Linux | The Linux Foundation

E-learning | The Linux Foundation

Exam | The Linux Foundation

Java

Java Programming | Capstone Courseware

Java EE | Capstone Courseware

Open-Source Frameworks | Capstone Courseware

XML and Web Services | Capstone Courseware

Java | SCADEMY

Programming

Java Programming | Capstone Courseware

Java EE | Capstone Courseware

Open-Source Frameworks | Capstone Courseware

Databases | Capstone Courseware

XML and Web Services | Capstone Courseware

Application modernization | Google Cloud

AI and Machine Learning | Google Cloud

FinOps | Google Cloud

Azure | Microsoft

Dynamics 365 | Microsoft

Visual Studio | Microsoft

Python | Python Academy

Django | Python Academy

On Demand | Python Academy

Fundamentals | SCADEMY

C# | SCADEMY

C/C++ | SCADEMY

Java | SCADEMY

PHP | SCADEMY

Python | SCADEMY

WEB | SCADEMY

Cloud | SCADEMY

Cryptography | SCADEMY

Finance | SCADEMY

Healthcare | SCADEMY

Telecome | SCADEMY

Software design | SCADEMY

Software testing | SCADEMY

Linux | The Linux Foundation

Embedded Linux | The Linux Foundation

E-learning | The Linux Foundation

Exam | The Linux Foundation

Web development

Java EE | Capstone Courseware

Open-Source Frameworks | Capstone Courseware

XML and Web Services | Capstone Courseware

Web Application Security | Mile2

Contact form

Please fill form below to obtain more info about this training.






* Fields marked with (*) are required !!!

Information on data processing by Compendium - Centrum Edukacyjne Spółka z o.o.

TRAINING PRICE FROM 900 EUR

  • In order to propose a date for this training, please contact the Sales Department

Upcoming Capstone Courseware training

Training schedule
Capstone Courseware