Sorry, not available in this language yet

English
日本語
简体中文

AppSec SaaS Platform | Integrated, cloud-based AST solution optimized for development and DevSecOps teams.
AppSec IDE Plug-ins | Secure code as you write it in your IDE
Software Risk Management | Manage application security programs at enterprise scale
DevSecOps Integrations | Integrate AppSec tools into DevOps workflows

Static Analysis (SAST) | Address security and quality defects in code as it's being developed
Software Composition Analysis (SCA) | Secure and manage open source risks in applications and containers
Interactive Analysis (IAST) | Automate web security testing within your DevOps pipelines
Dynamic Analysis (DAST) | Continuous web application security testing in production.
Penetration Testing | Identify business-critical vulnerabilities with on-demand testing expertise.
Protocol Fuzzing | Identify defects and zero-day vulnerabilities in services and protocols

Program Strategy & Planning | Measure, scale, and optimize your AppSec program
Threat & Risk Assessments | Understand and address internal and external security risks
Security Training | Equip development teams with the skills they need to produce more secure software
Implementation & Deployment | Optimize utilization, management and deployment of AppSec tools
Security Testing Services | On-demand AppSec testing resources and expertise

Open Source & Security Audits | Comprehensive technical due diligence services for M&A

AI-generated code | Harness the power of AI coding assistants while managing the risks
API Security Testing | Manage software risks with a holistic API security testing program.
AppSec Consolidation | Simplify your application security program
Application Security Testing | Solutions to address security risks at all stages of the application life cycle.
DevSecOps | Solutions to help shift security left without slowing down your development teams.
Software Supply Chain Security | Solutions to identify and manage software supply chain risks end-to-end.
Manage AppSec Risk | Scale your application security program without increasing complexity or adding friction.
Cloud & Container Security | Optimize your applications for secure deployment and operation in the cloud
Open Source License Compliance | Effective solutions for ensuring open source license compliance
M&A Due Diligence | Identify software risks that could negatively impact the value of acquired IP.
Quality & Security Standards Compliance | Ensure your software complies with the standards critical to customers and regulators

Dev and DevOps Teams | Build secure software while maintaining developer productivity and pipeline velocity.
Security Teams | Align people, processes, and technology to minimize software risk and transform your business.
Legal Teams | Solutions to protect your IP and manage risk.

Financial Services | Protect sensitive customer and financial data from rapidly evolving security threats.
IoT & Embedded | Ensure your embedded and IoT devices are safe, secure, and reliable.
Automotive | Build software security & reliability into the modern connected car.
Telecommunications | Create seamless and safe mobile experiences, from silicon to software.
Aerospace & Defense | Solutions for automating mission-critical development.
Public Sector | Application security for government agencies and their suppliers.
Medical Device | Safeguard medical devices and applications.

Defensive Programming for PHP Security

Course Description

This course covers how to design, build, and integrate with frameworks and native PHP functionality to secure applications. It is geared toward lead developers or developers with a strong interest in security, or the need to resolve threat model, secure code review, or penetration test reports. It provides students with the knowledge and skills required to protect data and applications from attack. By the conclusion of this course, students will understand how to design and implement security functionality, and how to leverage native PHP and common frameworks to secure their applications.

Learning Objectives

Authenticate users, including using modern JWT SSO, and integrate with two-factor authentication
Store sensitive state securely on the server
Build and enforce access control policies, including implementing role-based access control, as well understand capabilities-based access control, which is heavily used in mobile applications
Implement a full range of input validation and output encoding to avoid common pitfalls such as XSS and DOM XSS, and SQL injection
Design and implement secure storage of sensitive data
Configure PHP securely

Details

Delivery Format: eLearning

Duration: 1 hours 45 minutes

Level: Intermediate

Intended Audience:

Back-End Developers
Front-End Developers
Architects

Prerequisites:

Course Outline

Architecture

Introduction to PHP Architecture
Security Architecture for Responsive Web Apps
Traditional Full-Stack PHP Architecture
MVC Frameworks
Security in Microservices
Using Modern Frameworks
Object-Oriented Design
Modern Frameworks Protect Against SQL Injection
Security Helpers
Unit Testing
Principle: Defense in Depth
Principle: Least Privilege
Inter-Tier Auth/Process IDs
Encrypted Communication Between Components
Hacking Team

Authentication

Advanced Password Handling
Using JWTs
How to Integrate with JWTs
How to Authenticate
Verifying the JWT
How to Log Out
How to Support Two-Factor Authentication
Enrolling Your User in Google Two-Factor Authentication
Validating Google Codes

Session Management

Session Management in PHP
Session Management at Scale
Session Management Using Frameworks
Protecting Cookies
Scope
Cautions About Remember Me
Http Only (HttpOnly)
Secure Flag
Session Fixation and Regeneration of Session IDs
How to Access
Web Farms
Destroying Sessions and Protecting Data

Access Control

Access Control in Frameworks
Identities, Credentials, and Roles—Oh My!
Zend Framework Roles
Access Control: Capabilities-Based versus Role-Based
Business Logic Business Controls: Protecting Secured Records and Functions
ACL Matrices
Testing for Negative and Abuse Cases
Advanced CSRF Protections
Exposure of Sensitive Information at a Health Facility

Input Validation

Introduction to Input Validation
A General Framework for Input Validation
Client-Side Validation
Specific Consideration of PHP 7
Zend Framework
Input Validation Using Allowlisting
Blocklisting
Data Breach at a Free Webhost

Output Encoding

Output Encoding Basics
Output Encoding in Frameworks
PHP 7
Zend Framework
Automatic Encoding Using Template Engines

Error Handling, Logging, and Auditing

Secure Logging
Preventing Log Injection
Logging Frameworks
Auditing
Web Application Firewalls (WAFs)
Using OWASP Core Rule Set

Advanced Data Protection

Collection and Protection of Sensitive Records
The Years of the Megabreach
Concerns Both Regional and Global
Sensitive Data at Rest
Protecting Against Misuse
Protecting Against Unauthorized Change
Protecting Against Unauthorized Disclosure
Encryption for Personally Identifiable Records
Third-Party Packages
Zend Framework
ACME Cinemas in the News
CISO Response

Business Logic Flaws

Business Logic Flaws and Thinking Evil
ACME Cinemas in Booking Nightmare
Threat Modeling
Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege
Race Conditions
Easter Eggs
Discovering Time Bombs, Deliberate Logic Flaws, and Easter Eggs

Configuration

Configuration
Disabling Dangerous Functions
Dis-allow Includes from Unexpected Locations
HttpOnly
Secure Flag
Scope
Working with ZIP Files
Working with Images
EXIF Infiltration
Simple Concatenation
Backup and Incidental Files
Dependency Checks
TLS Configuration
Configuring Content Security Policies
Advanced CSP
Unsafe Inline
Unsafe Eval
Privacy Breach Due to Configuration Error

Download PDF

Training

Developer Security Training

Equip development teams with the skills and education to write secure code and fix issues faster

Learn more about developer security training