Java Advanced Secure Coding v3.0
Course Description
Java Advanced Secure Coding continues where Java Security Fundamentals leaves off. This course discusses advanced coding concepts and significant platform security features and applies them to practical use cases to address typical business security challenges. We cover preventing injection attacks, platform authentication and access control, cryptography, secure network communications, public key infrastructure, and web security, along with a summary of newer features introduced in Java 8/9.
Learning Objectives
- Learn about platform authentication and access control libraries, cryptography, and secure communications over untrusted networks
- Learn PKI concepts and relevant Java platform security controls, such as the CertPath API, PKIX, and OCSP/CRL revocation services
- Apply practical ideas to defend against SQL injection, XML parser attacks, CSRF, XSS, URL attacks, HTTP response redirect attacks, and more using the Java platform as well as third-party security libraries, such as OWASP
Details
Delivery Format : eLearning
Duration: 1 Hour
Level: Advanced
Intended Audience:
- Architects
- Front-End Developers
- Back-End Developers
Prerequisites: Java Security Fundamentals
Course Outline
Introduction
- Preventing Injection
- Authentication and Access Control
- Cryptography
- Secure Communications
- Public Key Infrastructure (PKI)
- Web Security
- Important Security Features in Java SE 8–11
Preventing Injection
- Introduction to Preventing Injection
- Defending Against SQL Injection: JDBC Prepared Statements
- Encoding Reserved Control Sequences Within Untrusted Input
- XML Parser Defense
Authentication and Access Control
- Java Authentication and Authorization Service (JAAS)
- Policy Management
- Sandbox Security
- Hot Waters: Building Your Own Security Controls
Cryptography
- Managing Passwords
- Ciphers
- Digital Signatures
- Secure Random Number Generation
- Heartbleed Bug
Secure Communications
- Java Secure Socket Extension
- GSS-API
- SASL-API
Public Key Infrastructure
- Java’s PKI Model Support
- Trust Management in Java
- Java CertPath API
- Storing Keys/Secrets
- Revocation Services
Web Security
- Cross-Site Request Forgery Defense
- CSRF Defense Example
- Advice for Defending Against CSRF Attacks
- Open Redirect Defense
- URL Validation
- HTTP Security Response Headers
- User Interface Security
Important Security Features
- Security Changes for Java 8
- Security Changes for Java 9
- Brief Considerations When Upgrading to Java 9
- Security Changes for Java 11
Training
Developer Security Training
Equip development teams with the skills and education to write secure code and fix issues faster