Secure Coding Fundamentals (OWASP)

Provided by

Enquire about this course

Overview

This course aims to teach learners about the OWASP top 10 in bite size modules, we will look at the OWASP top 10 vulnerabilities and mitigations available to any development environment. We can also teach this course over a shorter period as a facilitated 4hr workshop, focused on the specific topics of interest.

It is important to understand that this is the baseline set of security standards. Remembering that this knowledge can be reused across technology stacks.
  • Broken Access Controls
  • Cryptographic Failures
  • Injection
  • Insecure Design
  • Security Misconfiguration
  • Vulnerable and Outdated Components
  • Identification and Authentication Failures
  • Software and Data Integrity Failures
  • Security Logging and Monitoring Failures
  • Server-Side Request Forgery (SSRF)
The learner will have six months access to application security practice labs;

1. Web Application Security Analysis using OWASP-ZAP
Students will use the OWASP program;s ZAP tool suite from within Kali Linux to scan multiple web services and document vulnerabilities. Students will see ZAP in action on a vulnerable web site where entire database tables are available to potential attackers.

2. Web Application Security Analysis using Nikto
Students will use the Nikto tool to test web services over the network and document vulnerabilities. Students will then use network packet capture tools such as Wireshark to verify their understanding of the vulnerabilities and testing procedures.

3. Web Application Security Analysis using Vega
Students will use the Vega scanning tool, within a graphical Kali Linux environment, to test web services over the network and document vulnerabilities. Students will then use network packet capture tools such as Wireshark to verify their understanding of the vulnerabilities and testing procedures.

4. Web Application Security Analysis using Burp Suite
Burp Suite is an industry standard suite of tools used by information security professionals for testing Web application security. Its tools work together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security vulnerabilities.

5. Detecting and Exploiting SQL Injection Vulnerabilities
Students will learn how to detect and exploit SQL injection vulnerabilities. By using several SQL injections techniques students will gather information about a remote database such as Operating System, database type, table names and their content. Students will then use sqlmap, a tool for SQL injection, to automate this process.

6. Web Site Reconnaissance
Web site reconnaissance is about gathering information about a web site. Of course, there is information published on the website that is intended for people to see. Then there is information such as the name and version of the software used in the website and information about databases used by web applications on the site. This is information the website owner may not want known but can be discovered using techniques covered by CYRIN labs in the Network Monitoring and Recon and Web Application Security Analysis categories.

Prerequisites

There are no prerequisites for this course.

Delegates will learn how to
  • Identify the OWASP Top 10 Vulnerabilities
  • Explain how these vulnerabilities could be exploited
  • Outline potential impact and consequences of web-based attacks
  • Describe baseline mitigation steps and techniques to prevent common web and application-based attacks
Outline

OWASP Top Ten Overview

Our course takes the learner through the OWASP Top Ten. Each issue is introduced, practical examples are given using our application security labs to show the potential impact, whilst countermeasures and secure coding techniques are discussed. We cover the following topics;
  • Broken Access Controls
  • Cryptographic Failures
  • Injection
  • Insecure Design
  • Security Misconfiguration
  • Vulnerable and Outdated Components
  • Identification and Authentication Failures
  • Software and Data Integrity Failures
  • Security Logging and Monitoring Failures
  • Server-Side Request Forgery (SSRF)
  • In this short secure coding fundamentals course you will be introduced to the OWASP Top Ten labs, providing a live demonstration of some of the OWASP Top Ten vulnerabilities.
Delegates can also try some of the exploits in these specific labs.
  • Broken Access Controls (Broken Authentication)
  • Injection
  • Security Misconfiguration
  • Server-Side Request Forgery (SSRF)

Enquire

Start date Location / delivery
02 Sep 2022 QA On-Line Virtual Centre, Virtual Book now
01132207150 01132207150

Related article

QA's practice director of Cyber Security, Richard Beck, rounds up the latest cyber security news.