DEV544: Secure Coding in .NET: Developing Defensible Applications
This class should be required for anyone in the field of software development.
DEV544 covers the fundamentals of security. Many tools and concepts have been introduced.
ASP.NET and the .NET framework have provided web developers with tools that allow them an unprecedented degree of flexibility and productivity. On the other hand, these sophisticated tools make it easier than ever to miss the little details that allow security vulnerabilities to creep into an application. Since ASP.NET, 2.0 Microsoft has done a fantastic job of integrating security into the ASP.NET framework, but the responsibility is still on application developers to understand the limitations of the framework and ensure that their own code is secure.
Have you ever wondered if the built-in ASP.NET validation is effective? Have you been concerned that WCF web services might be introducing unexamined security issues into your application? Should you feel uneasy relying solely only on the security controls built into the ASP.NET framework? Secure Coding in .NET will answer these questions and far more.
What Does the Course Cover?
This is a comprehensive course covering a huge set of skills and knowledge. It's not a high-level theory course. It's about real programming. In this course you will examine actual code, work with real tools, build applications, and gain confidence in the resources you need for the journey to improving the security of .NET applications.
Rather than teaching students to use a set of tools, we're teaching students concepts of secure programming. This involves looking at a specific piece of code, identifying a security flaw, and implementing a fix for flaws found on the OWASP Top 10 and CWE/SANS Top 25 Most Dangerous Programming Errors.
The class culminates with a security review of a real-world open source application. You will conduct a code review, review a penetration test report, perform security testing to actually exploit real vulnerabilities, and finally, using the secure coding techniques that you have learned in class, implement fixes for these issues.
Section 6.5 of the Payment Card Industry (PCI) Data Security Standard (DSS) instructs auditors to verify that processes exist that require training in secure coding techniques for developers. If your application processes cardholder data and you are required to meet PCI compliance then this course is for you.
DEV544.1: Data Validation
Mon Sep 16th, 2013
9:00 AM - 5:00 PM
Improper data validation is the root cause of the most prevalent web application vulnerabilities today. Beginning on the first day, you will learn about some of the most prevalent web applications vulnerabilities such as XSS, SQL Injection, Open Redirects, and Parameter Manipulation. You will see how to find these issues and how to recreate them in a running application. Then you will use a variety of methods to actually fix these vulnerabilities in your C# code.
The course is full of hands on exercises where you can apply practical data validation techniques that you can use to prevent common attacks with defense ranging from input validation, output encoding, and use of new techniques like Content Security Policy.
CPE/CMU Credits: 6
- Web Application Attacks
- Web Application Proxies
- Parameter Manipulation
- Cross-Site Scripting (XSS)
- Open Redirect
- SQL Injection
- HTTP Response Splitting
- Input Validation
- Indirect Selection
- Regular Expressions
- Event Validation
- Character Encoding
- Command Encoding
- Content Security Policy
- LINQ & Entity Framework
DEV544.2: Authentication & Session Management
Tue Sep 17th, 2013
9:00 AM - 5:00 PM
Broken authentication and session management are common issues that can compromise the integrity of your system. Weak authentication protections can allow an attacker to expose your most sensitive secrets: your data! You will learn about these vulnerabilities and what you can do to design and code stronger authentication protections from the start. You will learn how to use ASP.NET Authentication mechanisms and securely implement Form Based Authentication.
Session management attacks and defenses are covered, including Session Hijacking, Cross-Site Request Forgery (CSRF), and Clickjacking.
CPE/CMU Credits: 6
- Authentication Factors
- Authentication Attacks
- Authorization Attacks
- Password Management
- Basic, Digest, & Windows Authentication
- Forms Authentication & Membership Provider
- Race Conditions
- Session Identifiers
- Man-in-the-middle (MITM) Attacks
- Cross-Site Request Forgery (CSRF)
- Session Hijacking
- Session Fixation
- Session Management
- Cookie Security
DEV544.3: Secure .NET Architecture
Wed Sep 18th, 2013
9:00 AM - 5:00 PM
Understanding how to leverage .NET to design a secure architecture with solid secure coding principals is critical to application security. This course combines tried and tested information security principals with secure coding principals to help you build rock solid applications.
CPE/CMU Credits: 6
- Password Storage
- String Immutability
- Numeric Overflow
- Risks of Malicious Code
- Exception Handling
- Auditing and Logging
- Web Service Security
DEV544.4: Secure Software Development Lifecycle
Thu Sep 19th, 2013
9:00 AM - 5:00 PM
We will take a look at each phase of the SDLC and discuss how security fits into the process. Using what you have learned about Web application vulnerabilities, you will get the opportunity to review code from an open source application to identify various vulnerabilities. Then, you will then perform security testing and actually exploit these weaknesses. Once they have been exploited, you will then fix them using the security coding techniques you have learned in class.
CPE/CMU Credits: 6
- Security Training
- Security Requirements
- Secure Design
- Threat Modeling
- Static Analysis
- Peer Reviews
- Secure Code Review
- Dynamic Analysis
- Penetration Test Reports
!!IMPORTANT - BRING YOUR OWN LAPTOP CONFIGURED USING THESE DIRECTIONS!!
A properly configured system is required for each student participating in this course. Before coming to class, carefully read and follow these instructions exactly.
Please download and install VMware Workstation 8, VMware Fusion 5.0, or VMware Player 5.0 or higher versions on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their web site.
VMware Player is a free download that does not need a commercial license. Most students find VMware Player adequate for the course.
Mandatory Laptop Requirements
Mandatory Host Hardware Requirements
- CPU: 2.0+ GHz processor or higher
- Memory: 4GB of RAM minimum
- Hard Disk: 20GB of free disk space
- DVD Drive (minimum 16x recommended)
- The student should have the capability to have Local Administrator Access within their host operating system
Mandatory Host Operating System Requirements
You must bring a laptop with one of the following operating systems. These operating systems have been verified to be compatible with course VMware image:
- Windows 8
- Windows 7
- Mac OS X (Lion or Mountain Lion)
Windows XP is no longer supported by Microsoft and is therefore not officially supported for this course. However, a Windows XP host operating system has been independently verified to work with the course VMware image.
Mandatory Software Requirements
Please ensure the following software is installed on the host operating system prior to class:
- VMware Workstation 8+, VMware Player 5+, or VMware Fusion 5+
- Zip File Utility (WinZip, 7Zip, or the built-in operating system zip utility)
IN SUMMARY, BEFORE YOU BEGIN THE COURSE YOU SHOULD:
- Bring the proper system hardware and operating system configuration
- Install VMware (Workstation, Player, or Fusion)
If you have additional questions about the laptop specifications, please contact firstname.lastname@example.org.
Who Should Attend
This course is intended for:
- ASP.NET developers who want to build more secure web applications
- .NET framework developers
- Software engineers
- Software architects
- Developers who need to be trained in secure coding techniques to meet PCI compliance
This class is focused specifically on software development, but it is accessible enough for anyone who's comfortable working with code and has an interest in understanding the developer's perspective. This could include:
- Application security auditors
- Technical project managers
- Senior software QA specialists
- Penetration testers who want a deeper understanding of how to target ASP.NET web applications or who want to provide more details vulnerability remediation options
Students should have the following:
- At least one year of experience working with ASP.NET and the .NET framework
- Experience with programming in ASP.NET using either Visual Basic or C#. All class work will be performed in C#
- A thorough knowledge of Web technology
- While this class briefly reviews basic web attacks, a prior understanding of web application vulnerabilities (i.e. the OWASP Top 10) is recommended.
Developers are always up against rigid deadlines, sparse and changing requirements and constant production support issues, which leaves little time for keeping up with the current threats and defenses and inevitably makes security an afterthought. Bolting security on at the end of the development phase leaves applications vulnerable and requires significantly more effort than if the applications were architected with security in mind at the beginning. CWE defines approximately 658 software weaknesses that can be introduced at different points in the software development lifecycle, and an attacker only needs to expose one of these while developers feel pressure to defend against them all. The goal of this course is not to teach developers how to write 100% secure code, but instead to help developers change their mindset to developing defensible code from the early stages of the SDL. This will allow applications to withstand an attack and provide feedback when under attack, so organizations can adjust and adapt to the changing threat landscape.
This course covers common attacks, including applicable topics from the CWE/SANS Top 25 Most Dangerous Programming Errors, the OWASP Top 10, and deficiencies in the .NET framework, while also providing solid defensive techniques. This course will change the way developers approach the design and implementation of software. Take part in this exciting class and arm yourself with the knowledge to protect your .NET applications. - Eric Johnson