Overview

You cannot win the battle if you do not understand what you are trying to defend. Day one starts with an overview of recent web application attack and security trends, followed by an examination of the essential technologies that are at play in web applications. We arm you with the right information so you can understand how web applications work and the security concepts related to them.

Modern web applications are supported by a combination of server infrastructure, cloud infrastructure, and possibly other data sources. The code in an application may be fully locked down, but if the server setting is insecure, the server running the application can be easily compromised. Locking down the web environment is essential, so we cover this basic concept of defending the platform and host. You will learn the common pitfalls of infrastructure and cloud security with web applications so you can properly secure them.

As automation is becoming a critical element of the development process, infrastructure and development components are built and maintained through configurations. The management of these configurations is crucial to the security of the application. We cover the best-practice processes and key aspects of securing web-application-related configurations, from infrastructure to cloud environments and web-server-level configurations, so that you can protect your configurations and related supporting environments for precious web applications.

Overview

Day two is devoted to protecting against threats arising from external input. Modern applications have to accept input from multiple sources, such as other applications, browsers, and web services. Web application attacks during the past few years have reminded us that these attack patterns are employed frequently.

We start the day with a discussion of SQL injection. The basic mechanics of the attack are covered, followed by real-world examples and defense patterns that work in large applications. We then look at cross-site request forgery, which is a common attack against session mechanisms. We'll cover the history of the attack and the modern patterns of defense in-depth to protect your web application against cross-site request forgery.

This is followed by a detailed discussion of cross-site scripting, the most common vulnerability in web applications. Cross-site scripting is not a complex attack, but the large attack surface makes it difficult to effectively defend against it. We'll focus on real-world cross-site scripting mitigation and testing strategies in enterprise environments.

Next we will cover business logic flaws and concurrency. These are difficult topics to detect with automated scanners, so it is essential that security professionals understand these problems and avoid them at all costs.

Overview

Day three starts with a discussion of authentication in web applications, followed by examples of exploitation and the mitigations that can be implemented in the short and long terms. Considering the trend to move towards less reliance on passwords for authentication, we cover the modern patterns of password-less authentication and multifactor authentications. We complete the discussion by providing information on how to discover and test for vulnerabilities.

Another topic is the new generation of single-sign-on solutions such as OAuth and related technologies such as JWT and OpenID Connect. We cover the implications of using these authentication/authorization systems and the common "gotchas" to avoid.

Authentication is followed by a discussion of authorization. A web application needs not only to accurately identify a user, but also needs to restrict access to information (access control) based on the user's privileges. You will learn the right way to plan for access control during the development life cycle and the common pitfalls when implementing such control. Similar to the discussion on authentication, we start with the vulnerabilities and then move on to mitigations and testing, followed by a section on best practices.

The Internet does not guarantee the secrecy of information being transferred. Encryption is commonly used to protect the integrity and confidentiality of information exchanged with web applications. This course day covers the security of data in transit as well as on disk and how encryption can help secure that information in the context of web application security.

We continue with a discussion of session management in web applications. We will go over a hacker's technique in attacking the session mechanism and related defense strategies. We'll present best practices of session security to ensure that your application's session management is as strong as possible.

Overview

We'll start day four by focusing on proactive defense mechanisms so that we can be ahead of the bad guys in the game of hack-and-defend. We will cover such topics as handling file uploads, intrusion detection, and the use of deception. The material is designed to give you the extra edge in defending your application.

We'll then pivot to the security of asynchronous JavaScript and XML (AJAX) and web services, which are currently the most active areas in web application development. Security issues continue to arise as organizations dive headfirst into insecurely implementing new web technologies without first understanding them.

We will cover security issues, mitigation strategies, and general best practices for implementing AJAX and web services (both SOAP and REST). We will also examine real-world attacks and trends to give you a better understanding of exactly what you are protecting against.

We end the day with multiple client-side, header-based defense mechanisms such as Content Security Policy to help you further secure your applications. We go in-depth into how these headers can uplift the security level of an application, but we'll also look at the potential downfall of these mechanisms.

Overview

Day five focuses on cutting-edge web application technologies and current research in this area. Topics such as serialization security, clickjacking, and DNS rebinding are covered. These vulnerabilities have emerged and changed in recent years, and we are refining our defense strategies against them. We cover recent developments on these topics and the latest defensive tactics to protect against these attacks.

We will also cover the security issues related to HTML5 components and handling Unicode in the web applications world. Lots of vulnerabilities are emerging in these areas and we'll discuss the best practices to address them.

We then look at the testing aspect of web application security - ranging from the basic testing methodologies to the strategies in the modern CI/CD pipeline. Testing web applications can be challenging given the current continuous delivery schedule, so our aim is to provide relevant information to help you navigate through the testing cycles of modern-day applications.

To enable any detection of intrusion, logging and error handling must be done correctly. We will discuss the correct approach to handling incidents and logs, then dive even further to cover the modern intrusion detection aspect of web application security.

Overview

Day six starts by introducing the secure software development life cycle and how to apply it to web development. The main activity will be a large lab that will tie together the lessons learned during the week and reinforce them with hands-on applications. Students will be provided with a virtual machine to implement a complete database-driven dynamic website. In addition, they will use a custom tool to enumerate security vulnerabilities and simulate a vulnerability assessment of the website. Students will then have to decide which vulnerabilities are real and which are false positives, then mitigate the vulnerabilities. The scanner will score the student as vulnerabilities are eliminated or checked off as false positives. Advanced students will be able to extend this exercise and find vulnerabilities not presented by the scanner.

Students will learn through these hands-on exercises how to secure the web application, starting with securing the operating system and the web server, finding configuration problems in the application language setup, and finding and fixing coding problems on the site.