Java Web Application Security Training: Securing Java Web Applications

Course Number: JAV-300
GSA/Previous Course Number: 293
Duration: 3 days
view class outline

Java Web Application Security Training Overview

This advanced course shows experienced developers of Java™ web applications how to secure those applications and to apply best practices with regard to secure enterprise coding. Authentication, authorization, and input validation are major themes, and students get good exposure to basic Java cryptography for specific development scenarios, as well as thorough discussions of HTTPS configuration and certificate management, error handling, logging, and auditing.

Location and Pricing

Most Accelebrate courses are taught on-site at our clients' locations worldwide for groups of 3 or more attendees and are customized to their specific needs. Please visit our client list to see organizations for whom we have recently delivered training. These courses can also be delivered as live, private online classes for groups that are geographically dispersed or wish to save on the instructor's or students' travel expenses. To receive a customized proposal and price quote private training at your site or online, please contact us.

In addition, some courses are available as live, online classes for individuals. To see a schedule of online courses, please visit http://www.accelebrate.com/online_training/java.htm.

Java Web Application Security Training Prerequisites

Java programming experience is essential.
Servlets programming experience is required.
JSP page-authoring experience is recommended but not required.

Hands-on/Lecture Ratio

This class is 70% hands-on, 30% lecture, with the longest lecture segments lasting for 20 minutes.

Java Web Application Security Training Materials

All Java web application security training attendees receive comprehensive courseware covering all topics listed.

Software Needed on Each Student PC

JDK 5.0 or later
Eclipse WTP 2.0 or later
Additional lab files that Accelebrate will provide - please contact us if you need a detailed setup guide.

Java Web Application Security Training Objectives

All attendees will learn how to:

Secure new and existing Java web applications.
Define security constraints and login configurations that instruct the web container to enforce authentication and authorization policies.
Validate user input aggressively, for general application health and specifically to foil injection and XSS attacks.
Configure a server and/or application to use one-way or two-way HTTPS.
Apply application-level cryptography where necessary.
Secure log files and establish audit trails for especially sensitive information or actions.

Java Web Application Security Training Outline

Secure Web Applications

Threats and Attack Vectors
Server, Network, and Browser Vulnerabilities
Secure Design Principles
GET vs. POST
Container Authentication and Authorization
HTML Forms
Privacy Under /WEB-INF
HTTP and HTTPS
Other Cryptographic Practices
SOA and Web Services
The OWASP Top 10

Authentication and Authorization

HTTP BASIC and DIGEST Authentication Schemes
Declaring Security Constraints
User Accounts
Safeguarding Credentials in Transit
Replay Attacks
Authorization Over URL Patterns
Roles
FORM Authentication
Login Form Design
EJB Authorization
Programmatic Security
Programmatic Security in JSF

Secure Application Design

Single Points of Decision
Cross-Site Scripting
Validation vs. Output Escaping
Forceful Browsing
Cross-Site Request Forgery
Request Tokens
Injection Attacks
Protections in JDBC and JPA
Session Management
Taking Care of Cookies
Validating User Input
Validation Practices
Regular Expressions
JSF Validation

HTTPS and Certificates

Digital Cryptography
Encryption
SSL and Secure Key Exchange
Hashing
Signature
Keystores
keytool
Why Keys Aren't Enough
X.509 Certificates
Certificate Authorities
Obtaining a Signed Certificate
Configuring HTTPS
Client-Side Certificates
PKCS #12 and Trust Stores
CLIENT-CERT Authentication

Application-Level Cryptography

The Java Cryptography Architecture
Secure Random Number Generation
The KeyStore API
The Signature Class
The SignedObject Class
The MessageDigest Class
The Java Cryptography Extensions
The SecretKey and KeyGenerator Types
The Cipher Class
Choosing Algorithms and Key Sizes
Dangerous Practices

Error Handling, Auditing, and Logging

Secure Development Cycle
Error Handling and Information Leakage
Failing to a Secure Mode
Logging Practices
Appropriate Content for Logs
Auditing
Strategies: Filters, Interceptors, and Command Chains
Penetration Testing
Back Doors

Conclusion

VB.NET, C#, ASP, & ASP.NET Training

Java Training

SQL Server Training
SharePoint Training

“Accelebrate,” “Accelerated Learning Celebrated Results,” and the Accelebrate logo are registered trademarks of Accelebrate, Inc. All other product names and trademarks are property of their respective owners. Course outline content may mirror or be derived from the book that each student receives with the course. Otherwise, all content is copyright © 2003- by Accelebrate, Inc. of Atlanta, Georgia, USA. To contact us, please use the contact form, email info@accelebrate.com us, or call 1 877 849 1850 in the US and Canada, 0808 234 2132 in the UK, 1 800 550 311 in Ireland, or +1 678 648 3113 from all other locations.