Email Us   Phone : 503-259-0312   
  Home    |    Instructor-led Training    |    Online Training     


Contact Us   -   Why Choose Wintrac   -   Clients    

Courses
ADA
Adobe
Agile
AJAX
Android
Apache
AutoCAD
Big Data
BlockChain
Business Analysis
Business Intelligence
Business Objects
Business Skills
C/C++/Go programming
Cisco
Citrix
Cloud Computing
COBOL
Cognos
ColdFusion
COM/COM+
CompTIA
CORBA
CRM
Crystal Reports
Data Science
Datawarehousing
DB2
Desktop Application Software
DevOps
DNS
Embedded Systems
Google Web Toolkit (GWT)
IPhone
ITIL
Java
JBoss
LDAP
Leadership Development
Lotus
Machine learning/AI
Macintosh
Mainframe programming
Microsoft technologies
Mobile
MultiMedia and design
.NET
NetApp
Networking
New Manager Development
Object oriented analysis and design
OpenVMS
Oracle
Oracle VM
Perl
PHP
PostgreSQL
PowerBuilder
Professional Soft Skills Workshops
Project Management
Rational
Ruby
Sales Performance
SAP
SAS
Security
SharePoint
SOA
Software quality and tools
SQL Server
Sybase
Symantec
Telecommunications
Teradata
Tivoli
Tomcat
Unix/Linux/Solaris/AIX/
HP-UX
Visual Basic
Visual Foxpro
VMware
Web Development
WebLogic
WebSphere
Websphere MQ (MQSeries)
Windows programming
XML
XML Web Services
Other
Securing Java Web Applications
Version 5.0
Java Training Overview

This advanced course shows experienced developers of Java web applications how to secure those applications and to apply best practices with regard to secure enterprise coding. Authentication, authorization, and input validation are major themes, and students get good exposure to basic Java cryptography for specific development scenarios, as well as thorough discussions of HTTPS configuration and certificate management, error handling, logging, and auditing.

Java Training Prerequisites

  • Java programming experience is essential -- Course "Java Programming" is excellent preparation.
  • Servlets programming experience is required -- Course "Java Servlets"
  • JSP page-authoring experience is recommended but not required
Java Training Learning Objectives

After completing this course, the student should be able to:

  • Generally, be prepared to develop secure Java web applications, or to secure existing applications by refactoring as necessary.
  • Define security constraints and login configurations that instruct the web container to enforce authentication and authorization policies.
  • Validate user input aggressively, for general application health and specifically to foil injection and XSS attacks.
  • Configure a server and/or application to use one-way or two-way HTTPS.
  • Apply application-level cryptography where necessary.
  • Secure log files and establish audit trails for especially sensitive information or actions.
Java Training Course duration

3 Days

Java Training Course outline

Chapter 1. Secure Web Applications
  • Threats and Attack Vectors
  • Server, Network, and Browser Vulnerabilities
  • Secure Design Principles
  • GET vs. POST
  • Container Authentication and Authorization
  • HTML Forms
  • Privacy Under /WEB-INF
  • HTTP and HTTPS
  • Other Cryptographic Practices
  • SOA and Web Services
  • The OWASP Top 10
Chapter 2. Authentication and Authorization
  • HTTP BASIC and DIGEST Authentication Schemes
  • Declaring Security Constraints
  • User Accounts
  • Safeguarding Credentials in Transit
  • Replay Attacks
  • Authorization Over URL Patterns
  • Roles
  • FORM Authentication
  • Login Form Design
  • EJB Authorization
  • Programmatic Security
  • Programmatic Security in JSF
Chapter 3. Secure Application Design
  • Single Points of Decision
  • Cross-Site Scripting
  • Validation vs. Output Escaping
  • Forceful Browsing
  • Cross-Site Request Forgery
  • Request Tokens
  • Injection Attacks
  • Protections in JDBC and JPA
  • Session Management
  • Taking Care of Cookies
  • Validating User Input
  • Validation Practices
  • Regular Expressions
  • JSF Validation
Chapter 4. HTTPS and Certificates
  • Digital Cryptography
  • Encryption
  • SSL and Secure Key Exchange
  • Hashing
  • Signature
  • Keystores
  • keytool
  • Why Keys Aren't Enough
  • X.509 Certificates
  • Certificate Authorities
  • Obtaining a Signed Certificate
  • Configuring HTTPS
  • Client-Side Certificates and Two-Way SSL
  • PKCS #12 and Trust Stores
  • CLIENT-CERT Authentication
Chapter 5. Application-Level Cryptography
  • The Java Cryptography Architecture
  • Secure Random Number Generation
  • The KeyStore API
  • The Signature Class
  • The SignedObject Class
  • The MessageDigest Class
  • The Java Cryptography Extensions
  • The SecretKey and KeyGenerator Types
  • The Cipher Class
  • Choosing Algorithms and Key Sizes
  • Dangerous Practices
Chapter 6. Secure Development Practices
  • Secure Development Cycle
  • Error Handling and Information Leakage
  • Failing to a Secure Mode
  • Logging Practices
  • Appropriate Content for Logs
  • Auditing
  • Strategies: Filters, Interceptors, and Command Chains
  • Penetration Testing
  • Back Doors
Appendix A. Learning Resources

System Requirements

Minimum Hardware Requirements

  • 1 GHz, 256 meg RAM, 500 meg disk space.
Minimum Software Requirements

  • All free downloadable tools.
Hardware – recommended

  • 1.5 GHz, 512 meg RAM, 1 gig disk space.
Network and Security

  • Limited privileges required
Operating system

  • Tested on Windows XP Professional. Course software should be viable on all systems which support a J2SE 5.0 JDK.


 
About us
Contact us
Careers at Wintrac
Our Clients
Why Wintrac


Register for a free training CD-ROM drawing
Refer a client or instructor and earn $$$


Wintrac Inc.
16523 SW McGwire Ct.
Beaverton OR 97007
 
© Wintrac, Inc. All rights reserved.                                                                               Site Map   |   Terms of Use   |   Privacy Policy