Scribd
Upload
2 views7 pages

Course Overview

The document outlines the 'Essentials of Web Application Security V3.0' course, intended for web developers, managers, QA specialists, and security auditors. It covers key objectives such as understanding web application security problems, secure coding concepts, and OWASP's top vulnerabilities, along with practical labs for exploiting these vulnerabilities. The course also emphasizes integrating security into the Software Development Life Cycle (SDLC) and includes various modules on specific security issues.

Uploaded by

elmarroufy.m023
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
2 views7 pages

Course Overview

The document outlines the 'Essentials of Web Application Security V3.0' course, intended for web developers, managers, QA specialists, and security auditors. It covers key objectives such as understanding web application security problems, secure coding concepts, and OWASP's top vulnerabilities, along with practical labs for exploiting these vulnerabilities. The course also emphasizes integrating security into the Software Development Life Cycle (SDLC) and includes various modules on specific security issues.

Uploaded by

elmarroufy.m023
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Essentials of Web Application Security V3.

Module 0: Course Overview

© Copyright IBM Corporation 2014


Course materials may not be reproduced in whole or in part without the prior written permission of IBM.
About ME

Youssef BADDI Assistant Professor, UCD, El Jadida

[Link]
Research Member
n “Equipe Innovation on Digital and Enterprise Architectures”,
ENSIAS, UM5R, Rabat

Consultant Mindtech

Consultant in Computer science (MITDEV,


ENOVASQUAD …)
baddi.y@[Link]

[Link]@[Link]

or social networks

Youssef BADDI. - Spring 2


Intended audience
• Web developers
• Web development managers
• QA specialists
• Security auditors

© Copyright IBM Corporation 2014


Course objectives
• Upon completion of this course, you should be able to:
 Describe the Web application security problem
 Understand secure coding concepts
 Describe the Web Application Security Consortium ( WASC) Threat
Classifications
 Describe the Open Web Application Security Project ( OWASP) Top Ten
Web application security vulnerabilities
 Understand how simple exploits can be made
 Implement solutions to the discussed vulnerabilities
 Understand how Web application vulnerability testing can be implemented
in the Software Development Life Cycle (SDLC)
 Understand how you can use threat modeling techniques such as DREAD
(Damage, Reliability, Exploitability, Affected users, and Discoverability)
and STRIDE (Spoofing, Tampering, Repudiation, Information disclosure,
Denial of service, and Elevation of privilege) to help you identify and
prioritize Web application vulnerabilities
© Copyright IBM Corporation 2014
Course outline (1 of 2)
• Module 0: Course Overview

• Module 1: The Web Application Security Problem

• Module 2: Web Application Basics

• Module 3: Common Secure Coding Concepts

• Module 4: OWASP A1 - Injection Flaws


 Lab: Exploit SQL Injection

• Module 5: OWASP A2 Broken Authentication and Session Management


 Lab: Exploit Broken Authentication

• Module 6: OWASP A3 Cross-Site Scripting (XSS)


 Lab: Exploit Cross-Site Scripting

• Module 7: OWASP A4 Insecure Direct Object Reference


 Lab: Exploit Direct Object Reference
© Copyright IBM Corporation 2014
Course outline (2 of 2)
• Module 8: OWASP A5 Security Misconfiguration
 Lab: Exploit Security misconfigurations

• Module 9: OWASP A6 Sensitive Data Exposure


 Lab: Exploit Sensitive Data Exposures

• Module 10: OWASP A7 Missing Function Level Access Control


 Lab: Exploit Access Control

• Module 11: OWASP A8 Cross-site Request Forgery (CSRF)


 Lab: Exploit CSRF

• Module 12: OWASP A9 Using Components with Known Vulnerabilities

• Module 13: OWASP A10 Unvalidated Redirects and Forwards

• Module 14: Integrating Application Security in your SDLC

© Copyright IBM Corporation 2014


Course materials
• Materials for this course:
 Student Manual
 Student Workbook

© Copyright IBM Corporation 2014

You might also like