Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
I. Introduction to Secure Coding and Web Application Security
1. The Modern Threat Landscape for Web Applications
- Typical vectors for web application attacks
- Security vulnerabilities prevalent in contemporary ASP.NET applications
- The critical role of secure coding in software development
- An overview of the OWASP Foundation and its available resources
2. Principles of Secure Software Development
- Implementing security by design
- Adopting a defense-in-depth strategy
- Practicing the principle of least privilege
- Ensuring systems fail securely
- Establishing secure defaults
- Fundamentals of threat modeling
II. Secure Development Lifecycle (SDL)
1. The Secure Software Development Lifecycle
- Integrating security across the entire development lifecycle
- Defining security requirements
- Designing secure architecture
- Implementing secure coding practices
- Conducting security testing and validation
- Ensuring secure deployment and ongoing maintenance
2. Risk Assessment and Threat Modeling
- Identifying key assets and potential threats
- Analyzing the attack surface
- Overview of the STRIDE model
- Prioritizing security risks effectively
III. OWASP Top 10 for ASP.NET Applications
1. Understanding the OWASP Top 10
- Broken Access Control
- Cryptographic Failures
- Injection
- Insecure Design
- Security Misconfiguration
- Vulnerable and Outdated Components
- Identification and Authentication Failures
- Software and Data Integrity Failures
- Security Logging and Monitoring Failures
- Server-Side Request Forgery (SSRF)
2. Applying OWASP Recommendations
- Techniques for secure coding
- Implementing preventive controls
- Adopting secure configuration practices
- Exploring real-world examples and demonstrations
IV. Authentication and Authorization Security
1. Fundamentals of Authentication
- Authentication mechanisms within ASP.NET
- Password security best practices
- Implementing Multi-Factor Authentication (MFA)
- Effective session management
- Managing identities
2. Authorization and Access Control
- Role-based authorization
- Claims-based authorization
- Policy-based authorization
- Preventing privilege escalation
- Protecting sensitive resources
V. Preventing Injection Attacks
1. Understanding Injection Vulnerabilities
- SQL Injection
- Command Injection
- LDAP Injection
- XML Injection
- Overview of NoSQL Injection
2. Secure Coding Techniques for Prevention
- Using parameterized queries
- Implementing robust input validation
- Applying output encoding
- Considering security implications of Object-Relational Mappers (ORM)
- Practicing safe database access methods
VI. Preventing Cross-Site Scripting (XSS)
1. Understanding XSS
- Stored XSS attacks
- Reflected XSS attacks
- DOM-based XSS attacks
- Common attack scenarios
2. Mitigating XSS Risks
- Employing output encoding
- Conducting input validation
- Implementing Content Security Policy (CSP)
- Safely handling HTML and JavaScript content
- Leveraging ASP.NET security features designed for XSS prevention
VII. Preventing Cross-Site Request Forgery (CSRF)
1. Understanding CSRF
- Mechanics of CSRF attacks
- Common attack scenarios
- Business impact of CSRF
2. Protecting Against CSRF
- Using anti-forgery tokens
- Configuring SameSite cookies
- Managing sessions securely
- Utilizing ASP.NET anti-forgery mechanisms
VIII. Secure Configuration of ASP.NET Applications
1. Leveraging ASP.NET Security Features
- Securing application configuration
- Implementing secure HTTP headers
- Configuring HTTPS and TLS
- Managing secrets securely
- Handling errors securely
2. Protecting Sensitive Data
- Utilizing Data Protection APIs
- Securely storing credentials
- Fundamentals of encryption
- Managing cryptographic keys
IX. Input Validation and Secure Data Handling
1. Validating User Input
- Comparing whitelisting versus blacklisting approaches
- Performing server-side validation
- Considerations for client-side validation
- Securing file uploads
2. Secure Data Processing
- Ensuring serialization security
- Mitigating deserialization risks
- Maintaining data integrity
- Adopting secure logging practices
X. Penetration Testing and Security Verification
1. Penetration Testing Methodology
- Planning security assessments
- Identifying vulnerabilities
- Understanding exploitation concepts
- Reporting findings effectively
2. Security Testing Techniques
- Static Application Security Testing (SAST)
- Dynamic Application Security Testing (DAST)
- Interactive Application Security Testing (IAST)
- Analyzing dependencies and components
- Conducting manual code reviews
XI. Securing ASP.NET Applications
1. Implementing Secure Coding Practices
- Implementing secure authentication
- Implementing secure authorization
- Ensuring session security
- Managing exceptions properly
- Establishing logging and monitoring
- Considering secure deployment factors
2. Security Best Practices
- Adhering to secure coding standards
- Managing dependencies effectively
- Executing patch management
- Continuously improving security posture
XII. Hands-on Security Workshop
1. Identifying and Exploiting Common Vulnerabilities
- Analyzing insecure ASP.NET code samples
- Identifying OWASP Top 10 vulnerabilities
- Understanding various attack techniques
- Evaluating application security posture
2. Remediating Security Issues
- Applying fixes based on secure coding principles
- Validating the effectiveness of mitigations
- Testing remediated applications
- Participating in a secure coding review exercise
XIII. Summary and Course Review
1. Review of Key Concepts
- Principles of secure design
- Mitigation strategies for the OWASP Top 10
- Security features within ASP.NET
- The Secure Development Lifecycle
2. Final Discussion
- Best practices for secure coding
- Integrating security into development teams
- Exploring additional OWASP resources and tools
- Q&A session and outlining next steps
Requirements
Previous experience with ASP.NET.
Proven ability to create web applications.
21 Hours
Testimonials (5)
Introductions to the many different types of unsafe behaviors.
Zhongqi
Course - Secure Developer .NET (Inc OWASP)
having a one to one session with Raymond was amazing he was really great and attentive to all my training needs.
Joshua
Course - Secure Developer .NET (Inc OWASP)
The high level of instructor knowledge meant that we got a very good insight into the topics covered.
Dafydd - TATA Steel
Course - Secure Developer .NET (Inc OWASP)
the reference links
Abraham Gonzalez - ATEB Servicios
Course - Secure Developer .NET (Inc OWASP)
The trainer's subject knowledge was excellent, and the way the sessions were set out so that the audience could follow along with the demonstrations really helped to cement that knowledge, compared to just sitting and listening.
