Catalogue | Kaïna-com Academy

Prérequis

Expérience et compréhension du développement d'applications Un niveau d'anglais business moyen est requis car la formation sera dispensée en anglais.

Public

Les développeurs d'applications et tous ceux qui cherchent à mieux comprendre comment créer des applications sécurisées.

Objectifs

En matière de sécurité, l'accent a principalement été mis sur la sécurisation de l'infrastructure réseau (pare-feu, VPN, etc.) et du système d'exploitation du serveur (par exemple, les systèmes de gestion des correctifs). Cependant, au cours des dernières années, l'accent s'est déplacé vers la couche application. En effet, la sécurité de l'infrastructure (réseau et système d'exploitation) s'est considérablement améliorée tandis que les applications sont restées vulnérables. La couche application est devenue la principale cible des attaques, tandis que les applications sécurisées sont devenues synonymes de meilleure qualité.
Le cours couvre les différents aspects de la sécurité des applications, y compris l'authentification, l'autorisation, l'audit, la confidentialité et l'intégrité des données, ainsi que les différentes technologies répondant à ces exigences. Il comprend le modèle d'analyse des risques et explique comment l'utiliser pour analyser les risques associés aux vulnérabilités des applications.
Les participants apprennent à créer des applications sécurisées : en commençant par inclure la sécurité dans le cycle de vie de développement d'applications et en continuant à sécuriser les pratiques de codage et les outils de test de sécurité.

Introduction

· The risks caused by unsecure applications: application vulnerabilities and associated threats

· Examples of application layer attacks and associated risks

· Security infrastructure and how it helps to protect the application

Encryption and hash functions

· Ensure data confidentiality and data integrity

· Symmetric encryption

· Asymmetric encryption

· Message hash functions and HMAC

· Digital signatures and digital certificates

· How to secure the data

· Crypto++ examples

· Confidentiality best practices

Authentication and Identity Management

· Passwords including password management

· Challenge-resp authentication and tokens

· One-time passwords (OTP) and OTP tokens

· Smart cards and public key technology

· Password storage and management

· Brute force and dictionary attacks

· Biometric authentication

· Two factor authentication

· Ticket based authentication

· Digital certificates

· PKI / PAM / RADIUS / ID Management

Application Layer Vulnerabilities

· Coding vulnerabilities

· Business logic vulnerabilities

Input Validation

· Server side validation

· Client side validation

· Input validation using positive security logic

· Input validation using negative security logic

· Canonicalization and evasion

· Injection attacks and countermeasures

Authorization and Access Control

· The principle of least privileges

· Access control matrix

· Discretionary Access Control (DAC)

· Mandatory Access Control (MAC)

· Role Based Access Control (RBAC)

· Distributed enforcement model with centralized management

Auditing and Logging

· The need

· Central logging

· Auditing and log analysis

Risk Analysis and Threats

· Vulnerability, threat and risk

· Risk analysis and risk mitigation

· Security risks

· Identifying threats

· STRIDE threat model and threat modeling

· DREAD and risk management

· Responding to threats (risk mitigation)

SDLC – Secure Development Life Cycle

· The Methodology

· Integrating security requirements

· Secure design

· Secure coding

· Security testing

· Security in deployment, support and maintenance

· Security policy management

Secure Design

· Guidelines to designing secure applications

· Reducing the attack surface

· Identifying trusts and secrets

Threat Modeling and SDLC Tools

· Microsoft threat analysis and modeling tool

· Pattern and practice check lists

· Creating a threat model

Application Layer Vulnerabilities

· Business logic vulnerabilities

· Coding vulnerabilities

· Web application vulnerabilities

Web Services Security Standards

· XML encryption

· XML digital signatures

· SAML

· XCAML

· Web service security

Secure Communication Protocols

· SSL

· IPSec

The End

· Summary

· Q&A

· Course’s Evaluation

David Movshovitz

Lecturer at LOGTEL

A propos

Dr. David Movshovitz is a senior lecturer at LOGTEL. David brings with him 30 years of experience in information security with a broad view of the range of topics necessary to build a comprehensive and efficient data protection system for product / system it must protect. He is software engineering and information security expert, and is teaching academic courses on Web-Application-Security and on Developing Secure Applications in Inter Disciplinary Center (IDC) in Herzalia and in Michlelet Tel-Aviv. Dr. Movshovitz headed a R&D team in the IDF that has earned the Israeli Defense Award for professional excellence. After his departure from the military, Dr. Movshovitz has served in senior R&D positions in the Hi-Tech industry (e.g. Elscint, Taldor Group, F5 Networks). Dr. Movshovitz was a co-founder and VP R&D at Algotec Systems Ltd. that was acquired by Kodak, a CTO and VP R&D of Magnifire Ltd. that was acquired by F5 Networks, and a CTO of Navajo Systems Ltd. that has been acquired by Salesforce.com. Dr. Movshovitz earned his doctorate in Physics from Bar-Ilan University.

Développer des applications sécurisées - Avancée

Prérequis

Public

Objectifs

Des questions ?

Nos autres formations sur le même thème