HARTMANN software group

Secure Java Web Development Training in Anaheim

Enroll in or hire us to teach our Secure Java Web Development class in Anaheim, California by calling us @303.377.6176. Like all HSG classes, Secure Java Web Development may be offered either onsite or via instructor led virtual training. Consider looking at our public training schedule to see if it is scheduled: Public Training Classes
Provided there are enough attendees, Secure Java Web Development may be taught at one of our local training facilities.
We offer private customized training for groups of 3 or more attendees.
get pricing information

Course Description

  
This comprehensive course shows experienced developers of Java EE applications how to secure those applications and to apply best practices with regard to secure enterprise coding. Authentication, authorization, and input validation are major themes, and students get good exposure to basic Java cryptography for specific development scenarios, as well as thorough discussions of HTTPS configuration and certificate management, error handling, logging, and auditing. Perhaps the most eye-opening parts of the course concern common web "hacks," or attack vectors. Students see how easy it is to leave an application unguarded against cross-site scripting (XSS), cross-site request forgery (CSRF), SQL injection, and other attack types -- and learn that it's also easy to fix such vulnerabilities and the importance of a secure development process. In the last part of the course we move beyond the scope of traditional, interactive web applications to consider RESTful web services, single sign-on systems, and third-party authorization. Students learn to perform HMAC cryptography as a means of HTTP message-level authentication, and get introductions and hands-on exercise with SAML SSO and OAuth.
Course Length: 5 Days
Course Tuition: $2090 (US)

Prerequisites
Java and Servlet programming experience is required.

Course Outline

  

Chapter 1. Concerns for Web Applications

  • Threats and Attack Vectors
  • Server, Network, and Browser Vulnerabilities
  • Secure Design Principles
  • GET vs. POST
  • Container Authentication and Authorization
  • HTML Forms
  • Privacy Under /WEB-INF
  • HTTP and HTTPS
  • Other Cryptographic Practices
  • SOA and Web Services
  • The OWASP Top 10

Chapter 2. Authentication and Authorization

  • HTTP BASIC and DIGEST Authentication Schemes
  • Declaring Security Constraints
  • User Accounts
  • Safeguarding Credentials in Transit
  • Replay Attacks
  • Authorization Over URL Patterns
  • Roles
  • FORM Authentication
  • Login Form Design
  • Session Fixation
  • Protections
  • Programmatic Security
  • Programmatic Security in JSF

Chapter 3. Common Web Attacks

  • Forceful Browsing
  • Predictable Resource Locations
  • Using Random Numbers
  • Cross-Site Scripting
  • Output Escaping
  • Cross-Site Request Forgery
  • Synchronizer Tokens
  • Injection Attacks
  • Protections in JDBC and JPA
  • Session Management
  • Taking Care of Cookies

Chapter 4. Input Validation

  • Validating User Input
  • Validation Practices
  • Regular Expressions
  • Bean Validation (a/k/a JSR-303)
  • Constraint Annotations
  • Cross-Field Validation
  • Built-In Support in Java EE
  • Using a Validator
  • Producing Error Responses
  • JSF Validation

Chapter 5. HTTPS and Certificates

  • Digital Cryptography
  • Encryption
  • SSL and Secure Key Exchange
  • Hashing
  • Signature
  • Keystores
  • keytool
  • Why Keys Aren't Enough
  • X.509 Certificates
  • Certificate Authorities
  • Obtaining a Signed Certificate
  • Configuring HTTPS
  • Client-Side Certificates and Two-Way SSL
  • PKCS #12 and Trust Stores
  • CLIENT-CERT Authentication

Chapter 6. Application-Level Cryptography

  • The Java Cryptography Architecture
  • Secure Random Number Generation
  • The KeyStore API
  • Digital Signature
  • Hashing
  • Password Hashing
  • Why Hashing Isn't Enough
  • Salts
  • Key Lengthening and Key Strengthening
  • Slow Algorithms
  • The Java Cryptography Extensions
  • The SecretKey and KeyGenerator Types
  • Symmetric Encryption
  • Choosing Algorithms and Key Sizes
  • Dangerous Practices
  • Storing and Managing Keys

Chapter 7. REST Security Basics

  • Security Concerns for REST Services
  • HTTPS
  • HTTP BASIC and DIGEST
  • Authorization by URL Pattern
  • Cross-Site Scripting
  • Injection Attacks
  • Cross-Site Request Forgery
  • Common Countermeasures

Chapter 8. HMAC Security

  • Use Case: Message Authentication
  • Digital Signature
  • Hashing as Signature: the HMAC
  • Keyed Hashing
  • The Hmac Utility
  • Appropriate Salts
  • Canonicalization
  • Amazon S3
  • Timestamps
  • Signing and Verifying Messages
  • XML Cryptography and Canonicalization
  • Canonicalizing JSON

Chapter 9. SAML SSO

  • The Challenge of Single Sign-On
  • Federated Identity
  • SAML 2.0
  • The Web Browser SSO Profile
  • Identity Providers and Service Providers
  • SAML Assertions
  • SAML Protocol
  • SAML Bindings
  • Speaking "Through" the Browser
  • The HTTP Redirect Binding
  • Artifact and SOAP Bindings
  • SAML Attributes
  • Security Concerns in SSO Systems

Chapter 10. OAuth

  • Use Case: Third-Party Authorization
  • OAuth
  • Initial Flow
  • Grant Types
  • Access Tokens
  • The Google OAuth API
  • Implementing Authorization and Resource Servers
  • Implementing Clients
  • Security Concerns with OAuth

Appendix A. Learning Resources

Course Directory [training on all levels]

Technical Training Courses
Software engineer/architect, System Admin ... Welcome!
Business Training Courses
Project Managers, Business Analysts, Paralegals ... Welcome!
Upcoming Classes
Gain insight and ideas from students with different perspectives and experiences.

Software Design/Development and System Integration Uses & Stats

Software Design/Development and System Integration is Used For:
Android & IOS Development Software Products Video Games Desktop GUI's
Difficulty
Popularity
Year Created
1995
Pros

Most Commonly Used: 
According to Oracle, three billion devices run on Java.  And, because of its real-world applications, it consistently ranks at the top of the TIOBE Programming Community Index. 

Great Career Choice: 
Some of the fastest-growing salaries in the U.S. in 2018 are for Java developers.  (Glassdoor)  

Android Apps Development:
Developers predominatly use their Java skills in building apps for Google's Android. The Android platform is the number one mobile paltform in the world

It Can Run On Any Platform:
Java can compile on Windows and run the same compiled file on Linux, Windows and Mac.

Great Supporting IDE's:
Over the years, coding in Java has become simpler with the introduction of open source development tools, i.e. Eclipse and NetBeans that use Java capabilities for debugging.  
 
Cons

Uses a Lot of Memory:
Performance can be significantly slower with Java and more memory-consuming than natively compiled languages such as C or C++.

Difficulty in Learning: 
Learning Java can be a bit challenging if you are a beginner.  However, once you get the hang of Object Oriented Programming and a decent grasp of the syntax, you will be well on your way.

Slow Start Up Times:
There is quite a bit of one-time initialization done by JDK classes before compiling as well as loading classes and verification (making sure code doesn't do evil things, all of which takes longer that some other languages such as C. 

Verbose and Complex Code:
Long, over-complicated sentences make code less readable and scannable. Compare to let's say Python, we can see how clear Python code appears: It doesn’t require semicolons; uses “and,” “or,” and “not” as operators instead of Java’s “&&,” “||,” and “!”; and generally has fewer bells and whistles such as parentheses or curly braces.

Commercial License Cost:
Companies have to prepare for the changes that Oracle will institute in 2019 . Today, the current version of Java is free and available for redistribution for general purpose computing. However, If you are a DEVELOPER, Oracle recommends you review the roadmap information for Java SE 8 and beyond and take appropriate action depending on the type of application you develop and your distribution mode.
Software Design/Development and System Integration Job Market
Average Salary
$102,000
Job Count
26,856
Top Job Locations

New York City 
San Jose
Washington D.C, 
Complimentary Skills to have along with Software Design/Development and System Integration

- If you are an experienced Java developer, learning a complimentary language to Java should come much more naturally.  As an example JetBrains recently created the Kotlin programming language which is officially supported by Google for mobile development.  Kotlin compiles to Java bytecode and runs on the JVM; it's purported to address many of Java's shortcomings...

Interesting Reads Take a class with us and receive a book of your choosing for 50% off MSRP.