HARTMANN software group

Securing Java Web Applications Training

We offer private customized training for groups of 3 or more attendees.
get pricing information

Course Description

  
This course shows Java web developers how to secure their applications and to apply best practices with regard to secure enterprise coding. Authentication, authorization, and input validation are major themes, and students get good exposure to basic Java cryptography for specific development scenarios, as well as thorough discussions of HTTPS configuration and certificate management, error handling, logging, and auditing. Perhaps the most eye-opening parts of the course concern common web "hacks," or attack vectors. Students see how easy it is to leave an application unguarded against cross-site scripting (XSS), cross-site request forgery (CSRF), SQL injection, and other attack types -- and learn that it's also easy to fix such vulnerabilities and the importance of a secure development process.
Course Length: 4 Days
Course Tuition: $1690 (US)

Prerequisites
Java and Servlet programming experience is required.

Course Outline

  

Chapter 1. Concerns for Web Applications

  • Threats and Attack Vectors
  • Server, Network, and Browser Vulnerabilities
  • Secure Design Principles
  • GET vs. POST
  • Container Authentication and Authorization
  • HTML Forms
  • Privacy Under /WEB-INF
  • HTTP and HTTPS
  • Other Cryptographic Practices
  • SOA and Web Services
  • The OWASP Top 10

Chapter 2. Authentication and Authorization

  • HTTP BASIC and DIGEST Authentication Schemes
  • Declaring Security Constraints
  • User Accounts
  • Safeguarding Credentials in Transit
  • Replay Attacks
  • Authorization Over URL Patterns
  • Roles
  • FORM Authentication
  • Login Form Design
  • Session Fixation
  • Protections
  • Programmatic Security
  • Programmatic Security in JSF

Chapter 3. Common Web Attacks

  • Forceful Browsing
  • Predictable Resource Locations
  • Using Random Numbers
  • Cross-Site Scripting
  • Output Escaping
  • Cross-Site Request Forgery
  • Synchronizer Tokens
  • Injection Attacks
  • Protections in JDBC and JPA
  • Session Management
  • Taking Care of Cookies

Chapter 4. Input Validation

  • Validating User Input
  • Validation Practices
  • Regular Expressions
  • Bean Validation (a/k/a JSR-303)
  • Constraint Annotations
  • Cross-Field Validation
  • Built-In Support in Java EE
  • Using a Validator
  • Producing Error Responses
  • JSF Validation

Chapter 5. HTTPS and Certificates

  • Digital Cryptography
  • Encryption
  • SSL and Secure Key Exchange
  • Hashing
  • Signature
  • Keystores
  • keytool
  • Why Keys Aren't Enough
  • X.509 Certificates
  • Certificate Authorities
  • Obtaining a Signed Certificate
  • Configuring HTTPS
  • Client-Side Certificates and Two-Way SSL
  • PKCS #12 and Trust Stores
  • CLIENT-CERT Authentication

Chapter 6. Application-Level Cryptography

  • The Java Cryptography Architecture
  • Secure Random Number Generation
  • The KeyStore API
  • Digital Signature
  • Hashing
  • Password Hashing
  • Why Hashing Isn't Enough
  • Salts
  • Key Lengthening and Key Strengthening
  • Slow Algorithms
  • The Java Cryptography Extensions
  • The SecretKey and KeyGenerator Types
  • Symmetric Encryption
  • Choosing Algorithms and Key Sizes
  • Dangerous Practices
  • Storing and Managing Keys

Chapter 7. Secure Development Practices

  • Secure Development Cycle
  • Penetration Testing
  • Secure Code Review
  • Error Handling and Information Leakage
  • Failing to a Secure Mode
  • Designing for Failure
  • Back Doors
  • Logging Practices
  • Appropriate Content for Logs
  • Auditing Strategies

Appendix A. Learning Resources

Course Directory [training on all levels]

Technical Training Courses
Software engineer/architect, System Admin ... Welcome!
Business Training Courses
Project Managers, Business Analysts, Paralegals ... Welcome!
Upcoming Classes
Gain insight and ideas from students with different perspectives and experiences.

Java Programming Uses & Stats

Java Programming is Used For:
Android & IOS Development Software Products Video Games Desktop GUI's
Difficulty
Popularity
Year Created
1995
Pros

Most Commonly Used: 
According to Oracle, three billion devices run on Java.  And, because of its real-world applications, it consistently ranks at the top of the TIOBE Programming Community Index. 

Great Career Choice: 
Some of the fastest-growing salaries in the U.S. in 2018 are for Java developers.  (Glassdoor)  

Android Apps Development:
Developers predominatly use their Java skills in building apps for Google's Android. The Android platform is the number one mobile paltform in the world

It Can Run On Any Platform:
Java can compile on Windows and run the same compiled file on Linux, Windows and Mac.

Great Supporting IDE's:
Over the years, coding in Java has become simpler with the introduction of open source development tools, i.e. Eclipse and NetBeans that use Java capabilities for debugging.  
 
Cons

Uses a Lot of Memory:
Performance can be significantly slower with Java and more memory-consuming than natively compiled languages such as C or C++.

Difficulty in Learning: 
Learning Java can be a bit challenging if you are a beginner.  However, once you get the hang of Object Oriented Programming and a decent grasp of the syntax, you will be well on your way.

Slow Start Up Times:
There is quite a bit of one-time initialization done by JDK classes before compiling as well as loading classes and verification (making sure code doesn't do evil things, all of which takes longer that some other languages such as C. 

Verbose and Complex Code:
Long, over-complicated sentences make code less readable and scannable. Compare to let's say Python, we can see how clear Python code appears: It doesn’t require semicolons; uses “and,” “or,” and “not” as operators instead of Java’s “&&,” “||,” and “!”; and generally has fewer bells and whistles such as parentheses or curly braces.

Commercial License Cost:
Companies have to prepare for the changes that Oracle will institute in 2019 . Today, the current version of Java is free and available for redistribution for general purpose computing. However, If you are a DEVELOPER, Oracle recommends you review the roadmap information for Java SE 8 and beyond and take appropriate action depending on the type of application you develop and your distribution mode.
Java Programming Job Market
Average Salary
$102,000
Job Count
26,856
Top Job Locations

New York City 
San Jose
Washington D.C, 
Complimentary Skills to have along with Java Programming

- If you are an experienced Java developer, learning a complimentary language to Java should come much more naturally.  As an example JetBrains recently created the Kotlin programming language which is officially supported by Google for mobile development.  Kotlin compiles to Java bytecode and runs on the JVM; it's purported to address many of Java's shortcomings...

Interesting Reads Take a class with us and receive a book of your choosing for 50% off MSRP.