Securing Java Web Applications Training Course

Home Training Securing Java Web Applications

Securing Java Web Applications Training


We offer private customized training for groups of 3 or more attendees.
get pricing information
Java Programming Stats-Uses and Pros-Cons
Course Description
This course shows Java web developers how to secure their applications and to apply best practices with regard to secure enterprise coding. Authentication, authorization, and input validation are major themes, and students get good exposure to basic Java cryptography for specific development scenarios, as well as thorough discussions of HTTPS configuration and certificate management, error handling, logging, and auditing. Perhaps the most eye-opening parts of the course concern common web "hacks," or attack vectors. Students see how easy it is to leave an application unguarded against cross-site scripting (XSS), cross-site request forgery (CSRF), SQL injection, and other attack types -- and learn that it's also easy to fix such vulnerabilities and the importance of a secure development process. Course Length: 4 Days Course Tuition: $1690 (US)

Prerequisites
Java and Servlet programming experience is required.

Course Outline

Chapter 1. Concerns for Web Applications

Threats and Attack Vectors
Server, Network, and Browser Vulnerabilities
Secure Design Principles
GET vs. POST
Container Authentication and Authorization
HTML Forms
Privacy Under /WEB-INF
HTTP and HTTPS
Other Cryptographic Practices
SOA and Web Services
The OWASP Top 10

Chapter 2. Authentication and Authorization

HTTP BASIC and DIGEST Authentication Schemes
Declaring Security Constraints
User Accounts
Safeguarding Credentials in Transit
Replay Attacks
Authorization Over URL Patterns
Roles
FORM Authentication
Login Form Design
Session Fixation
Protections
Programmatic Security
Programmatic Security in JSF

Chapter 3. Common Web Attacks

Forceful Browsing
Predictable Resource Locations
Using Random Numbers
Cross-Site Scripting
Output Escaping
Cross-Site Request Forgery
Synchronizer Tokens
Injection Attacks
Protections in JDBC and JPA
Session Management
Taking Care of Cookies

Chapter 4. Input Validation

Validating User Input
Validation Practices
Regular Expressions
Bean Validation (a/k/a JSR-303)
Constraint Annotations
Cross-Field Validation
Built-In Support in Java EE
Using a Validator
Producing Error Responses
JSF Validation

Chapter 5. HTTPS and Certificates

Digital Cryptography
Encryption
SSL and Secure Key Exchange
Hashing
Signature
Keystores
keytool
Why Keys Aren't Enough
X.509 Certificates
Certificate Authorities
Obtaining a Signed Certificate
Configuring HTTPS
Client-Side Certificates and Two-Way SSL
PKCS #12 and Trust Stores
CLIENT-CERT Authentication

Chapter 6. Application-Level Cryptography

The Java Cryptography Architecture
Secure Random Number Generation
The KeyStore API
Digital Signature
Hashing
Password Hashing
Why Hashing Isn't Enough
Salts
Key Lengthening and Key Strengthening
Slow Algorithms
The Java Cryptography Extensions
The SecretKey and KeyGenerator Types
Symmetric Encryption
Choosing Algorithms and Key Sizes
Dangerous Practices
Storing and Managing Keys

Chapter 7. Secure Development Practices

Secure Development Cycle
Penetration Testing
Secure Code Review
Error Handling and Information Leakage
Failing to a Secure Mode
Designing for Failure
Back Doors
Logging Practices
Appropriate Content for Logs
Auditing Strategies

Appendix A. Learning Resources

Course Directory [training on all levels]

Technical Training Courses

Software engineer/architect, System Admin ... Welcome!

Business Training Courses

Project Managers, Business Analysts, Paralegals ... Welcome!

Upcoming Classes

Gain insight and ideas from students with different perspectives and experiences.

See our complete public course listing

Java Programming Uses & Stats

Java Programming is Used For:

Android & IOS Development Software Products Video Games Desktop GUI's

Difficulty

Popularity

Year Created

1995

Pros

Most Commonly Used:
According to Oracle, three billion devices run on Java. And, because of its real-world applications, it consistently ranks at the top of the TIOBE Programming Community Index.

Great Career Choice:
Some of the fastest-growing salaries in the U.S. in 2018 are for Java developers. (Glassdoor)

Android Apps Development:
Developers predominatly use their Java skills in building apps for Google's Android. The Android platform is the number one mobile paltform in the world

It Can Run On Any Platform:
Java can compile on Windows and run the same compiled file on Linux, Windows and Mac.

Great Supporting IDE's:
Over the years, coding in Java has become simpler with the introduction of open source development tools, i.e. Eclipse and NetBeans that use Java capabilities for debugging.

Cons

Uses a Lot of Memory:
Performance can be significantly slower with Java and more memory-consuming than natively compiled languages such as C or C++.

Difficulty in Learning:
Learning Java can be a bit challenging if you are a beginner. However, once you get the hang of Object Oriented Programming and a decent grasp of the syntax, you will be well on your way.

Slow Start Up Times:
There is quite a bit of one-time initialization done by JDK classes before compiling as well as loading classes and verification (making sure code doesn't do evil things, all of which takes longer that some other languages such as C.

Verbose and Complex Code:
Long, over-complicated sentences make code less readable and scannable. Compare to let's say Python, we can see how clear Python code appears: It doesn’t require semicolons; uses “and,” “or,” and “not” as operators instead of Java’s “&&,” “||,” and “!”; and generally has fewer bells and whistles such as parentheses or curly braces.

Commercial License Cost:
Companies have to prepare for the changes that Oracle will institute in 2019 . Today, the current version of Java is free and available for redistribution for general purpose computing. However, If you are a DEVELOPER, Oracle recommends you review the roadmap information for Java SE 8 and beyond and take appropriate action depending on the type of application you develop and your distribution mode.

Java Programming Job Market

Average Salary $102,000	Job Count 26,856	Top Job Locations New York City San Jose Washington D.C,

Average Salary

$102,000

Job Count

26,856

Top Job Locations

New York City
San Jose
Washington D.C,

Complimentary Skills to have along with Java Programming

- If you are an experienced Java developer, learning a complimentary language to Java should come much more naturally. As an example JetBrains recently created the Kotlin programming language which is officially supported by Google for mobile development. Kotlin compiles to Java bytecode and runs on the JVM; it's purported to address many of Java's shortcomings...