There are no specific requirements needed to attend this course.
This is an extended version of the standard course, covering additional elements of ASP.NET and OWASP.
A number of programming languages are available today to compile code to .NET and ASP.NET frameworks. The environment provides powerful means for security development, but developers should know how to apply the architecture- and coding-level programming techniques in order to implement the desired security functionality and avoid vulnerabilities or limit their exploitation.
The aim of this course is to teach developers through numerous hands-on exercises how to prevent untrusted code from performing privileged actions, protect resources through strong authentication and authorization, provide remote procedure calls, handle sessions, introduce different implementations for certain functionality, and many more. A special section is devoted to configuration and hardening of the .NET and ASP.NET environment for security.
A brief introduction to the foundations of cryptography provides a common practical baseline for understanding the purpose and the operation of various algorithms, based on which the course presents the cryptographic features that can be used in .NET. This is followed by the introduction of some recent crypto vulnerabilities both related to certain crypto algorithms and cryptographic protocols, as well as side-channel attacks.
Introduction of different vulnerabilities starts with presenting some typical programming problems committed when using .NET, including bug categories of input validation, error handling or race conditions. A special focus is given to XML security, while the topic of ASP.NET-specific vulnerabilities tackles some special issues and attack methods, like attacking the ViewState, or the string termination attacks.
- IT security and secure coding
- .NET security architecture and services
- Practical cryptography
- ASP.NET security architecture
- Cryptographic vulnerabilities
- RSA timing attack
- Features and vulnerabilities
- Denial of service
- ASP.NETconfiguration and hardening
- XML security
- Common coding errors and vulnerabilities
- Principles of security and secure coding
- Knowledge sources