Security for web applications developed in .NET, Java and C++

Module 1: application security principles

• The 6 elements of application security: authentication, access control, data integrity and confidentiality, non-repudiation, and protection against traffic analysis.
• Using .NET application security tools.
• Implementing runtime security.
• Implementing authentication.
• Implementing access control and data protection.
• Threat forms and types.
• Implementing input validation.

Module 2: reviewing and securing Java code

• Analysing code quality and security with SonarQube and Abstract Syntax Trees (AST).
• Installing and using SonarQube in Eclipse.
• Securing Java 2 Enterprise Edition with web.xml: authentication realms, CAS and SSO.
• Using Spring Security for authentication: resource-based and method-level security.

Module 3: reviewing and securing C++ code

• Protecting assembly code through signatures and data validation.
• C++ protection models.
• Configuring the Common Language Runtime (CLR).
• Implementing a code access security policy for CLR integration.
• Best practices for deploying and running C++ applications.

Practical exercises:

• Load and secure Code Access Security (CAS).
• Load and unload application domain code.

Module 4: securing a .NET application with encryption

• Cryptography principles: symmetric and asymmetric methods, and encryption engine operation.
• Using encryption for certificates and .NET application signing.
• Implementing SSL and HTTPS to secure communications.

Practical exercises:

• Encrypt and decrypt data.

Module 5: authentication and access management

• .NET authentication systems and role-based authentication principles.
• Implementing .NET policies: code groups.
• Implementing a data protection model.
• Application execution restrictions.
• Implementing protected data storage.

Practical exercises:

• Create and modify identity and principal objects in .NET.
• Add and remove access control list entries: ACL and DACL.
• Create security policies with mscorcfg.msc.

Module 6: addressing security vulnerabilities with ASP.NET

• The 10 major vulnerabilities identified by the Open Web Application Security Project (OWASP).
• SQL injection attacks.
• Cross-site scripting (XSS).
• Session hijacking.
• Insecure Direct Object References (IDOR).
• Cross-site request forgery (CSRF).

Module 7: securing applications with C++

• The C++17 memory model.
• Program compilation.
• Function call stack frames.
• Secure coding best practices.
• C++ strings and pointers.
• Memory management.
• Input and output functions.
• Protecting file access.

Practical exercises:

• Analyse secure and insecure code.

Module 8: applying programming best practices

• Basic coding rules.
• Macros and inline functions.
• Memory management and error handling.
• Structures versus classes.
• Compilation from C++14 to C++17.
• Application security standards.
• Code validation.