OWASP Proactive Controls

Name: OWASP Proactive Controls
Rating: 4.0 (2028 reviews)

Created byStone River eLearning

Last updated 11/2018

English

English [Auto],

What you'll learn

Proactive Control 1: Verify Security
Proactive Control 2: Parameterize Queries
Proactive Control 3: Encode Data
Proactive Control 4: Validate Inputs
Proactive Control 5: Identity and Authentication Controls
Proactive Control 6: Implement Access Controls
Proactive Control 7: Protect Data
Proactive Control 8: Logging and Intrusion Detection
Proactive Control 9: Security Frameworks
Proactive Control 10: Exception Handling

Course content

2 sections • 30 lectures • 2h 51m total length

Topic A: Overview - Part 10:27
Explore the OWASP top ten proactive controls, its history, and how the project defines itself on the OWASP website, with guidelines for web security development.
Overview - Part 213:44
Learn about the OWASP top ten proactive controls v2.0, how to apply secure coding practices for web and mobile apps, with examples, languages, and downloadable references.
Overview - Part 30:34
Explore the OWASP top ten proactive controls project, its history, and where to access the document online; see that these security techniques have multi-language examples from the AWS team.
Topic B: Verify Security - Part 10:48
Prioritize security testing early and often in the software development life cycle to catch issues before late stages, leveraging the first OWASP proactive control for DevOps.
Verify Security - Part 213:20
Verify security early and often by testing throughout the lifecycle, automating security in DevOps, converting scan outputs into reusable controls, and mapping them to the OWASP Top Ten.
Verify Security - Part 30:29
Advance security testing early and often in the software development life cycle, addressing DevOps and CI challenges, and applying the BDD security testing framework to create security test scripts.
Topic C: Parameterize Queries - Part 10:22
Explore parameterized queries to prevent sql injection and protect sql commands. Understand the anatomy of a sql injection attack and apply defenses.
Parameterize Queries - Part 230:49
Understand how parameterized queries interpret inputs before execution to prevent SQL injection in code. Learn concrete examples and fixes using ASP.NET MVC demos and safe, non concatenated queries.
Parameterize Queries - Part 30:18
Explore how a malicious value can trigger a SQL injection to update data across multiple records, highlighting why you must use parameterized queries to prevent attacks.
Topic D: Encode Data - Part 10:31
Encode data to prevent cross-site scripting by properly encoding user input on web pages. Explore the anatomy of a cross-site scripting attack and learn tools and methods for data encoding.
Encode Data - Part 217:28
Encode data to prevent cross-site scripting by applying HTML encoders and sanitizers in ASP.NET MVC and .NET, mitigating injection risks and protecting cookies.
Encode Data - Part 30:26
Learn to encode user input to prevent script execution on websites, including scripts stored in databases and rendered on pages, and explore ready-to-use tools and libraries for encoding.
Topic E: Validate Inputs - Part 10:26
Explore the OWASP proactive controls topic e: validate inputs - part 1, emphasizing that all data inputs can't be trusted and must be validated, with file upload best practices.
Validate Inputs - Part 213:50
Learn to validate all inputs as untrusted, enforce safe handling of headers, cookies, and forms, and apply HTML sanitization and file upload safeguards to prevent injection and XSS.
Validate Inputs - Part 30:29
Examine why input cannot be trusted and may contain scripts, and apply the OWASP HTML sanitizer and file upload safeguards, including renaming files and verification checks.
Topic F: Identity and Authentication Controls - Part 10:21
Explore the fifth proactive control, identity and authentication controls, and learn best practices in password management and user authentication to secure your applications.
Identity and Authentication Controls - Part 221:01
Learn to implement identity and authentication controls, securing passwords with salt, hashing, and iterations, and adopting two-factor authentication, session management, and robust verification.
Identity and Authentication Controls - Part 30:16
Explore common password policy challenges and implement best practices for user authentication to ensure proper identity verification in web applications.
Review - Question

Topic A: Implement Access Controls - Part 10:28
Explore the six access control practices from the OWASP proactive controls and verify user permissions on every call. Identify anti-patterns such as role-based access control and adopt permission-based authorization.
Implement Access Controls - Part 214:04
Implement appropriate access controls by denying by default and verifying requests on the server. Use centralized, permission-based access rather than hard-coded roles to address anti-patterns and OWASP risks.
Implement Access Controls - Part 30:23
Learn to enforce authorization effectively by avoiding common access control antipatterns, and compare role-based and permission-based controls to determine which approach fits best.
Topic B: Protect Data - Part 10:31
Explore the seven OWASP Top Ten Proactive Controls, focusing on protecting data in transit and at rest, the importance of HTTPS, ways to protect HTTPS data, and secure data storage.
Protect Data - Part 218:07
Protect data by encrypting it in transit with https and at rest with secure key management, ensuring confidentiality, integrity, and authenticity through hsts, certificate pinning, and forward secrecy.
Protect Data - Part 30:15
Protect data in transit and at rest by leveraging https benefits and applying tools and methods to secure data at rest.
Topic C: Logging and Intrusion Detection - Part 10:24
Explore how to implement logging and intrusion detection within your code, align with the OWASP Proactive Controls, and leverage tools to detect intrusions.
Logging and Intrusion Detection - Part 29:30
Implement robust logging using standard frameworks with minimal, effective data and proper encoding. Use intrusion detection by monitoring validation failures, forced browsing, and honeypots.
Logging and Intrusion Detection - Part 30:21
Learn to balance effective application logging with intrusion detection, safeguard sensitive data, review code examples, and explore developer tools.
Topic D: Security Frameworks and Exception Handling - Part 10:30
Leverage security frameworks and libraries instead of rolling your own for OWASP Proactive Controls nine and ten. Apply best practices for error and exception handling, ensuring secure exits.
Security Frameworks and Exception Handling - Part 210:32
Leverage security frameworks and libraries, with built-in orm, access control, and csrf protections, and keep them up to date. Centralize error handling to fail securely and prevent data leakage.
Security Frameworks and Exception Handling - Part 30:24
Leverage well-known security frameworks and libraries to implement security solutions efficiently. Master proper error and exception handling to ensure your system recovers quickly and stays secure when issues occur.
Review - Question

Requirements

The course requires basic knowledge of web applications and network security. Prior experience of working in a development environment is recommended but not required.

Description

The OWASP: Proactive Controls course is part of a series of training courses on the Open Web Application Security Project (OWASP). The OWASP Top Ten Proactive Controls is a list of security techniques that should be included in every software development project. They are ordered by order of importance, with control number 1 being the most important. This training assists the developers who are new to secure development to ensure application security.

The OWASP Foundation was established with a purpose to secure the applications in such a way that they can be conceived, developed, acquired, operated, and maintained in a trusted way. All of the OWASP tools, documents, forums, and chapters are free and open to anyone interested in improving application security. This course along with the other courses in the series on OWASP provides a basic overview of the concepts that form an integral part of the OWASP core values.

Who this course is for:

Application security engineers
Network security engineers
Ethical hackers
Software developers

OWASP Proactive Controls

What you'll learn

Explore related topics

Course content

Chapter 01 - Controls 1-518 lectures • 1hr 56min

Chapter 02 - Controls 6-1012 lectures • 55min

Requirements

Description

Who this course is for: