OWASP Proactive Controls

Name: OWASP Proactive Controls
Rating: 4.0 (2028 reviews)

Created byStone River eLearning

Last updated 11/2018

English

What you'll learn

Proactive Control 1: Verify Security
Proactive Control 2: Parameterize Queries
Proactive Control 3: Encode Data
Proactive Control 4: Validate Inputs
Proactive Control 5: Identity and Authentication Controls
Proactive Control 6: Implement Access Controls
Proactive Control 7: Protect Data
Proactive Control 8: Logging and Intrusion Detection
Proactive Control 9: Security Frameworks
Proactive Control 10: Exception Handling

Course content

2 sections • 30 lectures • 2h 51m total length

Topic A: Overview - Part 10:27
Overview - Part 213:44
Overview - Part 30:34
Topic B: Verify Security - Part 10:48
Prioritize security testing early and often in the software development life cycle to catch issues before late stages, leveraging the first OWASP proactive control for DevOps.
Verify Security - Part 213:20
Verify Security - Part 30:29
Topic C: Parameterize Queries - Part 10:22
Parameterize Queries - Part 230:49
Parameterize Queries - Part 30:18
Topic D: Encode Data - Part 10:31
Encode Data - Part 217:28
Encode Data - Part 30:26
Topic E: Validate Inputs - Part 10:26
Explore the OWASP proactive controls topic e: validate inputs - part 1, emphasizing that all data inputs can't be trusted and must be validated, with file upload best practices.
Validate Inputs - Part 213:50
Validate Inputs - Part 30:29
Topic F: Identity and Authentication Controls - Part 10:21
Identity and Authentication Controls - Part 221:01
Identity and Authentication Controls - Part 30:16
Explore common password policy challenges and implement best practices for user authentication to ensure proper identity verification in web applications.
Review - Question

Topic A: Implement Access Controls - Part 10:28
Explore the six access control practices from the OWASP proactive controls and verify user permissions on every call. Identify anti-patterns such as role-based access control and adopt permission-based authorization.
Implement Access Controls - Part 214:04
Implement appropriate access controls by denying by default and verifying requests on the server. Use centralized, permission-based access rather than hard-coded roles to address anti-patterns and OWASP risks.
Implement Access Controls - Part 30:23
Learn to enforce authorization effectively by avoiding common access control antipatterns, and compare role-based and permission-based controls to determine which approach fits best.
Topic B: Protect Data - Part 10:31
Explore the seven OWASP Top Ten Proactive Controls, focusing on protecting data in transit and at rest, the importance of HTTPS, ways to protect HTTPS data, and secure data storage.
Protect Data - Part 218:07
Protect Data - Part 30:15
Topic C: Logging and Intrusion Detection - Part 10:24
Logging and Intrusion Detection - Part 29:30
Implement robust logging using standard frameworks with minimal, effective data and proper encoding. Use intrusion detection by monitoring validation failures, forced browsing, and honeypots.
Logging and Intrusion Detection - Part 30:21
Topic D: Security Frameworks and Exception Handling - Part 10:30
Leverage security frameworks and libraries instead of rolling your own for OWASP Proactive Controls nine and ten. Apply best practices for error and exception handling, ensuring secure exits.
Security Frameworks and Exception Handling - Part 210:32
Security Frameworks and Exception Handling - Part 30:24
Leverage well-known security frameworks and libraries to implement security solutions efficiently. Master proper error and exception handling to ensure your system recovers quickly and stays secure when issues occur.
Review - Question

Requirements

The course requires basic knowledge of web applications and network security. Prior experience of working in a development environment is recommended but not required.

Description

The OWASP: Proactive Controls course is part of a series of training courses on the Open Web Application Security Project (OWASP). The OWASP Top Ten Proactive Controls is a list of security techniques that should be included in every software development project. They are ordered by order of importance, with control number 1 being the most important. This training assists the developers who are new to secure development to ensure application security.

The OWASP Foundation was established with a purpose to secure the applications in such a way that they can be conceived, developed, acquired, operated, and maintained in a trusted way. All of the OWASP tools, documents, forums, and chapters are free and open to anyone interested in improving application security. This course along with the other courses in the series on OWASP provides a basic overview of the concepts that form an integral part of the OWASP core values.

Who this course is for:

Application security engineers
Network security engineers
Ethical hackers
Software developers

OWASP Proactive Controls

What you'll learn

Explore related topics

Course content

Chapter 01 - Controls 1-518 lectures • 1hr 56min

Chapter 02 - Controls 6-1012 lectures • 55min

Requirements

Description

Who this course is for: