Secure Coding - Secure application development

Identify threats early through the threat modeling process in the design phase. Apply STRIDE categories and data flow diagrams to prioritize mitigations and security controls.

Discover secure coding standards from OWASP, SAMM, SEI, and MITRE CWE's 25 programming bugs. Learn guidelines for web applications and secure coding across Java, C/C++, Android, Perl, .NET, and iOS.

explains the tcp/ip stack and the http protocol, illustrating layered web architectures, security of every component, and the http request/response structure and handshake sequences for secure coding.

Explore the OWASP web security testing guide for ethical hacking on web apps, covering information gathering, authentication, session management, and input validation with tests, tools, and remediation.

Explore tools for vulnerability assessment and penetration testing (VAPT), including web crawlers, proxies, vulnerability scanners, and pentest frameworks like Burp, ZAP, Nessus, OpenVAS, Metasploit, and WebGoat.

Explore the sql injection vulnerability lab using the vvwa project to see how input-based sql bypasses login, and apply parametric queries; note that Linq to Entities mitigates it.

Understand how os command injection occurs when server-side input reaches the operating system via system() or exec(), and prevent it with a white list of possible values and least-privilege practices.

Explore local file inclusion and remote file inclusion vulnerabilities, learn how input path verification against a whitelist mitigates lfi and rfi attacks, and verify successful defense in a lab.

Learn insecure deserialization risk from the Owasp top 10, and prevent tampering of serialized xml or json data by using digital signatures, https, trusted libraries, and type checks, with monitoring.

Explore authentication mechanisms for web applications, including basic, digest, windows integrated, and multi-factor options. Implement form-based authentication across ASP.NET, Java Spring, and PHP, and consider OpenID Connect for single sign-on.

Apply OWASP guidelines for authentication and password management by separating authentication logic, hashing passwords with robust algorithms, enforcing strong passwords, securing resets, and enabling multi-factor authentication.

Learn how web applications manage sessions in a stateless HTTP world, using cookies and session IDs or tokens to authenticate users, store state, and revoke access on logout or timeout.

Explore how symmetric cryptography uses the same key to encrypt and decrypt data, with 256-bit keys and AES as a block-based example for data at rest.

Explain how asymmetric cryptography uses public and private keys for secure data transmission, with digital certificates issued by certification authorities to verify keys, and RSA handshakes to exchange AES keys.