Designing and Coding Secure Systems
|
|
|
- Noreen Williams
- 9 years ago
- Views:
Transcription
1 Designing and Coding Secure Systems Kenneth Ingham and Anil Somayaji September 29, Course overview This class covers secure coding and some design issues from a language neutral approach you can make mistakes such as input validation or failing to use defense in depth in any language. The course stresses how to avoid security problems through the proper implementation of programs. This class makes heavy use of labs where the instructor presents a case study and the students discuss how to apply the concepts presented to the example under discussion; the example can also be a system in which the students are involved. This class is appropriate for students who are programmers; you cannot code your way out of a bad design, and recognizing design flaws earlier allows them to be fixed with fewer resources. This class is also appropriate for program designers and system architects; they need to understand how to design in security from the beginning. 2 Course objectives Students attending this class will learn: Why we have had problems writing secure code. Security belongs in all phases of the software development lifecycle. What is a threat model and how does it help with security. The design principle of secure failure modes. Important language-independent coding issues such as input validation. Concepts of authorization and access control with references to the Java and.net libraries. How, what, when, why, and where to log. Issues affecting web server security. 1
2 How to perform a software security audit. How to test for security. 3 Student background If you are attending this class, then we assume that You are familiar with programming in a major language (e.g., Java, C, C++, C#, etc). You are a programmer, software designer, or system architect. You want to produce more secure systems. 4 Logistics The class lasts two days. The student computers can run either Windows or Linux. The class uses the following software: Firefox Web Developer toolbar IE 6 or 7 (on Windows distribution) or Firefox 2 (on Linux distribution but needed for Windows) (optional) Internet access (optional) Java JDK 1.6 (for WebGoat) PortSwigger burp suite WebGoat v5.2 a web browser Since this is a discussion class, computers are not absolutely necessary. If computers are available, the student computers should have Internet access, including the necessary configuration for this to work. However, an isolated network can also work. If the classroom has computers, a web server is needed. The class needs a web server for the class web site. The instructor s laptop may be this web server; otherwise the machine provided in the classroom for the instructor is a good choice. This machine obviously will need web server software installed. 5 Class outline 1. Introduction (Lecture: 15; Lab: 0) (a) Class Introductions (b) Class Logistics i. Class schedule 2
3 ii. Breaks iii. Question policy iv. Break room and restroom locations v. Assumptions about your background (c) Typographic conventions 2. Designing and coding secure programs (Lecture: 50; Lab: 30) (a) What is a secure program? (b) Common security myths i. We have a firewall ii. I use anti-virus software A. Example (c) Why is Security Important? (d) The Challenge (e) Secure code is more reliable code (f) Security versus usability (g) Summary (h) Lab 3. Threat models and risk management (Lecture: 45; Lab: 55) i. Example (b) The threat model (c) The assets you are protecting (d) Attackers (e) Common attack goals (f) Mitigating threats (g) Examples i. Password vault ii. Web-based timesheet (h) Risk analysis (i) Failures of Imagination (j) Summary (k) Lab 4. Security and the software development life cycle (Lecture: 35; Lab: 20) (b) Requirements i. Example ii. Example iii. Use, Abuse, and Misuse cases (c) Design/Architecture 3
4 i. Design is critical ii. Properly-written specifications (d) Code development i. Implementation is critical (e) Testing (f) Operations/maintenance (g) Agile development (h) Penetrate and patch is the wrong approach (i) Summary (j) Lab 5. Input validation and representation (Lecture: 60; Lab: 35) i. Example input validation problems (b) Never trust the client i. Example: 3D3.Com ShopFactory ii. Example: Smartwin Technology CyberOffice Shopping Cart (c) Never trust the server (d) Never trust other programmers i. Example: Linux kernel (e) Beware Hidden User Input (f) Solution: Whitelists (g) Solution: Canonicalization i. Example: NTFS ii. Example: IIS and Nimda (h) Solution: Taint tracking (i) Summary (j) Lab 6. Fail securely (Lecture: 25; Lab: 15) (b) Failure-related code is often poorly written and tested i. Examples (c) Proper failure state (d) Complete error/exception handling i. Example: Linux ELF binary loader (e) Resource issues (f) Failures take unexpected paths in the code (g) Backwards Compatibility i. Example: Windows file sharing (h) Reporting Errors Securely 4
5 (i) Failing Functionally yet Securely (j) Summary (k) Lab 7. Logging (Lecture: 30; Lab: 35) (a) The purposes of logs (b) What to log (c) How to log (d) Resource issues (e) Distributed logging (f) Log monitoring (g) Sensitive data (h) Summary (i) Lab 8. State and the web (Lecture: 25; Lab: 65) (a) Overview (b) Ways of tracking state i. Hidden fields in forms ii. Cookies iii. CGI parameters iv. HTTP Referer field (c) Session hijacking (d) Solutions (e) Example vulnerable code (f) Testing for this problem (g) Summary (h) Lab 9. Code reviews (auditing) for security (Lecture: 45; Lab: 30) (a) Why to audit (b) How to audit (c) Automated code analysis tools (d) Items for an audit checklist i. Overall requirements and architecture issues ii. Defense in Depth iii. Compartmentalization iv. Privileges v. Authentication vi. Authorization vii. Cryptography viii. Secure failure ix. Input validation 5
6 x. Logging xi. Sensitive data xii. Race conditions xiii. Scripting and extensibility xiv. State and the web xv. Deployment (e) Summary (f) Lab 10. Software testing for security (Lecture: 20; Lab: 30) Appendices (a) Why to test (b) Who should perform the testing (c) How to test (d) When to test (e) Penetration testing and tools (f) Limitations of Testing (g) Summary (h) Lab A. Defense in depth (Lecture: 20; Lab: 25) (b) Example: Web-based timesheet application (c) Summary (d) Lab B. Least privilege (Lecture: 40; Lab: 20) (b) Dropping privileges after obtaining a resource (c) Separation of privilege i. Implementing separation of privilege ii. Example: OpenSSH A. Applying separation of privilege to OpenSSH iii. Example: NTP client (d) Example: Applying least privilege to the web timesheet application (e) Summary (f) Lab C. Compartmentalization (Lecture: 35; Lab: 20) (b) Processes (c) Filesystem Access Controls 6
7 (d) Mandatory Access Control (e) Virtualization i. Hardware Virtualization A. Paravirtualization ii. Operating System-Level Virtualization iii. Application Virtualization (f) Summary (g) Lab D. Erasing data (Lecture: 45; Lab: 20) (b) Erasing Memory i. Solutions (c) Erasing Files i. Examples ii. Solutions (d) Backups (e) Application/System Design issues (f) Summary (g) Lab E. Race conditions (Lecture: 25; Lab: 10) (b) TOCTTOU race conditions i. passwd command races ii. Temporary Files iii. Avoiding TOCTTOU problems (c) Memory corruption Race Conditions i. Multithreaded Processes ii. Signal race conditions iii. OS Kernel race conditions (d) Summary (e) Race Conditions Lab F. Cryptography Fundamentals (Lecture: 30; Lab: 25) i. Cryptographic Applications ii. Open design (b) Limits of Cryptography (c) Cryptographic Primitives i. Cryptographic Hash Functions 7
8 ii. Symmetric key encryption iii. Public key encryption (d) Digital signatures (e) Random Numbers (f) Parameter sizes (g) Insecure Cryptography (h) Do Not Innovate in Cryptography! (i) Summary (j) Lab G. Using Cryptography (Lecture: 30; Lab: 30) (b) Public Key Management (c) Certificates (d) Trust Models (e) Example: PGP/GnuPG (f) Example: SSL and TLS (g) Using cryptography to improve security (h) Standard strategies (i) Standard Implementations (j) Summary (k) Lab H. Authentication (Lecture: 30; Lab: 35) (a) The Basics (b) Authentication using secrets i. The problem with passwords ii. Authentication protocols for secrets (c) Authentication using physical tokens i. Smart cards ii. SecureID cards (d) Biometrics (e) Single sign-on (f) US Authentication Standards (g) Best Practices from OWASP (h) Lab I. Research directions (Lecture: 20; Lab: 0) (b) Static Analysis (c) Dynamic Analysis i. Limitations of Signatures and Specifications ii. Anomaly detection 8
9 (d) Mitigation (e) The Security Arms Race (f) Summary J. Final lab (Lecture: 0; Lab: 120) (a) Lab 9
Testing for Security
Testing for Security Kenneth Ingham September 29, 2009 1 Course overview The threat that security breaches present to your products and ultimately your customer base can be significant. This course is
Linux Operating System Security
Linux Operating System Security Kenneth Ingham and Anil Somayaji September 29, 2009 1 Course overview This class is for students who want to learn how to configure systems to be secure, test the security
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
EC-Council E C S P.NET. EC-Council. EC-Council Certified Secure Programmer (.NET)
E C S P.NET (.NET) ECSP.NET Course Software defects, bugs, and flaws in the logic of the program are consistently the cause for software vulnerabilities. Analysis by software security professionals has
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) [email protected] Open Web Application Security Project http://www.owasp.org
CESG Certification of Cyber Security Training Courses
CESG Certification of Cyber Security Training Courses Supporting Assessment Criteria for the CESG Certified Training (CCT) Scheme Portions of this work are copyright The Institute of Information Security
What is Web Security? Motivation
[email protected] http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
Passing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These
ASP.NET MVC Secure Coding 4-Day hands on Course. Course Syllabus
ASP.NET MVC Secure Coding 4-Day hands on Course Course Syllabus Course description ASP.NET MVC Secure Coding 4-Day hands on Course Secure programming is the best defense against hackers. This multilayered
Threat Modelling for Web Application Deployment. Ivan Ristic [email protected] (Thinking Stone)
Threat Modelling for Web Application Deployment Ivan Ristic [email protected] (Thinking Stone) Talk Overview 1. Introducing Threat Modelling 2. Real-world Example 3. Questions Who Am I? Developer /
Christchurch Polytechnic Institute of Technology Information Systems Acquisition, Development and Maintenance Security Standard
Christchurch Polytechnic Institute of Technology Information Systems Acquisition, Development and Maintenance Security Standard Corporate Policies & Procedures Section 1: General Administration Document
Ethical Hacking and Attack Tools
Ethical Hacking and Attack Tools Kenneth Ingham September 29, 2009 1 Course overview Attackers have at their disposal a large collection of tools that aid their exploiting systems. If you plan to defend
Lecture 11 Web Application Security (part 1)
Lecture 11 Web Application Security (part 1) Computer and Network Security 4th of January 2016 Computer Science and Engineering Department CSE Dep, ACS, UPB Lecture 11, Web Application Security (part 1)
elearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
Network Test Labs (NTL) Software Testing Services for igaming
Network Test Labs (NTL) Software Testing Services for igaming Led by committed, young and dynamic professionals with extensive expertise and experience of independent testing services, Network Test Labs
Advanced Linux System Administration on Red Hat
Advanced Linux System Administration on Red Hat Kenneth Ingham September 29, 2009 1 Course overview This class is for people who are familiar with basic Linux administration (i.e., they know users, packages,
"Charting the Course... ... to Your Success!" MOC 50331 D Windows 7 Enterprise Desktop Support Technician Course Summary
Description Course Summary This course provides students with the knowledge and skills needed to isolate, document and resolve problems on a Windows 7 desktop or laptop computer. It will also help test
Computer Security Literacy
Computer Security Literacy Staying Safe in a Digital World Douglas Jacobson and Joseph Idziorek CRC Press Taylor & Francis Group Boca Raton London New York CRC Press is an imprint of the Taylor & Francis
Using Foundstone CookieDigger to Analyze Web Session Management
Using Foundstone CookieDigger to Analyze Web Session Management Foundstone Professional Services May 2005 Web Session Management Managing web sessions has become a critical component of secure coding techniques.
05.0 Application Development
Number 5.0 Policy Owner Information Security and Technology Policy Application Development Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 5. Application Development
Secure Software Programming and Vulnerability Analysis
Secure Software Programming and Vulnerability Analysis Christopher Kruegel [email protected] http://www.auto.tuwien.ac.at/~chris Operations and Denial of Service Secure Software Programming 2 Overview
Web Application Security
Chapter 1 Web Application Security In this chapter: OWASP Top 10..........................................................2 General Principles to Live By.............................................. 4
MAXIMUM DATA SECURITY with ideals TM Virtual Data Room
MAXIMUM DATA SECURITY with ideals TM Virtual Data Room WWW.IDEALSCORP.COM ISO 27001 Certified Account Settings and Controls Administrators control users settings and can easily configure privileges for
External Supplier Control Requirements
External Supplier Control Requirements Cyber Security For Suppliers Categorised as High Cyber Risk Cyber Security Requirement Description Why this is important 1. Asset Protection and System Configuration
SERENA SOFTWARE Serena Service Manager Security
SERENA SOFTWARE Serena Service Manager Security 2014-09-08 Table of Contents Who Should Read This Paper?... 3 Overview... 3 Security Aspects... 3 Reference... 6 2 Serena Software Operational Security (On-Demand
Protecting Your Organisation from Targeted Cyber Intrusion
Protecting Your Organisation from Targeted Cyber Intrusion How the 35 mitigations against targeted cyber intrusion published by Defence Signals Directorate can be implemented on the Microsoft technology
EUCIP - IT Administrator. Module 5 IT Security. Version 2.0
EUCIP - IT Administrator Module 5 IT Security Version 2.0 Module 5 Goals Module 5 Module 5, IT Security, requires the candidate to be familiar with the various ways of protecting data both in a single
OWASP Top Ten Tools and Tactics
OWASP Top Ten Tools and Tactics Russ McRee Copyright 2012 HolisticInfoSec.org SANSFIRE 2012 10 JULY Welcome Manager, Security Analytics for Microsoft Online Services Security & Compliance Writer (toolsmith),
Web Security, Privacy, and Commerce
SECOND EDITION Web Security, Privacy, and Commerce Simson Garfinkel with Gene Spafford O'REILLT Beijing Cambridge Famham Köln Paris Sebastopol Taipei Tokyo Table of Contents Preface xi Part I. Web Technology
External Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must
Goals. Understanding security testing
Getting The Most Value From Your Next Network Penetration Test Jerald Dawkins, Ph.D. True Digital Security p. o. b o x 3 5 6 2 3 t u l s a, O K 7 4 1 5 3 p. 8 6 6. 4 3 0. 2 5 9 5 f. 8 7 7. 7 2 0. 4 0 3
Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
WEB APPLICATION SECURITY
WEB APPLICATION SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part
Web Security Testing Cookbook*
Web Security Testing Cookbook* Systematic Techniques to Find Problems Fast Paco Hope and Ben Walther O'REILLY' Beijing Cambridge Farnham Koln Sebastopol Tokyo Table of Contents Foreword Preface xiii xv
JVA-122. Secure Java Web Development
JVA-122. Secure Java Web Development Version 7.0 This comprehensive course shows experienced developers of Java EE applications how to secure those applications and to apply best practices with regard
KEN VAN WYK. Fundamentals of Secure Coding and how to break Software MARCH 19-23, 2007 RESIDENZA DI RIPETTA - VIA DI RIPETTA, 231 ROME (ITALY)
TECHNOLOGY TRANSFER PRESENTS KEN VAN WYK Fundamentals of Secure Coding and how to break Software MARCH 19-23, 2007 RESIDENZA DI RIPETTA - VIA DI RIPETTA, 231 ROME (ITALY) [email protected] www.technologytransfer.it
Acano solution. Security Considerations. August 2015 76-1026-01-E
Acano solution Security Considerations August 2015 76-1026-01-E Contents Contents 1 Introduction... 3 2 Acano Secure Development Lifecycle... 3 3 Acano Security Points... 4 Acano solution: Security Consideration
The Panoptix Building Efficiency Solution: Ensuring a Secure Delivery of Building Efficiency
logo The Panoptix Building Efficiency Solution: Ensuring a Secure Delivery of Building Efficiency Understanding the Multiple Levels of Security Built Into the Panoptix Solution Published: October 2011
INCIDENT RESPONSE CHECKLIST
INCIDENT RESPONSE CHECKLIST The purpose of this checklist is to provide clients of Kivu Consulting, Inc. with guidance in the initial stages of an actual or possible data breach. Clients are encouraged
CNT5410 - Computer and Network Security Review/Wrapup
CNT5410 - Computer and Network Security Review/Wrapup Professor Kevin Butler Fall 2015 Review What did we talk about this semester? Cryptography secret vs public-key key exchange (Diffie-Hellman) symmetric
Web Engineering Web Application Security Issues
Security Issues Dec 14 2009 Katharina Siorpaes Copyright 2009 STI - INNSBRUCK www.sti-innsbruck.at It is NOT Network Security It is securing: Custom Code that drives a web application Libraries Backend
Security + Certification (ITSY 1076) Syllabus
Security + Certification (ITSY 1076) Syllabus Course: ITSY 1076 Security+ 40 hours Course Description: This course is targeted toward an Information Technology (IT) professional who has networking and
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current
Expert Oracle Enterprise
Expert Oracle Enterprise Manager 12c Kellyn Pot'vin Anand Akela Gokhan Atil Bobby Curtis Alex Gorbachev Niall Litchfield Leighton Nelson Pete Sharman Apress' Contents J About the Authors About the Technical
ABB s approach concerning IS Security for Automation Systems
ABB s approach concerning IS Security for Automation Systems Copyright 2006 ABB. All rights reserved. Stefan Kubik [email protected] The problem Most manufacturing facilities are more connected (and
Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping
Larry Wilson Version 1.0 November, 2013 University Cyber-security Program Critical Asset Mapping Part 3 - Cyber-Security Controls Mapping Cyber-security Controls mapped to Critical Asset Groups CSC Control
Criteria for web application security check. Version 2015.1
Criteria for web application security check Version 2015.1 i Content Introduction... iii ISC- P- 001 ISC- P- 001.1 ISC- P- 001.2 ISC- P- 001.3 ISC- P- 001.4 ISC- P- 001.5 ISC- P- 001.6 ISC- P- 001.7 ISC-
ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster
Security Standards Symantec shall maintain administrative, technical, and physical safeguards for the Symantec Network designed to (i) protect the security and integrity of the Symantec Network, and (ii)
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
NSA/DHS CAE in IA/CD 2014 Mandatory Knowledge Unit Checklist 4 Year + Programs
Mandatory Knowledge Units 1.0 Core2Y 1.1 Basic Data Analysis The intent of this Knowledge Unit is to provide students with basic abilities to manipulate data into meaningful information. 1.1.1 Topics Summary
Programming Flaws and How to Fix Them
19 ö Programming Flaws and How to Fix Them MICHAEL HOWARD DAVID LEBLANC JOHN VIEGA McGraw-Hill /Osborne New York Chicago San Francisco Lisbon London Madrid Mexico City- Milan New Delhi San Juan Seoul Singapore
INFORMATION SECURITY TRAINING CATALOG (2015)
INFORMATICS AND INFORMATION SECURITY RESEARCH CENTER CYBER SECURITY INSTITUTE INFORMATION SECURITY TRAINING CATALOG (2015) Revision 3.0 2015 TÜBİTAK BİLGEM SGE Siber Güvenlik Enstitüsü P.K. 74, Gebze,
How To Secure An Rsa Authentication Agent
RSA Authentication Agents Security Best Practices Guide Version 3 Contact Information Go to the RSA corporate web site for regional Customer Support telephone and fax numbers: www.rsa.com. Trademarks RSA,
74% 96 Action Items. Compliance
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated
(WAPT) Web Application Penetration Testing
(WAPT) Web Application Penetration Testing Module 0: Introduction 1. Introduction to the course. 2. How to get most out of the course 3. Resources you will need for the course 4. What is WAPT? Module 1:
Web Application Security
Web Application Security A Beginner's Guide Bryan Sullivan Vincent Liu Mc r New York Chicago San Francisco Lisbon London Madrid Mexico City Milan New Delhi San Juan Seoul Singapore Sydney Toronto Contents
CS 665: Computer System Security. Network Security. Usage environment. Sources of vulnerabilities. Information Assurance Module
CS 665: Computer System Security Network Security Bojan Cukic Lane Department of Computer Science and Electrical Engineering West Virginia University 1 Usage environment Anonymity Automation, minimal human
Security Controls for the Autodesk 360 Managed Services
Autodesk Trust Center Security Controls for the Autodesk 360 Managed Services Autodesk strives to apply the operational best practices of leading cloud-computing providers around the world. Sound practices
Privacy + Security + Integrity
Privacy + Security + Integrity Docufree Corporation Data Security Checklist Security by Design Docufree is very proud of our security record and our staff works diligently to maintain the greatest levels
PCI DSS Requirements - Security Controls and Processes
1. Build and maintain a secure network 1.1 Establish firewall and router configuration standards that formalize testing whenever configurations change; that identify all connections to cardholder data
Web Application Hacking (Penetration Testing) 5-day Hands-On Course
Web Application Hacking (Penetration Testing) 5-day Hands-On Course Web Application Hacking (Penetration Testing) 5-day Hands-On Course Course Description Our web sites are under attack on a daily basis
Section 1 CREDIT UNION Member Information Security Due Diligence Questionnaire
SAMPLE CREDIT UNION INFORMATION SECURITY DUE DILIGENCE QUESTIONNAIRE FOR POTENTIAL VENDORS Section 1 CREDIT UNION Member Information Security Due Diligence Questionnaire 1. Physical security o Where is
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4 Gordon MacKay Digital Defense, Inc. Chris Wysopal Veracode Session ID: Session Classification: ASEC-W25 Intermediate AGENDA Risk Management Challenges
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
WHITE PAPER. FortiWeb and the OWASP Top 10 Mitigating the most dangerous application security threats
WHITE PAPER FortiWeb and the OWASP Top 10 PAGE 2 Introduction The Open Web Application Security project (OWASP) Top Ten provides a powerful awareness document for web application security. The OWASP Top
Apple Pro Training Series. OS X Server. Essentials. Arek Dreyer. and Ben Greisler
Apple Pro Training Series OS X Server Essentials Arek Dreyer and Ben Greisler Table of Contents Configuring and Monitoring OS X Server Lesson 1 About This Guide 3 Learning Methodology 4 Lesson Structure
Chapter 17. Transport-Level Security
Chapter 17 Transport-Level Security Web Security Considerations The World Wide Web is fundamentally a client/server application running over the Internet and TCP/IP intranets The following characteristics
APPENDIX G ASP/SaaS SECURITY ASSESSMENT CHECKLIST
APPENDIX G ASP/SaaS SECURITY ASSESSMENT CHECKLIST Application Name: Vendor Name: Briefly describe the purpose of the application. Include an overview of the application architecture, and identify the data
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security
Development. Resilient Software. Secure and. Mark S. Merkow Lakshmikanth Raghavan. CRC Press. Taylor& Francis Croup. Taylor St Francis Group,
Secure and Resilient Software Development Mark S. Merkow Lakshmikanth Raghavan CRC Press Taylor& Francis Croup Boca Raton London New York CRC Press is an imprint of the Taylor St Francis Group, an Informs
ERIE COMMUNITY COLLEGE COURSE OUTLINE A. COURSE TITLE: CS 103 - WEB DEVELOPMENT AND PROGRAMMING FUNDAMENTALS
ERIE COMMUNITY COLLEGE COURSE OUTLINE A. COURSE TITLE: CS 103 - WEB DEVELOPMENT AND PROGRAMMING FUNDAMENTALS B. CURRICULUM: Mathematics / Computer Science Unit Offering C. CATALOG DESCRIPTION: (N,C,S)
Application White Listing and Privilege Management: Picking Up Where Antivirus Leaves Off
Application White Listing and Privilege Management: Picking Up Where Antivirus Leaves Off Times have Changed & A/V Executives Agree An A/V product as your sole endpoint protection solution isn t enough.
Data Breaches and Web Servers: The Giant Sucking Sound
Data Breaches and Web Servers: The Giant Sucking Sound Guy Helmer CTO, Palisade Systems, Inc. Lecturer, Iowa State University @ghelmer Session ID: DAS-204 Session Classification: Intermediate The Giant
90% of data breaches are caused by software vulnerabilities.
90% of data breaches are caused by software vulnerabilities. Get the skills you need to build secure software applications Secure Software Development (SSD) www.ce.ucf.edu/ssd Offered in partnership with
Securing Data on Microsoft SQL Server 2012
Securing Data on Microsoft SQL Server 2012 Course 55096 The goal of this two-day instructor-led course is to provide students with the database and SQL server security knowledge and skills necessary to
System Administration of Windchill 10.2
System Administration of Windchill 10.2 Overview Course Code Course Length TRN-4340-T 3 Days In this course, you will gain an understanding of how to perform routine Windchill system administration tasks,
Promoting Application Security within Federal Government. AppSec DC November 13, 2009. The OWASP Foundation http://www.owasp.org
Promoting Application Security within Federal Government AppSec DC November 13, 2009 Dr. Sarbari Gupta, CISSP, CISA Founder/President Electrosoft [email protected] 703-437-9451 ext 12 The Foundation
Excellence Doesn t Need a Certificate. Be an. Believe in You. 2014 AMIGOSEC Consulting Private Limited
Excellence Doesn t Need a Certificate Be an 2014 AMIGOSEC Consulting Private Limited Believe in You Introduction In this age of emerging technologies where IT plays a crucial role in enabling and running
Introduction to Cyber Security / Information Security
Introduction to Cyber Security / Information Security Syllabus for Introduction to Cyber Security / Information Security program * for students of University of Pune is given below. The program will be
"Charting the Course... Implementing Citrix NetScaler 11 for App and Desktop Solutions CNS-207 Course Summary
Course Summary Description The objective of this course is to provide the foundational concepts and teach the skills necessary to implement, configure, secure and monitor a Citrix NetScaler system with
Bellevue University Cybersecurity Programs & Courses
Undergraduate Course List Core Courses: CYBR 250 Introduction to Cyber Threats, Technologies and Security CIS 311 Network Security CIS 312 Securing Access Control CIS 411 Assessments and Audits CYBR 320
Data Protection: From PKI to Virtualization & Cloud
Data Protection: From PKI to Virtualization & Cloud Raymond Yeung CISSP, CISA Senior Regional Director, HK/TW, ASEAN & A/NZ SafeNet Inc. Agenda What is PKI? And Value? Traditional PKI Usage Cloud Security
BM482E Introduction to Computer Security
BM482E Introduction to Computer Security Lecture 7 Database and Operating System Security Mehmet Demirci 1 Summary of Lecture 6 User Authentication Passwords Password storage Password selection Token-based
Infor CloudSuite. Defense-in-depth. Table of Contents. Technical Paper Plain talk about Infor CloudSuite security
Technical Paper Plain talk about security When it comes to Cloud deployment, security is top of mind for all concerned. The Infor CloudSuite team uses best-practice protocols and a thorough, continuous
Adobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...
Antivirus and Malware Prevention Policy and Procedures (Template) Employee Personal Device Use Terms and Conditions (Template)
Below you will find the following sample policies: Antivirus and Malware Prevention Policy and Procedures (Template) Employee Personal Device Use Terms and Conditions (Template) *Log in to erisk Hub for
Data Stored on a Windows Server Connected to a Network
Attachment A Form to Describe Sensitive Data Security Plan For the Use of Sensitive Data from The National Longitudinal Study of Adolescent to Adult Health Data Stored on a Windows Server Connected to
Web App Security Audit Services
locuz.com Professional Services Web App Security Audit Services The unsecured world today Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System
The Electronic Arms Race of Cyber Security 4.2 Lecture 7
The Electronic Arms Race of Cyber Security 4.2 Lecture 7 ISIMA Clermont-Ferrand / 04-February 2011 Copyright 2011 Dr. Juergen Hirte List of Content Why Process Automation Security? Security Awareness Issues
Chapter 1 Web Application (In)security 1
Introduction xxiii Chapter 1 Web Application (In)security 1 The Evolution of Web Applications 2 Common Web Application Functions 4 Benefits of Web Applications 5 Web Application Security 6 "This Site Is
Certified Secure Computer User
Certified Secure Computer User Course Outline Module 01: Foundations of Security Essential Terminologies Computer Security Why Security? Potential Losses Due to Security Attacks Elements of Security The
MS-55096: Securing Data on Microsoft SQL Server 2012
MS-55096: Securing Data on Microsoft SQL Server 2012 Description The goal of this two-day instructor-led course is to provide students with the database and SQL server security knowledge and skills necessary
Visa U.S.A Cardholder Information Security Program (CISP) Payment Application Best Practices
This document is to be used to verify that a payment application has been validated against Visa U.S.A. Payment Application Best Practices and to create the Report on Validation. Please note that payment
Cisco ASA. Administrators
Cisco ASA for Accidental Administrators Version 1.1 Corrected Table of Contents i Contents PRELUDE CHAPTER 1: Understanding Firewall Fundamentals What Do Firewalls Do? 5 Types of Firewalls 6 Classification