Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
I. Introduction to Secure Coding and Web Application Security
1. Modern Web Application Threat Landscape
- Common web application attack vectors
- Security risks in modern ASP.NET applications
- The role of secure coding in software development
- Introduction to the OWASP Foundation and its resources
2. Secure Software Development Principles
- Security by design
- Defense in depth
- Least privilege
- Fail securely
- Secure defaults
- Threat modeling fundamentals
II. Secure Development Lifecycle (SDL)
1. Secure Software Development Lifecycle
- Security throughout the development lifecycle
- Security requirements
- Secure architecture and design
- Secure coding practices
- Security testing and validation
- Secure deployment and maintenance
2. Risk Assessment and Threat Modeling
- Identifying assets and threats
- Attack surface analysis
- STRIDE overview
- Prioritizing security risks
III. OWASP Top 10 for ASP.NET Applications
1. Understanding the OWASP Top 10
- Broken Access Control
- Cryptographic Failures
- Injection
- Insecure Design
- Security Misconfiguration
- Vulnerable and Outdated Components
- Identification and Authentication Failures
- Software and Data Integrity Failures
- Security Logging and Monitoring Failures
- Server-Side Request Forgery (SSRF)
2. Applying OWASP Recommendations
- Secure coding techniques
- Preventive controls
- Secure configuration practices
- Real-world examples and demonstrations
IV. Authentication and Authorization Security
1. Authentication Fundamentals
- Authentication mechanisms in ASP.NET
- Password security
- Multi-factor authentication
- Session management
- Identity management
2. Authorization and Access Control
- Role-based authorization
- Claims-based authorization
- Policy-based authorization
- Preventing privilege escalation
- Protecting sensitive resources
V. Preventing Injection Attacks
1. Injection Vulnerabilities
- SQL Injection
- Command Injection
- LDAP Injection
- XML Injection
- NoSQL Injection overview
2. Secure Coding Techniques
- Parameterized queries
- Input validation
- Output encoding
- ORM security considerations
- Safe database access practices
VI. Preventing Cross-Site Scripting (XSS)
1. Understanding XSS
- Stored XSS
- Reflected XSS
- DOM-based XSS
- Attack scenarios
2. XSS Prevention
- Output encoding
- Input validation
- Content Security Policy (CSP)
- Secure handling of HTML and JavaScript
- ASP.NET security features for XSS prevention
VII. Preventing Cross-Site Request Forgery (CSRF)
1. Understanding CSRF
- How CSRF attacks work
- Common attack scenarios
- Business impact
2. CSRF Protection
- Anti-forgery tokens
- SameSite cookies
- Secure session management
- ASP.NET anti-forgery mechanisms
VIII. Secure Configuration of ASP.NET Applications
1. ASP.NET Security Features
- Configuration security
- Secure HTTP headers
- HTTPS and TLS configuration
- Secrets management
- Secure error handling
2. Protecting Sensitive Data
- Data protection APIs
- Secure storage of credentials
- Encryption fundamentals
- Key management
IX. Input Validation and Secure Data Handling
1. Validating User Input
- Whitelisting versus blacklisting
- Server-side validation
- Client-side validation considerations
- File upload security
2. Secure Data Processing
- Serialization security
- Deserialization risks
- Data integrity
- Secure logging practices
X. Penetration Testing and Security Verification
1. Penetration Testing Methodology
- Planning security assessments
- Vulnerability identification
- Exploitation concepts
- Reporting findings
2. Security Testing Techniques
- Static Application Security Testing (SAST)
- Dynamic Application Security Testing (DAST)
- Interactive Application Security Testing (IAST)
- Dependency and component analysis
- Manual code review
XI. Securing ASP.NET Applications
1. Applying Secure Coding Practices
- Secure authentication implementation
- Secure authorization implementation
- Session security
- Exception handling
- Logging and monitoring
- Secure deployment considerations
2. Security Best Practices
- Secure coding standards
- Dependency management
- Patch management
- Continuous security improvement
XII. Hands-on Security Workshop
1. Identifying and Exploiting Common Vulnerabilities
- Analyzing insecure ASP.NET code
- Identifying OWASP Top 10 vulnerabilities
- Understanding attack techniques
- Evaluating application security
2. Remediating Security Issues
- Applying secure coding fixes
- Validating mitigations
- Testing remediated applications
- Secure coding review exercise
XIII. Summary and Course Review
1. Review of Key Concepts
- Secure design principles
- OWASP Top 10 mitigation strategies
- ASP.NET security features
- Secure development lifecycle
2. Final Discussion
- Secure coding best practices
- Building security into development teams
- Additional OWASP resources and tools
- Q&A and next steps
Requirements
Experience with ASP.net
Experience of creating web applications
21 Hours
Testimonials (5)
Introductions to the many different types of unsafe behaviors.
Zhongqi
Course - Secure Developer .NET (Inc OWASP)
having a one to one session with Raymond was amazing he was really great and attentive to all my training needs.
Joshua
Course - Secure Developer .NET (Inc OWASP)
The high level of instructor knowledge meant that we got a very good insight into the topics covered.
Dafydd - TATA Steel
Course - Secure Developer .NET (Inc OWASP)
the reference links
Abraham Gonzalez - ATEB Servicios
Course - Secure Developer .NET (Inc OWASP)
The trainer's subject knowledge was excellent, and the way the sessions were set out so that the audience could follow along with the demonstrations really helped to cement that knowledge, compared to just sitting and listening.
