Skill Up Card - Course Bundles

Pricing is per delegate, giving you huge savings over the cost of individual courses.

  • UK = £2,000 + VAT per Skill Up Card
  • Ireland = €2,400 per Skill Up Card
skill up card logo - Nexus Human

Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120)

4.6 out of 5 rating Last updated 14/11/2024   English

Jump to outline

Global Schedule

GTR = Guaranteed to Run

03 Feb 25 Book
15:00 - 23:00 Live Online 1,541
14 Apr 25 Book
15:00 - 23:00 Live Online 1,541

16 Jun 25 Book
15:00 - 23:00 Live Online 1,541
18 Aug 25 Book
15:00 - 23:00 Live Online 1,541
20 Oct 25 Book
15:00 - 23:00 Live Online 1,541
01 Dec 25 Book
15:00 - 23:00 Live Online 1,541
Duration

2 Days

12 CPD hours

Overview

This course will walk you through how to recognize actual and potential software vulnerabilities and implement defenses for those vulnerabilities. You will explore most common security vulnerabilities faced by web applications today, examining each vulnerability from a coding perspective through a process of describing the threat and attack mechanisms, recognizing associated vulnerabilities, and, finally, designing and implementing effective defenses.
This course combines engaging instructor-led presentations and useful demonstrations with valuable hands-on labs and engaging group activities. Throughout the course you'll:
- Grasp defensive, secure coding concepts and terminology, including the understanding of exploit phases and goals.
- Explore the 2021 OWASP Top Ten (latest edition) as well as several additional prominent vulnerabilities.
- Master the first axioms in security analysis and addressing security concerns across all web applications.
- Learn how to perform ethical hacking and bug hunting in a safe and appropriate manner.
- Identify and utilize effective defect/bug reporting mechanisms within your organization.
- Learn how to avoid common pitfalls in bug hunting and vulnerability testing.
- Develop an appreciation for the value of a multilayered defense strategy.
- Understand potential sources of untrusted data and the consequences of improper handling.
- Comprehend the vulnerabilities associated with authentication and authorization mechanisms.
- Learn how to detect and mitigate threats to authentication and authorization functionalities.
- Understand the mechanics and threats of Cross-Site Scripting (XSS) and Injection attacks, and how to defend against them.
- Comprehend the risks associated with XML processing, software uploads, and deserialization, and learn mitigation
strategies.
- Familiarize yourself with security tools, hardening techniques, ongoing threat intelligence resources
- Optional / Bonus: Exploring AI in Web Application Security

Description

Embark on a comprehensive journey into web application security with our two-day seminar-style course, "Securing Web Applications / 2021 OWASP Top Ten and Beyond". Designed for web developers and technical stakeholders, this course equips you with the foundational concepts of defensive and secure coding. You'll learn to move beyond the "penetrate and patch" approach, integrating security into your applications from the get-go, leading to robust, resilient software.
Throughout the engaging course, you'll delve into the best practices for defensively coding web applications, addressing the 2021 OWASP Top Ten and several other vital vulnerabilities. Learn from the mistakes of the past as we dissect real-world examples of poorly designed web applications, providing you with stark illustrations of the potential fallout when security best practices are not adhered to. Our security expert will guide you on the process of integrating security measures into your development lifecycle, ensuring you build secure applications from the ground up.
The course goes beyond theory, offering practical skills directly applicable to your work: ethical hacking, bug hunting,
detection, and mitigation of threats to authentication and authorization functionalities. You'll understand the mechanics and threats of Cross-Site Scripting (XSS) and Injection attacks and comprehend the risks and mitigation strategies associated with XML processing, software uploads, and deserialization.
Unlike many courses that are self-guided or delivered by less experienced trainers, this course is led by a seasoned web
application security expert who shares practical insights, best practices, and real-life experiences, adding invaluable depth to your learning journey. You'll exit this course well-versed in these technologies, equipped with practical skills, plus the ability to effectively communicate and collaborate in your professional environment. With engaging expert-led lectures, interactive discussions, and insightful demos, this course will provide you with the skills required to begin your journey to building safer, stronger web applications.

Prerequisites

This is not a hands-on course, however its helpful if you have:
- Basic understanding of web development and web architecture
- Some familiarity with basic programming concepts.
- Basic understanding of web security concepts.

Lesson: Why Hunt Bugs

The Language of Cybersecurity
The Changing Cybersecurity Landscape
AppSec Dissection of SolarWinds
The Human Perimeter
Interpreting the Verizon Data Breach Investigation Report
First Axiom in Web Application Security Analysis
First Axiom in Addressing ALL Security Concerns
Lab: Case Study in Failure
Lesson: Safe and Appropriate Bug Hunting/Hacking

Working Ethically
Respecting Privacy
Bug/Defect Notification
Bug Bounty Programs
Bug Hunting Mistakes to Avoid
Session: Moving Forward From Hunting Bugs

Lesson: Removing Bugs

Open Web Application Security Project (OWASP
OWASP Top Ten Overview
Web Application Security Consortium (WASC)
CERT Secure Coding Standards
Microsoft Security Response Center
Software-Specific Threat Intelligence
Session: Foundation for Securing Web Applications

Lesson: Principles of Information Security

Security Is a Lifecycle Issue
Minimize Attack Surface Area
Layers of Defense: Tenacious D
Compartmentalize
Consider All Application States
Do NOT Trust the Untrusted
AppSec Dissection of the Verkada Exploit
Session: Bug Stomping 101

Lesson: Unvalidated Data

Buffer Overflows
Integer Arithmetic Vulnerabilities
Defining and Defending Trust Boundaries
Rigorous., Positive Specifications
Whitelisting vs Blacklisting
Challenges: Free-Form Text, Email Addresses, and Uploaded Files
Lesson: A01: Broken Access Control

Elevation of Privileges
Insufficient Flow Control
Unprotected URL/Resource Access/Forceful Browsing
Metadata Manipulation (JWTs)
CORS Misconfiguration Issues
Cross Site Request Forgeries (CSRF)
CSRF Defenses
Lab: Spotlight: Verizon
Lesson: A02: Cryptographic Failures

Identifying Protection Needs
Evolving Privacy Considerations
Options for Protecting Data
Transport/Message Level Security
Weak Cryptographic Processing
Keys and Key Management
NIST Recommendations
Lesson: A03: Injection

Injection Flaws
SQL Injection Attacks Evolve
Drill Down on Stored Procedures
Other Forms of Server-Side Injection
Minimizing Injection Flaws
Client-side Injection: XSS
Persistent, Reflective, and DOM-Based XSS
Best Practices for Untrusted Data
Lesson: A04: Insecure Design

Secure Software Development Processes
Shifting Left
Cost of Continually Reinventing
Leveraging Common AppSec Practices and Control
Paralysis by Analysis
Actionable Application Security
Additional Tools for the Toolbox
Lab: Actionable AppSec
Lesson: A05: Security Misconfiguration

System Hardening
Risks with Internet-Connected Resources (Servers to Cloud)
Minimalist Configurations
Application Whitelisting
Secure Baseline
Segmentation with Containers and Cloud
Lab: Configuration Guidance
Resolution of External References
Safe XML Processing
Session: Bug Stomping 102

Lesson: A06: Vulnerable and Outdated Components

Vulnerable Components
Software Inventory
Managing Updates: Balancing Risk and Timeliness
AppSec Dissection of Ongoing Microsoft Exchange Exploits
Lab: Spotlight: Equifax
Lesson: A07: Identification and Authentication Failures

Quality and Protection of Authentication Data
Proper hashing of passwords
Handling Passwords on Server Side
Session Management
HttpOnly and Security Headers
Lesson: A08: Software and Data Integrity Failures

Serialization/Deserialization
Issues with Consuming Vulnerable Software
Using Trusted Repositories
CI/CD Pipeline Issues
Protecting Software Development Resources
Lesson: A09: Security Logging and Monitoring Failures

Detecting Threats and Active Attacks
Best Practices for Determining What to Log
Safe Logging in Support of Forensics
Lab: Auditing and Logging Guidance
Lesson: A10: Server-Side Request Forgery (SSRF)

Understanding SSRF
Remote Resource Access Scenarios
Complexity of Cloud Services
SSRF Defense in Depth
Positive Allow Lists
Session: Moving Forward

Lesson: Applications: What Next

Common Vulnerabilities and Exposures
CWE/SANS Top 25 Most Dangerous SW Errors
Strength Training: Project Teams/Developers
Strength Training: IT Organizations
Lab: Spotlight: Capital One
Optional / Bonus Content

Bonus Chapter: Leveraging AI in Web Application Security Development

Introduction to AI in Web Application Security
AI-Powered Threat Detection
AI for Secure Coding
AI in Authentication and Access Control
AI in Incident Response
Challenges and Ethical Considerations in AI for Security
Additional course details:

Nexus Humans Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120) training program is a workshop that presents an invigorating mix of sessions, lessons, and masterclasses meticulously crafted to propel your learning expedition forward.

This immersive bootcamp-style experience boasts interactive lectures, hands-on labs, and collaborative hackathons, all strategically designed to fortify fundamental concepts.

Guided by seasoned coaches, each session offers priceless insights and practical skills crucial for honing your expertise. Whether you're stepping into the realm of professional skills or a seasoned professional, this comprehensive course ensures you're equipped with the knowledge and prowess necessary for success.

While we feel this is the best course for the ITS Data Analytics course and one of our Top 10 we encourage you to read the course outline to make sure it is the right content for you.

Additionally, private sessions, closed classes or dedicated events are available both live online and at our training centres in Dublin and London, as well as at your offices anywhere in the UK, Ireland or across EMEA.

FAQ for the Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120) Course

Available Delivery Options for the Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120) training.
  • Live Instructor Led Classroom Online (Live Online)
  • Traditional Instructor Led Classroom (TILT/ILT)
  • Delivery at your offices in London or anywhere in the UK
  • Private dedicated course as works for your staff.
How many CPD hours does the Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120) training provide?

The 2 day. Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120) training course give you up to 12 CPD hours/structured learning hours. If you need a letter or certificate in a particular format for your association, organisation or professional body please just ask.

Which exam does the Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120) training course prepare you for?

The Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120) prepares you for the Yes official exam. You can take this exam at any exam center across UK including, England, Scotland, Cymru (Wales) or Northern Ireland or live online where ever you are. Exams vary in duration and if required you can request with the provider for any accommodations appropriate for you.

What is the correct audience for the Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120) training?

This is an overview-level course ideally suited for web developers, software engineers, system administrators, and other
technical stakeholders who are involved in the design, development, or maintenance of web applications. Security
professionals looking to deepen their understanding of web application vulnerabilities and defense mechanisms would also
greatly benefit. Moreover, project managers and leaders who wish to ensure their teams are following best practices for
secure application development will find this course valuable in shaping their strategic direction.

Do you provide training for the Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120).

Yes we provide corporate training, dedicated training and closed classes for the Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120). This can take place anywhere in UK including, England, Scotland, Cymru (Wales) or Northern Ireland or live online allowing you to have your teams from across UK or further afield to attend a single training event saving travel and delivery expenses.

What is the duration of the Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120) program.

The Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120) training takes place over 2 day(s), with each day lasting approximately 8 hours including small and lunch breaks to ensure that the delegates get the most out of the day.

What other terms do people search for when looking for this course?

Popular related searched include OWASP; Security.

Why are Nexus Human the best provider for the Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120)?
Nexus Human are recognised as one of the best training companies as they and their trainers have won and hold many awards and titles including having previously won the Small Firms Best Trainer award, national training partner of the year for UK on multiple occasions, having trainers in the global top 30 instructor awards in 2012, 2019 and 2021. Nexus Human has also been nominated for the Tech Excellence awards multiple times. Learning Performance institute (LPI) external training provider sponsor 2024.
Is there a discount code for the Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120) training.

Yes, the discount code PENPAL5 is currently available for the Secure Web Applications | OWASP 2021 Top Ten 2021, Web Services, Rich Interfaces & More (TT8120) training. Other discount codes may also be available but only one discount code or special offer can be used for each booking. This discount code is available for companies and individuals.

Jump to dates

Training Insurance Included!

When you organise training, we understand that there is a risk that some people may fall ill, become unavailable. To mitigate the risk we include training insurance for each delegate enrolled on our public schedule, they are welcome to sit on the same Public class within 6 months at no charge, if the case arises.

What people say about us


Top