Intro to principles and practice of secdev

Intro to practical secure development

Setting up the right security requirements using OWASP SKF

Create and train security champions

S-SDLC basics, secure development as integral part of SDLC

Automatic tools and their values, non-automatic tools, pentests, peer code review, assisted code-review

Testing/hacking and fixing

Common server-side vulnerabilities and their defense

Injections: SQLi, XML injections, JSON, XPath, XSS, cookie injection, open redirection, http header injection, 2 deserialization attacks

Path traversal, XXE, Buffer overflow, Zip bomb, Million laugh, RFI, Insecure file upload, Code execution, Remote file inclusion

Command injection

Insecure direct object reference

Server side template injection

CSRF bypassing

JWT

Authorization bypasses

Common client-side vulnerabilities and their defense

XSS (types, impact, causes, defenses, other html injections, BeEF)

CSRF, Clickjacking, Same-origin policy, CORS

Tabnabbing

Client side template injection

Security design

Security by design

Threat modelling

Separation of duties, trust boundaries, security boundaries, defence in depth, principle of least privilege, minimising the attack surface, risk driven mitigation

Business logic vulnerabilities