Duration: 3 days
Time: 9am to 5pm
What Will Be Taught For This Certified Application Security Engineer Course?
The Certified Application Security Engineer (CASE) focuses on secure application software development processes.
It is a, hands-on, comprehensive application security course that will help you create a secure application software.
This course encompasses security activities involved in all phases of the Secure Software Development Lifecycle (SDLC): planning, creating, testing, and deploying an application.
Unlike other application security trainings, CASE goes beyond just the guidelines on secure coding practices to include secure requirement gathering, robust application design, and handling security issues in post development phases of application development.
The CASE certification exam and training program prepare application security engineers, analysts, testers, and anyone with exposure to any phase of SDLC to build secure applications that are robust enough to meet today’s challenging operational environment by focusing not just on secure coding, but much more.
This makes CASE one of the most comprehensive certifications on the market today. It’s desired by software application engineers, analysts, testers globally, and respected by hiring authorities
Module 01: Understanding Application Security, Threats, and Attacks
- What is a Secure Application
- Need for Application Security
- Most Common Application Level Attacks
- Why Applications become Vulnerable to Attacks
- What Constitutes a Comprehensive Application Security?
- Insecure Application: A Software Development Problem
- Software Security Standards, Models, and Frameworks
Module 02: Security Requirements Gathering
- Importance of Gathering Security Requirements
- Security Requirement Engineering (SRE)
- Abuse Case and Security Use Case Modeling
- Abuser and Security Stories
- Security Quality Requirements Engineering (SQUARE)
- Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)
Module 03: Secure Application Design and Architecture
- Relative Cost of Fixing Vulnerabilities at Different Phases of SDLC
- Secure Application Design and Architecture
- Goal of Secure Design Process
- Secure Design Actions
- Secure Design Principles
- Threat Modeling
- Decompose Application
- Secure Application Architecture
Module 04: Secure Coding Practices for Input Validation
- Input Validation
- Why Input Validation?
- Input Validation Specification
- Input Validation Approaches
- Input Filtering
- Secure Coding Practices for Input Validation: Web Forms
- Secure Coding Practices for Input Validation: ASP.NET Core
- Secure Coding Practices for Input Validation: MVC
Module 05: Secure Coding Practices for Authentication and Authorization
- Authentication and Authorization
- Common Threats on User Authentication and Authorization
- Authentication and Authorization: Web Forms
- Authentication and Authorization: ASP.NET Core
- Authentication and Authorization: MVC
- Authentication and Authorization Defensive Techniques: Web Forms
- Authentication and Authorization Defensive Techniques: ASP.NET Core
- Authentication and Authorization Defensive Techniques: MVC
Module 06: Secure Coding Practices for Cryptography
- Block Cipher Modes
- Symmetric Encryption Keys
- Asymmetric Encryption Keys
- Functions of Cryptography
- Use of Cryptography to Mitigate Common Application Security Threats
- Cryptographic Attacks
- Techniques Attackers Use to Steal Cryptographic Keys
- What should you do to Secure .NET Applications from Cryptographic Attacks?
- .NET Cryptography Namespaces
- .NET Cryptographic Class Hierarchy
- Symmetric Encryption
- Symmetric Encryption: Defensive Coding Techniques
- Asymmetric Encryption
- Asymmetric Encryption: Defensive Coding Techniques
- Digital Signatures
- Digital Certificates
- XML Signatures
- ASP.NET Core Specific Secure Cryptography Practices
Module 07: Secure Coding Practices for Session Management
- Session Management
- ASP.NET Session Management Techniques
- Defensive Coding Practices against Broken Session Management
- ViewState-based Session Management
- ASP.NET CORE: Secure Session Management Practices
Module 08: Secure Coding Practices for Error Handling
- What are Exceptions/Runtime Errors?
- Need of Secure Error/Exception Handling
- Consequences of Detailed Error Message
- Exposing Detailed Error Messages
- Considerations: Designing Secure Error Messages
- Secure Exception Handling
- Handling Exceptions in an Application
- Defensive Coding practices against Information Disclosure
- Defensive Coding practices against Improper Error Handling
- ASP.NET Core: Secure Error Handling Practices
- Secure Auditing and logging
- Tracing in .NET
Module 09 Static and Dynamic Application Security Testing (SAST & DAST)
- Static Application Security Testing
- Manual Secure Code Review for Most Common Vulnerabilities
- Code Review: Check List Approach
- SAST Finding
- SAST Report
- Dynamic Application Security Testing
- Automated Application Vulnerability Scanning Tools
- Proxy-based Security Testing Tools
- Choosing Between SAST and DAST
Module 10: Secure Deployment and Maintenance
- Secure Deployment
- Prior Deployment Activity
- Deployment Activities: Ensuring Security at Various Levels
- Ensuring Security at Host Level
- Ensuring Security at Network Level
- Ensuring Security at Application Level
- Web Application Firewall (WAF)
- Ensuing Security at IIS level
- Sites and Virtual Directories
- ISAPI Filters
- Ensuring Security at .NET Level
- Ensuring Security at SQL Server Level
- Security Maintenance and Monitoring
Who Should Attend This Certified Application Security Engineer Training?
- .NET Developers with a minimum of 2 years of experience and individuals who want to become application security engineers/analysts/testers.
- Project Manager and Individuals involved in the role of developing, testing, managing, or protecting applications
You must be well-versed with .NET programming language.
|w/o GST||w GST|
1. 2 to 4 weeks’ written notice from start date of training - 50% of course fee for cancellation
2. Less than 2 weeks’ written notice from start date of training - 100% of course fees for postponement or cancellation
3. Course schedule selected is subjected to confirmation.
4. ST Electronics (e-Services) Pte Ltd reserves the rights to withdraw, re-schedule the class or change the venue due to unforeseen circumstances.
Please click on the course date to enrol.