{"course":{"productid":30329,"modality":1,"active":true,"language":"de","title":"Cloud application security in Java for AWS\u00a0","productcode":"CASEC-JAWS","vendorcode":"CY","vendorname":"Cydrill","fullproductcode":"CY-CASEC-JAWS","courseware":{"has_ekit":false,"has_printkit":true,"language":""},"url":"https:\/\/portal.flane.ch\/course\/cydrill-casec-jaws","objective":"<ul>\n<li>Understand cloud security specialties<\/li><li>Getting familiar with essential cyber security concepts<\/li><li>Understanding how cryptography supports security<\/li><li>Learning how to use cryptographic APIs correctly in Java<\/li><li>Understanding Web application security issues<\/li><li>Detailed analysis of the OWASP Top Ten elements<\/li><li>Putting Web application security in the context of Java<\/li><li>Going beyond the low hanging fruits<\/li><li>Managing vulnerabilities in third party components<\/li><li>Learn to deal with cloud infrastructure security<\/li><li>Input validation approaches and principles<\/li><li>Identify vulnerabilities and their consequences<\/li><li>Learn the security best practices in Java<\/li><\/ul>","essentials":"<p>General Java and Web development<\/p>","audience":"<p>Java developers working on Web applications and AWS<\/p>","outline":"<h4>Day 1<\/h4><ul>\n<li><strong>Cyber security basics<\/strong><ul>\n<li>What is security?<\/li><li>Threat and risk<\/li><li>Cyber security threat types &ndash; the CIA triad<\/li><li>Cyber security threat types &ndash; the STRIDE model<\/li><li>Consequences of insecure software<\/li><\/ul><\/li><li><strong>Cloud security basics<\/strong><ul>\n<li>Cloud infrastructure basics<\/li><li>The Cloud Cube Model and Zero Trust Architecture<\/li><\/ul><\/li><li><strong>The OWASP Top Ten 2021<\/strong><ul>\n<li>The OWASP Top 10 2021<\/li><li>A01 - Broken Access Control<ul>\n<li>Access control basics<\/li><li>Failure to restrict URL access<\/li><li>Confused deputy<\/li><li>File upload<\/li><li>Open redirects and forwards<\/li><li>Cross-site Request Forgery (CSRF)<\/li><\/ul><\/li><li>A02 - Cryptographic Failures<ul>\n<li>Information exposure<\/li><li>Cryptography for developers<\/li><\/ul><\/li><\/ul>\n\n<h4>Day 2<\/h4><ul>\n<li><strong>A02 - Cryptographic Failures (continued)<\/strong><ul>\n<li>Cryptography for developers<\/li><li>Transport security<\/li><\/ul><\/li><li><strong>A03 - Injection<\/strong><ul>\n<li>Injection principles<\/li><li>Injection attacks<\/li><li>SQL injection<\/li><li>NoSQL injection<\/li><li>Parameter manipulation<\/li><li>Code injection<\/li><li>HTML injection - Cross-site scripting (XSS)<\/li><\/ul><\/li><\/ul>\n\n<h4>Day 3<\/h4><ul>\n<li><strong>A04 - Insecure Design<\/strong><ul>\n<li>The STRIDE model of threats<\/li><li>Secure design principles of Saltzer and Schroeder<\/li><li>Client-side security<\/li><\/ul><\/li><li><strong>A05 - Security Misconfiguration<\/strong><ul>\n<li>Configuration principles<\/li><li>Server misconfiguration<\/li><li>AWS configuration best practices<\/li><li>Cookie security<\/li><li>XML entities<\/li><\/ul><\/li><li><strong>A06 - Vulnerable and Outdated Components<\/strong><ul>\n<li>Using vulnerable components<\/li><li>Assessing the environment<\/li><li>Hardening<\/li><li>Untrusted functionality import<\/li><li>Vulnerability management<\/li><\/ul><\/li><li><strong>A07 - Identification and Authentication Failures<\/strong><ul>\n<li>Authentication<\/li><li>Session management<\/li><li>Identity and access management (IAM)<\/li><\/ul><\/li><\/ul>\n\n<h4>Day 4<\/h4><ul>\n<li><strong>A07 - Identification and Authentication Failures (continued)<\/strong><ul>\n<li>Password management<\/li><\/ul><\/li><li><strong>A08 - Software and Data Integrity Failures<\/strong><ul>\n<li>Integrity protection<\/li><li>Subresource integrity<\/li><li>Insecure deserialization<\/li><\/ul><\/li><li><strong>A09 - Security Logging and Monitoring Failures<\/strong><ul>\n<li>Logging and monitoring principles<\/li><li>Log forging<\/li><li>Log forging &ndash; best practices<\/li><li>Case study &ndash; Log interpolation in log4j<\/li><li>Case study &ndash; The Log4Shell vulnerability (CVE-2021-44228)<\/li><li>Case study &ndash; Log4Shell follow-ups (CVE-2021-45046, CVE-2021-45105)<\/li><li>Lab &ndash; Log4Shell<\/li><li>Logging best practices<\/li><li>Detection and monitoring<\/li><\/ul><\/li><li><strong>A10 - Server-side Request Forgery (SSRF) <\/strong><ul>\n<li>Server-side Request Forgery (SSRF)<\/li><li>Case study &ndash; SSRF and the Capital One breach<\/li><\/ul><\/li><\/ul>\n\n<h4>Cloud security<\/h4>\n<strong>AWS security<\/strong><ul>\n<li>Security considerations<\/li><li>Data security in the cloud<\/li><\/ul>\n\n<h4>Day 5<\/h4>\n<strong>Cloud security<\/strong><ul>\n<li><strong>Container security<\/strong><ul>\n<li>Container security concerns<\/li><li>Containerization, virtualization and security<\/li><li>The attack surface<\/li><li>Docker security<\/li><li>Kubernetes security<\/li><\/ul><\/li><\/ul><\/li><\/ul><h4>The OWASP Top Ten 2021<\/h4><p>\n<strong>Web application security beyond the Top Ten<\/strong><\/p>\n<ul>\n<li>Code quality<\/li><li>Denial of service<\/li><\/ul><h4>Input validation<\/h4><ul>\n<li>Input validation principles<\/li><li>Denylists and allowlists<\/li><li>What to validate &ndash; the attack surface<\/li><li>Where to validate &ndash; defense in depth<\/li><li>When to validate &ndash; validation vs transformations<\/li><li>Validation with regex<\/li><li><strong>Integer handling problems<\/strong><ul>\n<li>Representing signed numbers<\/li><li>Integer visualization<\/li><li>Integer overflow<\/li><li>Lab &ndash; Integer overflow<\/li><li>Signed \/ unsigned confusion in Java<\/li><li>Case study &ndash; The Stockholm Stock Exchange<\/li><li>Integer truncation<\/li><li>Best practices<\/li><\/ul><\/li><li><strong>Files and streams<\/strong><ul>\n<li>Path traversal<\/li><li>Lab &ndash; Path traversal<\/li><li>Path traversal-related examples<\/li><li>Additional challenges in Windows<\/li><li>Virtual resources<\/li><li>Path traversal best practices<\/li><li>Lab &ndash; Path canonicalization<\/li><\/ul><\/li><li><strong>Unsafe reflection<\/strong><ul>\n<li>Reflection without validation<\/li><li>Lab &ndash; Unsafe reflection<\/li><\/ul><\/li><li><strong>Unsafe native code<\/strong><ul>\n<li>Native code dependence<\/li><li>Lab &ndash; Unsafe native code<\/li><li>Best practices for dealing with native code<\/li><\/ul><\/li><\/ul><h4>Wrap up<\/h4><ul>\n<li>Secure coding principles<\/li><li>And now what?<\/li><\/ul>","summary":"<p>Your cloud application written in Java works as intended, so you are done, right? But did you consider feeding in incorrect values? 16Gbs of data? A null? An apostrophe? Negative numbers, or specifically -1 or -2^31? Because that&rsquo;s what the bad guys will do &ndash; and the list is far from complete.<\/p>\n<p>The cloud has become a critical aspect of online services. No matter which model you&rsquo;re using (SaaS, PaaS, IaaS), part of your service is now operated by someone else. This may look like a net positive, but it also greatly expands the attack surface and brings in several new risks that may not be obvious. Have you configured all security settings correctly? Are you prepared for supply chain attacks? How can you protect the confidentiality of user data in the cloud? And most importantly: can the bad guys use your exposure to their advantage?<\/p>\n<p>Handling security needs a healthy level of paranoia, and this is what this course provides: a strong emotional engagement by lots of hands-on labs and stories from real life, all to substantially improve code hygiene. Mistakes, consequences, and best practices are our blood, sweat and tears.<\/p>\n<p>The curriculum goes through the common Web application security issues following the OWASP Top Ten but goes far beyond it both in coverage and the details.All this is put in the context of Java, and extended by core programming issues, discussing security pitfalls of the Java language and the AWS cloud platform.<\/p>\n<p>So that you are prepared for the forces of the dark side.<\/p>\n<p>So that nothing unexpected happens.<\/p>\n<p>Nothing.<\/p>","objective_plain":"- Understand cloud security specialties\n- Getting familiar with essential cyber security concepts\n- Understanding how cryptography supports security\n- Learning how to use cryptographic APIs correctly in Java\n- Understanding Web application security issues\n- Detailed analysis of the OWASP Top Ten elements\n- Putting Web application security in the context of Java\n- Going beyond the low hanging fruits\n- Managing vulnerabilities in third party components\n- Learn to deal with cloud infrastructure security\n- Input validation approaches and principles\n- Identify vulnerabilities and their consequences\n- Learn the security best practices in Java","essentials_plain":"General Java and Web development","audience_plain":"Java developers working on Web applications and AWS","outline_plain":"Day 1\n\n\n- Cyber security basics\n- What is security?\n- Threat and risk\n- Cyber security threat types \u2013 the CIA triad\n- Cyber security threat types \u2013 the STRIDE model\n- Consequences of insecure software\n- Cloud security basics\n- Cloud infrastructure basics\n- The Cloud Cube Model and Zero Trust Architecture\n- The OWASP Top Ten 2021\n- The OWASP Top 10 2021\n- A01 - Broken Access Control\n- Access control basics\n- Failure to restrict URL access\n- Confused deputy\n- File upload\n- Open redirects and forwards\n- Cross-site Request Forgery (CSRF)\n- A02 - Cryptographic Failures\n- Information exposure\n- Cryptography for developers\n\n\nDay 2\n\n\n- A02 - Cryptographic Failures (continued)\n- Cryptography for developers\n- Transport security\n- A03 - Injection\n- Injection principles\n- Injection attacks\n- SQL injection\n- NoSQL injection\n- Parameter manipulation\n- Code injection\n- HTML injection - Cross-site scripting (XSS)\n\n\nDay 3\n\n\n- A04 - Insecure Design\n- The STRIDE model of threats\n- Secure design principles of Saltzer and Schroeder\n- Client-side security\n- A05 - Security Misconfiguration\n- Configuration principles\n- Server misconfiguration\n- AWS configuration best practices\n- Cookie security\n- XML entities\n- A06 - Vulnerable and Outdated Components\n- Using vulnerable components\n- Assessing the environment\n- Hardening\n- Untrusted functionality import\n- Vulnerability management\n- A07 - Identification and Authentication Failures\n- Authentication\n- Session management\n- Identity and access management (IAM)\n\n\nDay 4\n\n\n- A07 - Identification and Authentication Failures (continued)\n- Password management\n- A08 - Software and Data Integrity Failures\n- Integrity protection\n- Subresource integrity\n- Insecure deserialization\n- A09 - Security Logging and Monitoring Failures\n- Logging and monitoring principles\n- Log forging\n- Log forging \u2013 best practices\n- Case study \u2013 Log interpolation in log4j\n- Case study \u2013 The Log4Shell vulnerability (CVE-2021-44228)\n- Case study \u2013 Log4Shell follow-ups (CVE-2021-45046, CVE-2021-45105)\n- Lab \u2013 Log4Shell\n- Logging best practices\n- Detection and monitoring\n- A10 - Server-side Request Forgery (SSRF) \n- Server-side Request Forgery (SSRF)\n- Case study \u2013 SSRF and the Capital One breach\n\n\nCloud security\n\n\nAWS security\n- Security considerations\n- Data security in the cloud\n\n\nDay 5\n\n\nCloud security\n- Container security\n- Container security concerns\n- Containerization, virtualization and security\n- The attack surface\n- Docker security\n- Kubernetes security\nThe OWASP Top Ten 2021\n\n\nWeb application security beyond the Top Ten\n\n\n- Code quality\n- Denial of service\nInput validation\n\n\n- Input validation principles\n- Denylists and allowlists\n- What to validate \u2013 the attack surface\n- Where to validate \u2013 defense in depth\n- When to validate \u2013 validation vs transformations\n- Validation with regex\n- Integer handling problems\n- Representing signed numbers\n- Integer visualization\n- Integer overflow\n- Lab \u2013 Integer overflow\n- Signed \/ unsigned confusion in Java\n- Case study \u2013 The Stockholm Stock Exchange\n- Integer truncation\n- Best practices\n- Files and streams\n- Path traversal\n- Lab \u2013 Path traversal\n- Path traversal-related examples\n- Additional challenges in Windows\n- Virtual resources\n- Path traversal best practices\n- Lab \u2013 Path canonicalization\n- Unsafe reflection\n- Reflection without validation\n- Lab \u2013 Unsafe reflection\n- Unsafe native code\n- Native code dependence\n- Lab \u2013 Unsafe native code\n- Best practices for dealing with native code\nWrap up\n\n\n- Secure coding principles\n- And now what?","summary_plain":"Your cloud application written in Java works as intended, so you are done, right? But did you consider feeding in incorrect values? 16Gbs of data? A null? An apostrophe? Negative numbers, or specifically -1 or -2^31? Because that\u2019s what the bad guys will do \u2013 and the list is far from complete.\n\nThe cloud has become a critical aspect of online services. No matter which model you\u2019re using (SaaS, PaaS, IaaS), part of your service is now operated by someone else. This may look like a net positive, but it also greatly expands the attack surface and brings in several new risks that may not be obvious. Have you configured all security settings correctly? Are you prepared for supply chain attacks? How can you protect the confidentiality of user data in the cloud? And most importantly: can the bad guys use your exposure to their advantage?\n\nHandling security needs a healthy level of paranoia, and this is what this course provides: a strong emotional engagement by lots of hands-on labs and stories from real life, all to substantially improve code hygiene. Mistakes, consequences, and best practices are our blood, sweat and tears.\n\nThe curriculum goes through the common Web application security issues following the OWASP Top Ten but goes far beyond it both in coverage and the details.All this is put in the context of Java, and extended by core programming issues, discussing security pitfalls of the Java language and the AWS cloud platform.\n\nSo that you are prepared for the forces of the dark side.\n\nSo that nothing unexpected happens.\n\nNothing.","skill_level":"Intermediate","version":"1","duration":{"unit":"d","value":5,"formatted":"5 Tage"},"pricelist":{"List Price":{"SI":{"country":"SI","currency":"EUR","taxrate":20,"price":3750},"MK":{"country":"MK","currency":"EUR","taxrate":null,"price":3750},"GR":{"country":"GR","currency":"EUR","taxrate":null,"price":3750},"HU":{"country":"HU","currency":"EUR","taxrate":20,"price":3750},"DE":{"country":"DE","currency":"EUR","taxrate":19,"price":3750},"AT":{"country":"AT","currency":"EUR","taxrate":20,"price":3750},"SE":{"country":"SE","currency":"EUR","taxrate":25,"price":3750},"CH":{"country":"CH","currency":"CHF","taxrate":8.1,"price":3750}}},"lastchanged":"2026-01-12T11:24:34+01:00","parenturl":"https:\/\/portal.flane.ch\/swisscom\/json-courses","nexturl_course_schedule":"https:\/\/portal.flane.ch\/swisscom\/json-course-schedule\/30329","source_lang":"de","source":"https:\/\/portal.flane.ch\/swisscom\/json-course\/cydrill-casec-jaws"}}