With the increase in cybercrime and threat actors targeting web applications and software vulnerabilities as a route to exploit business, it's time to start building security into new systems developments processes right from the start. [...]
  • QASECDEV-QA
  • Cena na vyžádání

With the increase in cybercrime and threat actors targeting web applications and software vulnerabilities as a route to exploit business, it's time to start building security into new systems developments processes right from the start. Most successful cyber-attacks still depend on exploiting a few well-known common vulnerabilities. This course, updated with the latest OWASP Top 10, will show you how security can be designed into, managed and maintained within a development lifecycle.The course includes the following technical practice simulation CYRIN labs, which are available to learners for six months post class.1. Web Application Security Analysis using OWASP-ZAPStudents will use the OWASP program’s ZAP tool suite from within Kali Linux to scan multiple web services and document vulnerabilities. Students will see ZAP in action on a vulnerable web site where entire database tables are available to potential attackers.2. Web Application Security Analysis using NiktoStudents will use the Nikto tool to test web services over the network and document vulnerabilities. Students will then use network packet capture tools such as Wireshark to verify their understanding of the vulnerabilities and testing procedures.3. Web Application Security Analysis using VegaStudents will use the Vega scanning tool, within a graphical Kali Linux environment, to test web services over the network and document vulnerabilities. Students will then use network packet capture tools such as Wireshark to verify their understanding of the vulnerabilities and testing procedures.4. Web Application Security Analysis using Burp SuiteBurp Suite is an industry standard suite of tools used by information security professionals for testing Web application security. Its tools work together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security vulnerabilities.5. Detecting and Exploiting SQL Injection VulnerabilitiesStudents will learn how to detect and exploit SQL injection vulnerabilities. By using several SQL injections techniques students will gather information about a remote database such as Operating System, database type, table names and their content. Students will then use sqlmap, a tool for SQL injection, to automate this process.6. Web Site ReconnaissanceWeb site reconnaissance is about gathering information about a web site. Of course, there is information published on the website that is intended for people to see. Then there is information such as the name and version of the software used in the website and information about databases used by web applications on the site. This is information the website owner may not want known but can be discovered using techniques covered by CYRIN labs in the Network Monitoring and Recon and Web Application Security Analysis categories.

  • Understand the main Secure Development Lifecycle (SDLC) Models, and their principal differences
  • Be able to choose which SDLC model is most appropriate in a given situation.
  • Learn how to apply secure development techniques from the initial design stage and throughout a development lifecycle
  • Understand the latest (2021) OWASP vulnerabilities and how to counter/mitigate them
  • Learn about useful system design tools
  • Discover resources to help introduce and use secure design and development best practices
  • Learn Threat Modelling methodologies and techniques
  • Understand the benefits of code review
  • Understand various testing strategies
  • Learn about encryption, securing and compromising passwords and meta data
  • An introduction to the classification of security flaws and application security

Mám zájem o vybraný QA kurz