Introduction to Web Security

Agenda

The order and the depth of each block are adapted to your team – topics you already master are skipped, your questions get the time instead.

1. 01

   IT security fundamentals

   • CIA triad / security principles
   • Encryption
   • Hashing
   • Symmetric / asymmetric encryption
   • Authentication & Authorization
2. 02

   Security concepts in web applications

   • Same Origin Policy / Cross Origin Ressource Sharing
   • Cookie security (cookie attributes such as httpOnly)
   • HTTP security
   • correct use of security-related HTTP headers
   • Content Security Policy (CSP)
   • JWT
   • OAuth2 and OpenID Connect
   • uvm.
3. 03

   Practical application of the security concepts

   • How to ensure data integrity, even when data
     • travels over insecure channels
     • how to secure the communication channel
     • how to protect applications in multiple layers
     • how to store passwords securely, and
   • What to watch out for when
     • Authentication implementation
     • using a web framework
   • Secure implementation of
     • forms and file uploads
     • Denial-of-service protection strategies
     • Security measures for the frontend and
     • secure API development, including REST services
4. 04

   Attacks on web applications

   • OWASP Top-10
   • Credential attacks
   • Cross-Site-Scripting
   • Cross Site Request Forgery (CSRF)
   • various injection attacks (e.g. SQL)
   • DoS
5. 05

   Securing web applications

   • against the attack vectors presented
6. 06

   Introduction to testing a web application for vulnerabilities

   • manual and automated tools
   • static and dynamic analysis for scanning for security vulnerabilities