Web Application Security Basics

• What is Untrusted Data?
• HTTP Security Considerations
• Anti-Pattern and Weaknesses
• Security Controls and Positive Pattern
• Input Validation

Authentication and Session Management

• Registration of New Users
• Login Process
• Attacks Against Authentication
• Secure Cookies
• Credential Security
• Multi-Factor Authentication
• Federated Identity, SAML, OAuth et al

Access Control

• Identity and Access Control
• Anti-Pattern and Pattern
• Role-Based Access Control
• Multi-Tenancy
• Contextual Access Control
• Attribute-Based Access Control

Cross-Site Scripting (XSS) Defense

• Content Spoofing
• Reflected, Stored and DOM-Based XSS
• Defending Against XSS
• Input and HTML Validation and Sanitization
• Output Encoding
• Secure JSON Pattern jQuery and DOM XSS

Cross-Site Request Forgery (CSRF) Defense and Clickjacking

• How Does CSRF Work?
• Stored, Intranet, Network and Unauthenticated CSRF
• How to Combat CSRF
• Synchronizer Token and Challenge/Response Pattern
• HTTP Request Referrer Header Verification
• XSS Defense and CSRF Protection
• Clickjacking
• How to Combat Clickjacking

Protecting Sensitive Data

• Securing Data in Transit
• Protocol Versions and Cipher Suites
• Certificates and Trust Managers
• Securing Data at Rest
• Encryption and Signing
• Key Management
• Secure Random Numbers

SQL Injection and Other Injection Attacks

• What is SQL Injection?
• Query Parameterization
• Stored Procedures
• Defense in Depth
• Input Validation and Type Safety
• Access Control
• Relational Mapping and ORMs
• XML, JSON and Command Injections

Safe File Upload and File I/O

• Anti-Pattern and Design Flaws
• File Path and Null Byte Injections
• File I/O Resource Management
• File Upload Security
• Attack Pattern
• Dangerous Content, Overwrites and Quota Overload DoS
• Processing zip, rar and other Archives
• Positive Pattern

Logging, Error Handling, and Intrusion Detection

• Logging Basics
• What to Log, What Not
• Logging Frameworks for Security
• Safe Error Handling
• App Layer Intrusion Detection
• Defending Against Automated Attacks
• OWASP AppSensor

Secure Software Development Lifecycle

• Averting Disaster Before it Starts
• Team Roles for Security
• Security Throughout the Application Life Cycle
• Security in the Software Development Life Cycle
• Business and Technical Security Requirements
• Implementing Security Controls
• Testing Security Controls
• Monitoring and Incident Response