Implementing a secure networked application can be challenging, even for developers who have previously used various cryptographic building blocks (such as encryption and digital signatures). To help participants understand the role and usage of these cryptographic primitives, this course first establishes a solid foundation on the main requirements of secure communication – secure acknowledgement, integrity, confidentiality, remote identification, and anonymity – while also presenting typical problems that may compromise these requirements along with real-world solutions.
As cryptography is a critical aspect of network security, this course discusses the most important cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. Rather than presenting an in-depth mathematical background, these concepts are explored from a developer's perspective, showing typical use-case examples and practical considerations related to the use of crypto, such as public key infrastructures (PKI). Security protocols in various areas of secure communication are introduced, with an in-depth discussion on the most widely-used protocol families such as IPSEC and SSL/TLS.
Typical cryptographic vulnerabilities are discussed both related to certain crypto algorithms and cryptographic protocols, such as BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and similar threats, as well as the RSA timing attack. For each case, the practical considerations and potential consequences are described without going into deep mathematical details.
Finally, as XML technology is central for data exchange by networked applications, the security aspects of XML are described. This includes the usage of XML within web services and SOAP messages alongside protection measures such as XML signature and XML encryption – as well as weaknesses in those protection measures and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.
Participants attending this course will
- Understand basic concepts of security, IT security, and secure coding
- Understand the requirements of secure communication
- Learn about network attacks and defenses at different OSI layers
- Have a practical understanding of cryptography
- Understand essential security protocols
- Understand some recent attacks against cryptosystems
- Get information about some recent related vulnerabilities
- Understand security concepts of Web services
- Get sources and further readings on secure coding practices
Audience
Developers, Professionals
Read more...
