Implementing a secure networked application can be challenging, even for developers who have previously utilized various cryptographic building blocks (such as encryption and digital signatures). To help participants grasp the role and application of these cryptographic primitives, the course first establishes a solid foundation on the core requirements of secure communication – secure acknowledgement, integrity, confidentiality, remote identification, and anonymity. It also highlights typical issues that can compromise these requirements and presents real-world solutions.
Given that cryptography is a critical aspect of network security, the course discusses essential cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. Instead of delving into an in-depth mathematical background, these elements are examined from a developer's perspective, illustrating typical use-case examples and practical considerations related to crypto usage, such as public key infrastructures. The course introduces security protocols across various areas of secure communication, with an in-depth discussion on the most widely used protocol families, such as IPSEC and SSL/TLS.
Typical crypto vulnerabilities are examined, both concerning specific crypto algorithms and cryptographic protocols, such as BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and others, as well as the RSA timing attack. For each issue, practical considerations and potential consequences are described, again without going into deep mathematical details.
Finally, as XML technology is central to data exchange in networked applications, the security aspects of XML are described. This includes the usage of XML within web services and SOAP messages alongside protection measures such as XML signature and XML encryption – as well as weaknesses in those protection measures and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.
Participants attending this course will
- Understand basic concepts of security, IT security, and secure coding
- Understand the requirements of secure communication
- Learn about network attacks and defenses at different OSI layers
- Acquire a practical understanding of cryptography
- Understand essential security protocols
- Understand some recent attacks against cryptosystems
- Get information about some recent related vulnerabilities
- Understand security concepts of Web services
- Get sources and further readings on secure coding practices
Audience
Developers, Professionals
Read more...
