Certified Application Security Engineer (CASE .NET) Certification - Brunei Darussalam

Certified Application Security Engineer Certification Course Outline

Module 1: Understanding Application Security, Threats and Attacks

• What is a Secure Application?
• Need for Application Security
• Most Common Application Level Attacks
• Why Applications become Vulnerable to Attacks?
• What Constitutes Comprehensive Application Security?
• Insecure Application: A Software Development Problem
• Software Security Standards, Models and Frameworks

Module 2: Security Requirements Gathering

• Importance of Gathering Security Requirements
• Security Requirement Engineering (SRE)
• Abuse Case and Security Use Case Modelling
• Abuser and Security Stories
• Security Quality Requirements Engineering (SQUARE)
• Operationally Critical Threat, Asset and Vulnerability Evaluation (OCTAVE)

Module 3: Secure Application Design and Architecture

• Relative Cost of Fixing Vulnerabilities at Different Phases of SDLC
• Secure Application Design and Architecture
• Goal of Secure Design Process
• Secure Design Actions
• Secure Design Principles
• Threat Modelling
• Decompose Application
• Secure Application Architecture

Module 4: Secure Coding Practices for Input Validation

• Input Validation
• Why Input Validation?
• Input Validation Specification
• Input Validation Approaches
• Input Filtering
• Secure Coding Practices for Input Validation: Web Forms
• Secure Coding Practices for Input Validation: ASP.NET Core
• Secure Coding Practices for Input Validation: MVC

Module 5: Secure Coding Practices for Authentication and Authorisation

• Authentication and Authorisation
• Common Threats on User Authentication and Authorisation
• Authentication and Authorisation: Web Forms
• Authentication and Authorisation: ASP .NET Core
• Authentication and Authorisation: MVC
• Authentication and Authorisation Defensive Techniques: Web Forms
• Authentication and Authorisation Defensive Techniques: ASP .NET Core
• Authentication and Authorisation Defensive Techniques: MVC

Module 6: Secure Coding Practices for Cryptography

• Cryptographic
• Ciphers
• Block Ciphers Modes
• Symmetric Encryption Keys
• Asymmetric Encryption Keys
• Functions of Cryptography
• Use of Cryptography to Mitigate Common Application Security Threats
• Cryptographic Attacks
• Techniques Attackers Use to Steal Cryptographic Keys
• What should you do to Secure .Net Applications for Cryptographic Attacks?
• .NET Cryptographic Name Spaces
• .NET Cryptographic Class Hierarchy
• Symmetric Encryption
• Symmetric Encryption: Defensive Coding Techniques
• Asymmetric Encryption
• Asymmetric Encryption: Defensive Coding Techniques
• Hashing
• Digital Signatures
• Digital Certificates
• XML Signature
• ASP.NET Core Specific Secure Cryptography Practices

Module 7: Secure Coding Practices for Session Management

• What are Exceptions/Runtime Errors?
• Need for Secure Error/Exception Handling
• Consequences of Detailed Error Message
• Exposing Detailed Error Messages
• Considerations: Designing Secure Error Messages
• Secure Exception Handling
• Handling Exceptions in an Application
• Defensive Coding practices against Information Disclosure
• Defensive Coding practices against Improper Error Handling
• ASP .NET Core: Secure Error Handling Practices
• Secure Auditing and Logging
• Tracing .NET
• Auditing and Logging Security Checklists

Module 8: Static and Dynamic Application Security Testing (SAST and DAST)

• Static Application Security Testing
• Manual Secure Code Review for Most Common Vulnerabilities
• Code Review: Check List Approach
• SAST Finding
• SAST Report
• Dynamic Application Security Testing
• Automated Application Vulnerability Scanning Tools
• Proxy-Based Security Testing Tools
• Choosing between SAST and DAST

Module 9: Secure Deployment and Maintenance

• Secure Deployment
• Prior Deployment Activity
• Deployment Activities: Ensuring Security at Various Levels
• Ensuring Security at Host Level
• Ensuring Security at Network Level
• Ensuring Security at Application Level
• Web Application Firewall (WAF)
• Ensuring Security at IIS Level
• Sites and Virtual Directories
• ISAPI Filters
• Ensuring Security at .NET Level
• Ensuring Security at SQL Server Level
• Security Maintenance and Monitoring