Implementing a secure networked application can be challenging, even for developers who have previously utilized various cryptographic building blocks (such as encryption and digital signatures). To help participants grasp the role and application of these cryptographic primitives, the course first establishes a solid foundation on the core requirements of secure communication—secure acknowledgment, integrity, confidentiality, remote identification, and anonymity. It also highlights typical threats to these requirements alongside real-world solutions.
Since cryptography is a critical aspect of network security, the course discusses the most important algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. Rather than focusing on deep mathematical backgrounds, these elements are presented from a developer's perspective, illustrating typical use-case examples and practical considerations related to cryptography, such as public key infrastructures. Security protocols used in various areas of secure communication are introduced, with an in-depth discussion on widely-used protocol families like IPSEC and SSL/TLS.
Common cryptographic vulnerabilities are examined, both concerning specific crypto algorithms and protocols, such as BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and others, as well as RSA timing attacks. For each issue, practical considerations and potential consequences are described, without delving into complex mathematical details.
Finally, given that XML technology is central to data exchange for networked applications, the security aspects of XML are covered. This includes the usage of XML within web services and SOAP messages, along with protection measures such as XML signature and XML encryption. The course also addresses weaknesses in these protection measures and XML-specific security issues like XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.
Participants attending this course will
- Understand basic concepts of security, IT security, and secure coding
- Understand the requirements of secure communication
- Learn about network attacks and defenses at different OSI layers
- Have a practical understanding of cryptography
- Understand essential security protocols
- Understand some recent attacks against cryptosystems
- Get information about some recent related vulnerabilities
- Understand security concepts of Web services
- Get sources and further readings on secure coding practices
Audience
Developers, Professionals
Read more...
