Web Security 360
When applications on the Internet are exposed to potential attacks around the clock, then security should not just play a secondary role. This is not only true for business-critical applications, but also for any processing of personal and confidential data. Even if applications don't seem particularly important or worth protecting, security vulnerabilities make them a gateway for attacks from inside and outside.
Based on OWASP Top 10 , Security by Design, IT-Grundschutz , and GDPR compliance , numerous other important aspects of web security are covered, including authentication mechanisms such as WebAuthn or best practices for designing and implementing secure APIs.
The content and focus of the training is continuously updated to take new developments in security research and new attacks into account.
Learning Objectives
- You understand the basic principles of secure web development and security by design
- You are familiar with effective security mechanisms
- You know the most important attack vectors and can evaluate resulting risks
- You can identify and eliminate the most common security-related errors
Target Audience
This training is designed for developers, DevOps, and other stakeholders who want to build and operate secure web applications or need to increase the security level of existing applications.
Requirements
Basic knowledge of PHP or a similar programming language is required, as well as experience in creating or running web-based applications.
Web Security 360 1980,- EUR 20 Credits
12 Online Sessions á 120 minutes
-
XSS & Content Security Policy
Duration: 120 minutes
198,- EUR
2 Credits
Cross-site scripting can be effectively prevented, not least through the use of a content security policy.
-
Injection Attack
Duration: 120 minutes
198,- EUR
2 Credits
Whether accessing the database or using external services: does your application cope with manipulated inputs and outputs?
-
Security-relevant headers
Duration: 120 minutes
198,- EUR
2 Credits
For optimum security, browsers today expect a large number of additional headers. Arne Blankerts shows which ones you should be aware of.
-
Attacking the session
Duration: 120 minutes
198,- EUR
2 Credits
Session confidentiality is a fundamental core element of most web applications. It's high time to protect it properly.
-
Transport Security
Duration: 120 minutes
198,- EUR
2 Credits
Today, nothing works without encrypted transmissions. Arne Blankerts shows how to properly secure servers and interfaces with TLS and co.
-
Authentication
Duration: 120 minutes
198,- EUR
2 Credits
A modern login involves more than just a classic password request. Learn how to implement a secure login.
-
Authorisation
Duration: 120 minutes
198,- EUR
2 Credits
Insufficient access protection, extension of rights or indirect, unauthorised access: Learn how to avoid authorisation errors.
-
Cross-Origin Resource Sharing (CORS)
Duration: 120 minutes
198,- EUR
2 Credits
Cross-Origin Resource Sharing is a standard mechanism for the controlled integration of distributed web applications. Learn how to implement it correctly and securely.
-
API Security
Duration: 120 minutes
198,- EUR
2 Credits
Automated interfaces accessible via the internet require a special level of security. Learn what to look out for during API development and operation.
-
GDPR & Co
Duration: 120 minutes
198,- EUR
2 Credits
The GDPR places high demands on the security of servers, applications and data storage.Learn how you should set up your application so that you don't run into any problems with the GDPR.
-
On the way to production
Duration: 120 minutes
198,- EUR
2 Credits
Secure deployment and management of access data: Just two of many questions on the way to live operation.
-
After the launch
Duration: 120 minutes
198,- EUR
2 Credits
Whether patch management or monitoring, there are many things you should pay attention to in addition to further development during operation.
Your Trainer
Arne Blankerts
has solutions ready before others have even understood the problem.
Exclusive and customized?
We are happy to conduct any training exclusively online ("in-house") for you. We adapt the content and focus to your specific wishes and needs and optionally work with examples directly from your code base.