Category:OWASP AppSec Conference Training - Revision history

Wichers: /* T8. Writing Secure Code ASP.NET - Sep 22-23, 2008 */

2008-09-19T15:10:02Z

‎T8. Writing Secure Code ASP.NET - Sep 22-23, 2008

Wichers: /* OWASP AppSec 2008 Training Courses - September 22nd - 23rd, 2008 */

2008-09-14T16:26:22Z

‎OWASP AppSec 2008 Training Courses - September 22nd - 23rd, 2008

Wichers: /* OWASP AppSec 2008 Training Courses - September 22nd - 23rd, 2008 */

2008-09-06T14:30:24Z

‎OWASP AppSec 2008 Training Courses - September 22nd - 23rd, 2008

KateHartmann: /* T5. Leading the Development of Secure Applications - 1-Day Course - Sep 22, 2008 */

2008-08-06T16:32:14Z

‎T5. Leading the Development of Secure Applications - 1-Day Course - Sep 22, 2008

KateHartmann: /* OWASP AppSec 2008 Training Courses - September 22nd - 23rd, 2008 */

2008-08-06T16:29:22Z

‎OWASP AppSec 2008 Training Courses - September 22nd - 23rd, 2008

Brennan at 18:18, 28 July 2008

2008-07-28T18:18:20Z

Brennan at 18:16, 28 July 2008

2008-07-28T18:16:51Z

Brennan at 18:15, 28 July 2008

2008-07-28T18:15:55Z

Brennan at 18:12, 28 July 2008

2008-07-28T18:12:45Z

Brennan at 18:11, 28 July 2008

2008-07-28T18:11:02Z

@@ Line 282: / Line 282: @@
 == T8. Writing Secure Code ASP.NET - Sep 22-23, 2008 ==
-'''Course Overview'''
+'''Summary'''
-This course will help you understand the key security features of the .NET platform, the common web security pitfalls developers make, and how to build secure and reliable web applications using ASP.NET.
+This course is a compressed version of Aspect's standard 3-day Secure Coding for C#/VB.NET course.
-'''Details'''
+'''Course Overview'''
-<br>
+Most developers, IT professionals, and auditors learn what they know about application security on the job, usually by making mistakes. Application security is not a part of many computer science curricula today and most organizations have not focused on instituting a culture that includes application security as a core part of their IT security efforts.
-Secure Design Principles • Introduction to Hacme Bank • Demonstration • (Hacme Bank Penetration Test): Students observe (and may optionally participate) as the instructor exploits numerous common vulnerabilities in Hacme Bank, an ASP.NET web application that is designed to function as a real-world online bank.
+This powerful two day course focuses on the most common web application security problems, including the OWASP Top Ten. The course will introduce and demonstrate hacking techniques, illustrating how application vulnerabilities can be exploited so students really understand how to avoid introducing such vulnerabilities into their code.
-'''.NET Platform Security''' .NET Language Security Features• .NET Common Language Runtime (CLR) Security Mechanisms
+'''Details'''
-'''Data Protection''' Common Mistakes• .NET System.Cryptography Namespace• .NET Algorithm Recommendations• Data Protection API (DPAPI)• Advanced Cryptographic Features in .NET• Lab • (Data Protection):Encrypt sensitive data with the DPAPI
+This course starts with a module designed to raise awareness of just how insecure most .NET based web applications are. We demonstrate how easily hackers are able to attack web applications, and what some of the most common and most significant vulnerabilities are. The course then provides an overview of how .NET web applications work from a security perspective.
-'''Authentication''' Common Mistakes • ASP.NET Authentication• Impersonation and Delegation• Code Signing (Authenticode) • Windows Card Space•
+The next modules detail a number of specific security areas. We describe common vulnerabilities, present best practices, and discuss recommended approaches for avoiding such vulnerabilities. This course includes coverage of the following .NET web application security areas (which encompass the entire OWASP Top 10 plus more):
-'''User Management''' Common Mistakes• Password Storage and Quality• Strategies for Password Reset• Account Lockout Schemes• ASP.NET Membership API•
+* Authentication and Session Management
-'''Authorization''' Common Mistakes• .NET Authorization Models• ASP.NET Authorization• RoleManager• Session Management• Cross-Site Request Forgery• Lab • (Authorization): Fix privilege escalation vulnerability in Hacme Bank
+For each area, the course covers the following:
-'''Error Handling and Exception Management''' Common Mistakes• Safe Exception Handling• Error Handling• Event Logging and Audit Trails•
+* Theoretical foundations
-<br>
+'''Hands on Testing Exercises'''
-'''Data Validation''' Common Mistakes• Data Validation Attacks• Preventing Data Validation Attacks• Regular Expressions• .NET Validation Frameworks & APIs• Canonicalization Issues• Lab • (Data Validation): Implement a variety of validation routines
+To cement the principles delivered via the lecture portion of the course, students can participate in a number of hands-on security testing exercises. During the hands-on exercises students will attack a live web application (i.e., WebGoat) that has been seeded with common web application vulnerabilities. The students will use proxy tools commonly used by the hacker community to complete the exercises.
-'''Configuration Management''' Common Mistakes• Securing Sensitive Configuration Data• Securing Communications• Resource Exhaustion and Other Denial of • Service Conditions Application Secure hardening• Secure Build and Deployment• Partial Trust ASP.NET•
+'''Hands on Coding Exercises''' (Only in .NET specific version of this class!)
-'''Logging and Auditing''' Common Mistakes• Logging Best Practices• Data Retention• Popular Logging Frameworks•
+For this .NET focused course, students will additionally have the opportunity to find, exploit, and then fix .NET coding vulnerabilities in three different .NET labs using Visual Studio Express.
-'''Software Security Analysis''' Threat Modeling• Secure Code Review Methodology• Automated Code Scanning Tools• Practical Strategies
+'''Requirements'''
 '''Registration'''
 Registration is available via the OWASP Conference Cvent site at: [http://guest.cvent.com/i.aspx?4W,M3,828ca6d1-1b60-4105-8034-d344700e6956 http://www.owasp.org/images/7/7f/Register.gif]
 '''Tutorial Provider'''
-The instructors are Foundstone's Technical Director, Rudolph Araujo and Foundstone's Professional Services Conlultant, Alex Smolen. [http://www.foundstone.com/us/education-overview.asp https://www.owasp.org/images/2/26/Foundstone.jpg]
+Instructor: Jerry Hoff: [http://www.aspectsecurity.com http://www.owasp.org/images/d/d1/Aspect_logo.gif]

@@ Line 38: / Line 38: @@
 '''Location'''
-At Pace University in New York. Same location as the conference.
+<u><b>[http://www.parkcentralny.com/location/location.cfm The Park Central Hotel - 870 Seventh Avenue at 56th Street New York, NY 10019-4038.]</b></u>  Same location as the conference.
 '''Course Times'''
-Each class begins at 9 AM and runs until 5 PM each day.
+Each class begins at 9 AM and runs until 5:30 PM each day.
 == T1. Defensive Programming - 2-Day Course - Sep 22-23, 2008 ==

@@ Line 20: / Line 20: @@
 |-
 ! <div style="margin:0;background-color:#f5faff;font-family:sans-serif;font-size:100%;font-weight:bold;border:1px solid #a3b0bf;text-align:left;color:#000;padding:0.2em 0.4em;">T5</div>
-! <div style="margin:0;background-color:#f5faff;font-family:sans-serif;font-size:100%;font-weight:bold;border:1px solid #a3b0bf;text-align:left;color:#000;padding:0.2em 0.4em;">[[:Category:OWASP_AppSec_Conference_Training#T5._Leading_the_Development_of_Secure_Applications_-_1-Day_Course_-_Sep_22-23,_2008 | Leading the Development of Secure Applications - 1-Day]]</div>
+! <div style="margin:0;background-color:#f5faff;font-family:sans-serif;font-size:100%;font-weight:bold;border:1px solid #a3b0bf;text-align:left;color:#000;padding:0.2em 0.4em;">[[:Category:OWASP_AppSec_Conference_Training#T5._Leading_the_Development_of_Secure_Applications_-_1-Day_Course_-_Sep_22,_2008 | Leading the Development of Secure Applications - 1-Day]]</div>
 |-
 ! <div style="margin:0;background-color:#f5faff;font-family:sans-serif;font-size:100%;font-weight:bold;border:1px solid #a3b0bf;text-align:left;color:#000;padding:0.2em 0.4em;">T6</div>

← Older revision		Revision as of 16:32, 6 August 2008
Line 258:		Line 258:

	'''Tutorial Provider'''		'''Tutorial Provider'''
		+
		+	== T6. Building Secure Rich Internet Applications - 1-Day Course - Sep 23, 2008 ==
		+
		+	'''Summary'''
		+
		+	This one day class will cover common RIA security threats and vulnerabilities and it will provide specific guidance on how to develop RIA to defend against these threats and vulnerabilities.
		+	Training developers on secure coding practices offers one of highest returns on investment of any security investment by eliminating vulnerabilities at the source. Aspect’s Building Secure RIA Course is designed to enable developers to use RIA technologies in their web applications without introducing security issues. The course provides detailed examples of ‘what to do’ and ‘what not to do.' The class is lead by Dave Wichers, Aspect COO, and is delivered in a very interactive manner.
		+	The course will use demonstrations, code examples, and spot-the-bug exercises to get developers engaged in the topic. Developers will leave with an understanding of how RIA attacks work, the impacts of successful attacks, and what to do to defend against them.
		+
		+
		+	'''Course Overview'''
		+	The course begins with an overview and a Web 2.0 introduction. The next section deals with exploring the AJAX and RIA surface attacks, followed by Authentication and Session control sections. Cross Site Request Forgery, Cross Site Scripting and Protecting Sensitive Data, are the next sections which are followed by Error Handling and Logging and References to round out the day.
		+
		+	'''Requirements'''
		+
		+	If you are interested in participating in the hands on portion of the course, please bring a Windows based laptop.
		+
		+
		+	'''Tutorial Provider'''
		+
		+	This tutorial is provided by longtime OWASP contributor: [http://www.aspectsecurity.com http://www.owasp.org/images/d/d1/Aspect_logo.gif]

	== T8. Writing Secure Code ASP.NET - Sep 22-23, 2008 ==		== T8. Writing Secure Code ASP.NET - Sep 22-23, 2008 ==

@@ Line 22: / Line 22: @@
 ! <div style="margin:0;background-color:#f5faff;font-family:sans-serif;font-size:100%;font-weight:bold;border:1px solid #a3b0bf;text-align:left;color:#000;padding:0.2em 0.4em;">[[:Category:OWASP_AppSec_Conference_Training#T5._Leading_the_Development_of_Secure_Applications_-_1-Day_Course_-_Sep_22-23,_2008 | Leading the Development of Secure Applications - 1-Day]]</div>
 |-
 ! <div style="margin:0;background-color:#f5faff;font-family:sans-serif;font-size:100%;font-weight:bold;border:1px solid #a3b0bf;text-align:left;color:#000;padding:0.2em 0.4em;">T8</div>
 ! <div style="margin:0;background-color:#f5faff;font-family:sans-serif;font-size:100%;font-weight:bold;border:1px solid #a3b0bf;text-align:left;color:#000;padding:0.2em 0.4em;">[[:Category:OWASP_AppSec_Conference_Training#T8._Writing Secure Code ASP.NET_-_Sep_22-23,_2008 | Writing Secure Code ASP.NET - 2 Days]]</div>

← Older revision		Revision as of 18:18, 28 July 2008
Line 300:		Line 300:
	'''Tutorial Provider'''		'''Tutorial Provider'''

−	~~This tutorial is provided by~~ Rudolph Araujo, ~~Technical Director for Foundstone and~~ Alex Smolen~~, Professional Services Consultant for~~ Foundstone	+	The instructors are Foundstone's Technical Director, Rudolph Araujo and Foundstone's Professional Services Conlultant, Alex Smolen. [http://www.foundstone.com/us/education-overview.asp https://www.owasp.org/images/2/26/Foundstone.jpg]
−	~~__NOTOC__~~

← Older revision		Revision as of 18:16, 28 July 2008
Line 187:		Line 187:

	'''Tutorial Provider'''		'''Tutorial Provider'''
		+	Instructor: Gunnar Peterson''' [http://www.arctecgroup.net https://www.owasp.org/images/b/bf/Arctec.jpg]

	== T4. Advanced Web Application Security Testing - 2-Day Course - Sep 22-23, 2008 ==		== T4. Advanced Web Application Security Testing - 2-Day Course - Sep 22-23, 2008 ==

← Older revision		Revision as of 18:15, 28 July 2008
Line 93:		Line 93:

	Registration is available via the OWASP Conference Cvent site at: [http://guest.cvent.com/i.aspx?4W,M3,828ca6d1-1b60-4105-8034-d344700e6956 http://www.owasp.org/images/7/7f/Register.gif]		Registration is available via the OWASP Conference Cvent site at: [http://guest.cvent.com/i.aspx?4W,M3,828ca6d1-1b60-4105-8034-d344700e6956 http://www.owasp.org/images/7/7f/Register.gif]
		+
		+	'''Tutorial Provider'''
		+	Instructor: Jason Rouse, [http://www.cigital.com/training/series http://www.owasp.org/images/b/be/Cigital_OWASP.GIF]'''

	== T2. Secure Coding for Java EE- 2-Day Course - Sep 22-23, 2008==		== T2. Secure Coding for Java EE- 2-Day Course - Sep 22-23, 2008==