Võta ühendust:
+372 618 1720
info@koolitus.ee

.NET, C# and ASP.NET Coding Security

SCA-01

Maht: 2 päeva
Hind:
1 295 € (+ km 20%)

Koolituse kokkuvõte:

Koolituse tulemusena on osalejad omandanud programmeerimisalased teadmised ja oskused, et ennetada ebaturvaliste programmikoodide koostamist ja osata hinnata võimalikke ohukohti programmeerimisel.

Mitmed programmeerimiskeeled kasutavad koodide kompileerimiseks .NET ja ASP-NET raamistikku. Selleks, et programmeerida turvaliselt on oluline teada kavandamise ja programmeerimise tehnikaid, mis võimaldavad vältida turvaauke.

Koolitus sisaldab paljusid praktilisi harjutusi, mis võimaldab arendajatel omandada oskused hinnata programmikoodide turvalisust. Koolitusel käsitletakse teemasid, kuidas vältida programmikoodil teostada privilegeeritud toiminguid, kaitsta andmeid tugevate autoriseerimistehnikatega, arendada kaughaldust, ASP.NET turvalisuse tasemete hindamist, rollide haldamist, sessioonide käsitlemist ja palju muud.

Koolitusel käsitletakse levinumaid turvaprobleeme, mis tehakse programmeerimisel. Põhjalikult läbitakse teemad ASP.NET haavatavusest ja turvaaukude mõjust. Koolitusel vaadeldakse ka ASP.NET spetsiifilisi probleeme ja rünnakute meetodeid – PostBack, ViewState või string termination rünnakud. Väga põhjalikult käsitletakse haavatuvust ja ründeid: Overflows .NET ja ASP.NET-s, SQL Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Equals() and toString() probleemid; PostBack ja ViewState ründed, GC.Collect(), ICloneable, [Serializable] ja palju muud.

Õppesisu sisaldab hulgaliselt harjutusi, mis võimaldavad osalejatel testida programmikoodi haavatavust. Kõik harjutused on koostatud meetodil plug-and-play, mis loovad simulatsiooni põhjal reaalse elu olukordi. Lisaks sellele sisaldab õppematerjal ka turvalise koodikirjutamise allikate stardipaketti, haavatuvuse andmebaase, .NET turvalise programmeerimise allikaid msdn.microsoft.com, .NET turvalise programmeerimise suunised.

Koolitus on inglise keeles.

Kursuse toimumiseks on minimaalne osavõtjate arv 6.

Kellele koolitus on suunatud:

.NET, C# ja ASP.NET arendajad, tarkvara-arhitektid ja testijad



Koolituse oodatav tulemus/eesmärk (õpiväljundid):

Koolituse edukal lõpetamisel osalejad:

  • teavad, millised on kõige enamlevinud turvaprobleemid programmeerimisel;
  • oskavad hinnata loodud programmikoodi turvalisust erinevate testidega;
  • teavad, kuidas kasutada erinevaid turvatehnikaid programmikoodide koostamisel;
  • oskavad kasutada ennetavaid tehnikaid turvalise koodi programmeerimisel.
Koolitusel osalemise eeldused (soovitavalt):

Head teadmised .NET ja ASP.NET programmeerimisest

Koolituse sisukord:

IT security and secure coding

  • General security vs. IT security
  • IT security related terms
  • Definition of risk
  • Specialty of information technology security
  • Different aspects of IT security
  • Requirements of different application areas
  • IT security vs. secure coding
  • Building a secure system from vulnerabilities to botnets and cyber crime
    • Nature of security flaws
    • Reasons of difficulty
    • From your computer to attacks against critical targets
    • Cyber-crime – an organized network of criminals
  • Classification of security flaws
    • Landwehr’s taxonomy
    • The Fortify taxonomy
    • Vulnerability categories – Seven Pernicious Kingdoms
    • OWASP Top Ten (2013 release candidate)

PCI DSS and secure coding

  • What is PCI DSS?
  • Prioritized approach
  • Scope
  • PCI DSS Requirements
  • PCI DSS Requirements
  • Secure Systems and Applications (R6)
  • Patch Management & Change Control (R6.1-2-4)
  • Software Development Controls (R6.3)
  • Software Development Controls (R6.3)
  • Secure Software Development (6.5)
  • Public-Facing Applications (R6.6)

Web application vulnerabilities

  • SQL Injection
    • Typical SQL Injection attack methods
    • SQL Injection protection methods
  • Other injection vulnerabilities
    • Command injection
    • Cookie injection – HTTP parameter pollution
  • Cross-Site Scripting (XSS)
    • Cross-Site Scripting (XSS)
    • CSS injection
    • Exploitation: injection through HTML/CSS
    • Preventing XSS and other injection flaws
  • Vulnerabilities in session handling
    • Insecure session cookie parameters
    • Session fixation
  • Remote code execution
    • Remote code execution
    • Filtering file uploads
    • Insecure direct object reference
      • Cross Site Request Forgery (CSRF)
      • Login CSRF
      • CSRF prevention
    • Failure to restrict URL access

.NET security architecture and services

  • .NET architecture
  • Code Access Security
  • Evidence classes
  • Permissions
  • Code access permission classes
  • Permission sets
  • Class and method-level declarative permission
  • Imperative (programmatic) permission checking
  • .NET runtime permission checking
  • The Stack Walk
  • Effects of Assert()
  • Security transparency model from .NET 4.0
  • Exercise – sandboxing .NET code
  • Role-based security
    • Principal-based authorization
    • Exercise – adding role-based authorization
    • Exercise – adding role-based authorization
  • Cryptography in .NET
    • .NET cryptographic architecture
    • Hashing
    • Using random numbers
    • Encrypting and decrypting (symmetric)
    • Asymmetric algorithms in .NET
    • .NET cryptographic classes
    • Protecting .NET code

ASP.NET security architecture

  • ASP.NET basics
  • ASP.NET features
  • ASP.NET application services
    • ASP.NET authentication and identity management
    • Windows authentication
    • Forms authentication
  • ASP.NET authorization
    • Access Control List (ACL) authorization
    • URL authorization
    • Role Manager
    • Roles API
  • ASP.NET security features for web applications
    • XSS protection in ASP.NET
    • Validations and encoding done by validateRequest
    • Viewstate protection
    • Event validation
    • Custom protected configuration providers
    • MS Web Protection (Anti-XSS) Library
  • Input validation
    • Input validation concepts
    • Unsafe Native Calls
    • Integer overflow in .NET
    • A real-world integer overflow vulnerability
    • Avoiding arithmetic overflow – addition
    • Avoiding arithmetic overflow – multiplication
    • Detecting arithmetic overflow with the checked keyword
    • Exceptions triggered by the checked keyword
    • Implementation of a command dispatcher
    • Unsafe reflection – spot the bug!
    • Log forging – spot the bug
  • Improper use of security features
    • Problems related to the use of security features
    • Insecure randomness
    • Insecure randomness in .NET
    • Exercise – Google cracking
    • Password management – stored passwords
    • Special purpose hash algorithms for password storage
    • Some usual password management problems
    • Exercise – Hard coded password
    • Accessing private fields with reflection in .NET
    • Exercise – Accessing private fields with reflection
  • Improper error and exception handling
    • Empty catch block
    • Overly broad catch
    • NullReferenceException – spot the bug!
    • Exercise WebExample – Information leakage through error reporting
  • Time and stateproblems
    • Concurrency and threading
    • Concurrency in .NET
    • Omitted synchronization – spot the bug!
    • Exercise – Forgotten synchronization
    • Incorrect granularity – spot the bug!
    • Exercise – Incorrect granularity
    • Deadlocks
    • Avoiding deadlocks
    • Exercise – Avoiding deadlocks
    • Lock statement
    • Locking and atomicity – spot the bug!
    • Lock-free reordering – spot the bug!
    • Race condition with files – spot the bug!
    • Preventing file race condition
    • Exception handling in threads – spot the bug
    • Interrupt and abort
    • Safe cancellation
    • Patterns for achieving thread safety
  • Database race conditions
    • Optimistic vs. pessimistic locking
    • Optimistic locking
    • Pessimistic locking
  • Code quality problems
    • Dangers arising from poor code quality
    • Poor code quality – spot the bug!
    • Unreleased resources
    • Misspelled method – spot the bug!
    • Exercise – Misspelled method
    • Public method without final – object hijacking
    • Exercise – Object hijacking
    • Immutable String – spot the bug!
    • Exercise – Immutable strings
    • Serializable sensitive – spot the bug!
    • Exercise – Serializable sensitive

ASP.NET specific vulnerabilities

  • Attacking the postback
  • Accessing disabled and hidden controls
    • Control sequence attacks
    • Control sequence attacks – an example
  • Security of the Viewstate
  • NULL bytes
  • Real life example – Forms Authentication Bypass
  • Security issues caused by ELMAH
  • Ways to exploit ELMAH
  • Value shadowing
  • Exercise – Value shadowing
  • Denial of service possibilities
    • DOS caused by .NET Code
  • Hashtable collision attack
    • Using hashtable to store inputs
    • Hashtable collision
    • Hashtable collision in ASP.NET
Lisainfo:

Koolitushind sisaldab:

  • õppematerjale;
  • tunnistust.

Lisaväärtusena pakume:

  • võimalust osaleda tasuta korduskoolitusel, kui on soov teemasid korrata;
  • sooje jooke koos küpsistega;
  • lõunasööki igal koolituspäeval;
  • soodushinnaga registreerimise võimalust järgmisele kalendrikoolitusele;
  • tasuta parkimist.

Seotud koolitused

2 päeva C/C++ Secure Coding 1 095 € (+ km 20%)