PCI DSS / OWASP Compliance Training Course
| Course code: |
PCIDSS |
| Details: |
12 September, 2 days, £1500 + VAT
|
| Onsite | Enquire about bringing this course to your offices |
| Who should attend: |
IT Staff who need to develop and deploy systems in accordance with the guidance in the Payment Card Industry Data Security Standard (PCI DSS) |
| Prerequisite skills: |
Experience of developing data-driven web applications in either ASP.NET or Java is ideal (as the course will involve hands-on workshops throughout) - the course is useful though for anyone who needs to understand the Secure Development Lifecycle (SDL). |
Course Outline
This course will provide delegates with a sound understanding of current Payment Card Industry Secure Data Security Standards for building secure web applications. These standards derive from Best Practices set out (and continually monitored and improved) by the Open Web Application Security Project (OWASP).
Delegates on our course will gain a solid understanding of the issues and threats facing web application developers. Some aspects covered are generic to all web developers – but specific examples in both ASP.NET and Java will be used. Please contact us if you need to focus on PHP or any other language / platform.
What you will learn
1. Security Principles
2. An understanding of OWASP and PCI DSS
3. Writing compliant code in ASP.NET (C# and / or VB.NET) and Java / JEE
4. How to test security
5. How to build privacy into you application
6. How to secure installations
7. How to write secure documentation and error messages.
PCI DSS / OWASP for Web Developers - Web Application Security Training Course
Secure Development Overview
Case Studies
The Need for Secure Systems
Trustworthy Computing
Proactive Security Development
Security Principles
Threat Modelling
PCI DSS v1.2
What’s new?
PCI DSS and OWASP
Common misconceptions
OWASP
What is OWASP?
Current OWASP Top Ten
PCI DSS 6.5
6.5.1 Cross-site scripting (XSS)
- Understanding XSS
- Validate Requests in ASP.NET / Java EE
- Validating all parameters before use
6.5.2 Injection flaws
- Understanding SQL injection.
- Understanding LDAP and XPath injection flaws as well as other injection flaws.
- Database Access & SQL Injection
- Validating input to verify user data cannot modify meaning of commands and queries
6.5.3 Malicious file execution
Validating input to verify application does not accept filenames or files from users.
Using the File upload control
6.5.4 Insecure direct object references
Avoiding exposing internal object references to users.
Using Code Access Security in ASP.NET & Java EE
Understanding Trust levels in ASP.NET & Java EE
6.5.5 Cross-site request forgery
- Understanding Cross-site request forgery (CSRF)
- Dealing with authorization credentials and tokens automatically submitted by browsers
- Cross site service security policies for Silverlight and Flash
6.5.6 Information leakage and improper error handling
- Avoiding leaking information via error messages or other means.
- ASP.NET & Java EE exception handling
- Exception handling patterns
6.5.7 Broken authentication and session management
- Authenticating users and protect account credentials and session tokens.
- Authentication, Authorisation & membership models in ASP.NET & Java EE
- Understanding & configuring Session state in ASP.NET & Java EE
6.5.8 Insecure cryptographic storage
- Preventing cryptographic flaws.
- Using cryptography in ASP.NET & Java EE
- Using cryptography in .NET Enterprise library v4.1
6.5.9 Insecure communications
- Properly encrypting all authenticated and sensitive communications.
- Understanding secure communications in Web Servers
6.5.10 Failure to restrict URL access
- Consistently enforcing access control in presentation layer and business logic for all URLs.
- Enforcing Access Policy using Authentication & Ahuthorisation
