Become a Java Developer SE 9

OWASP Top 10

The Open Web Application Security Project (OWASP) aims to make applications more secure. The OWASP Top 10 is a strong web application security awareness document that provides a widespread agreement on the most crucial web application security concerns. This course covers the most recent revisions to the Top 10 as well as how threats have evolved.

Must-Have Rudiments

Before taking this course, it is ideal that takers of this course must have undergone the previous set of courses entitled, OWASP Top 10 2013. This course includes the following topics:

• (First Part) Avoiding Hacker Tricks;
• (Second Part) Forgery and Phishing;
• (Third Part) Threats and Session Security;
• (Fourth Part) Misconfiguration and Data Encryption OWASP.

Furthermore, it is assumed that course takers have a solid understanding of web and mobile development.

OWASP Top 10 Overview

This course starts by introducing the history of OWASP Top 10 in 2017 and the process that led to its development. Moreover, this course will also cover the recent updates in OWASP, a review in A4, A8, A10 (the newest additions in OWASP Top 10 2017), and learn the top current threats and risks.

Digging deeper, the discussion in A4 will revolve in 2017 XML External Entities (XXE); for A8, it will be about 2017 Insecure Deserialization; and the A10 discussion will include 2017 Insufficient Logging & Monitoring.

Discussing the process of the OWASP updates, new approaches leading to its development will be thoroughly discussed. After that, a demonstration video will allow course takers to find OWASP via the internet.

Moving forward, the A4 External Entities lesson will cover XML entities, samples of these entities, remote code execution, revealing files, and how to prevent XXE. An XXE demo will also be part of this course to enable course takers to understand it fully. Aside from that, an XML XXE Dotnet demo will also be at the forefront of the lecture.

Another chunk of the discussion will revolve around explaining Insecure Deserialization, including samples and how to prevent it.

Insufficient Logging and Monitoring will also be part of this course. This topic involves tackling the nature of this phenomenon, example attack scenarios, and how to prevent this online attack.

Wrapping up the course, learners will know more about OWASP by providing insights about its future. It will also provide other OWASP resources that learners may include for further readings.