Certified Application Security Engineer (CASE Java) Certification in Manama

Certified Application Security Engineer Certification Course Outline

Module 1: Understanding Application Security, Threats and Attacks

• What is a Secure Application
• Need for Application Security
• Most Common Application Level Attacks
• Why Applications become Vulnerable to Attacks
• What Consistutes Comprehensive Application Security
• Insecure Application: A Software Development Problem
• Software Security Standards, Models and Frameworks

Module 2: Security Requirements Gathering

• Importance of Gathering Security Requirements
• Security Requirement Engineering (SRE)
• Abuse Case and Security Use Case Modeling
• Abuser amd Security Stories
• Security Quality Requirements Engneering (SQUARE)
• Operationally Critical Threat, Asset and Vulnerability Evaluation (OCTAVE)

Module 3: Secure Application Design and Architecture

• Relative Cost of Fixing Vulnerabilities at Different Phases of SDLC
• Secure Application Design and Architecture
• Goal of Secure Design Process
• Secure Design Actions
• Secure Design Principles
• Threat Modeling
• Decompose Application
• Secure Application Architecture

Module 4: Secure Coding Practices for Input Validation

• Input Validation Pattern
• Validation and Security Issues
• Impact of Invalid Data Input
• Data Validation Techniques
• Input Validation using Frameworks and APIs
• Open Source Validation Framework for Java
• Servlet Filters Validation Filters for Servlet
• Data Validation using OWASP ESAPI
• Data Validation: Struts Framework
• Data Validation: Spring Framework
• Input Validation Errors
• Common Secure Coding Practices

Module 5: Secure Coding Practices for Authentication and Authorisation

• Introduction to Authentication
• Types of Authentication
• Authentication Weaknesses and Prevention
• Introduction to Authorisation
• Access Control Model
• EJB Authorisation
• Java Authentication and Authorisation (JAAS)
• Java EE Security
• Authorisation Common Mistakes and Countermeasures
• Authentication and Authorisation in Spring Security Framework
• Defensive Coding Practices against Broken Authentication and Authorisation
• Secure Development Checklists: Broken Authentication and Session Management

Module 6: Secure Coding Practices for Cryptography

• Java Cryptographic
• Encryption and Secret Keys
• Cipher Class
• Digital Signatures
• Secure Socket Layer (SSL)
• Key Management
• Digital Signatures
• Signed Code Sources
• Hashing
• Java Card Cryptography
• Spring Security: Crypto Module
• Do's and Dont's in Java Cryptography
• Best Practices for Java Cryptography

Module 7: Secure Coding Practices for Session Management

• Session Management
• Session Tracking
• Session Management in Spring Security
• Session Vulnerabilities and their Mitigation Techniques
• Best Practices and Guidelines for Secured Sessions Management
• Checklist to Secure Credentials and Session ID's
• Guidelines for Secured Session Management

Module 8: Secure Coding Practices for Error Handling

• Introduction to exceptions
• Erroneous Exceptional Behaviors
• Dos and Don'ts in Error Handling
• Spring MVC Error Handling
• Exception Handling in Struts 2
• Best Practices for Error Handling
• Introduction to Logging
• Logging using Log4j
• Secure Coding in Logging

Module 9: Static and Dynamic Application Security Testing (SAST and DAST)

• Static Application Security Testing
• Manual Secure Code Review for Most Common Vulnerabilities
• Code Review: Check List Approach
• SAST Finding
• SAST Report
• Dynamic Application Security Testing
• Automated Application Vulnerability Scanning Tools
• Proxy-based Security Testing Tools
• Choosing between SAST and DAST

Module 10: Secure Deployment and Maintenance

• Secure Deployment
• Prior Deployment Activity
• Deployment Activities: Ensuring Security at Various Levels
• Ensuring Security at Host Level
• Ensuring Security at Network Level
• Ensuring Security at Application Level
• Ensuring Security at Web Container Level (Tomcat)
• Ensuring Security in Orcale
• Security Maintenance and Monitoring

Who should attend this Certified Application Security Engineer Certification Course?

This CASE Java Certification Course is ideal for individuals who want to improve their application security skills, especially those interested in learning about Java security practices to protect applications from vulnerabilities and cyber threats. This EC-Council Certification can be beneficial for a wide range of professionals, including:

• Software Developers
• Application Architects
• Security Consultants
• Quality Assurance Testers
• IT Managers
• System Analysts
• Security Engineers
• Technical Leads

Prerequisites for Certified Application Security Engineer Certification Course

Delegates should have at least 2 years of working Java experience to take this CASE Certification Course. Familiarity with programming languages such as Java, C#, or Python will also be beneficial.

Certified Application Security Engineer Certification Course Overview

The CASE Certification Course is designed to train professionals to protect Java applications from cyber threats. In today's digital age, application security is vital because cyber-attacks are more advanced and pose risks to businesses and individuals.

Mastering application security is vital for ensuring the integrity, confidentiality, and availability of software applications. This CASE Java Certification Training is ideal for Software Developers, Security Engineers, and IT Professionals aiming to enhance their ability to secure Java-based applications and build strong defenses against vulnerabilities and cyber-attacks.

This intensive 3-day CASE Java Certification Training by The Knowledge Academy, delegates will gain hands-on experience identifying, fixing, and reducing security weaknesses in Java applications. Through practical exercises and real-world scenarios, attendees will grasp application security principles thoroughly. This EC-Council Certification will empower them to implement adequate security measures and create more secure Java applications.

Course Objectives

• To understand the fundamental concepts of application security
• To identify common security vulnerabilities in Java applications
• To implement secure coding practices and techniques
• To apply secure design principles to Java applications
• To conduct thorough security testing and assessments
• To develop and maintain secure Java applications

After completing the CASE Java Certification Course, delegates will possess the skills and knowledge necessary to enhance the security of Java applications effectively. They will be well-equipped to tackle security challenges and ensure their applications are resilient against modern cyber threats.

What’s included in this Certified Application Security Engineer Certification Course?

• Certified Application Security Engineer Examination   
• World-Class Training Sessions from Experienced Instructors   
• Certified Application Security Engineer Certificate   
• Digital Delegate Pack

Certified Application Security Engineer Certification Exam Information

This CASE .NET Certification exam assesses candidate proficiency in securing Java applications. It evaluates their understanding of secure coding practices, common vulnerabilities in Java applications, and techniques for mitigating security risks. To be eligible to apply to sit for the CASE Exam, the candidate must either:  

• Attend the official EC-Council CASE training through an accredited EC-Council Partner  
• Be an ECSP (.NET/ Java) member in good standing 
• Have a minimum of 2 years working experience in InfoSec/ Software domain 
• Have any other industry equivalent certifications such as GSSP .NET/Java

The exam format is as follows: 

• Type of Assessment: Multiple Choice  
• Number of Questions: 50  
• Pass Marks: 70%  
• Duration: 2 Hours