Certified Application Security Engineer (CASE .NET) Certification - Jordan

Certified Application Security Engineer Certification Course Outline

Module 1: Understanding Application Security, Threats and Attacks

• What is a Secure Application?
• Need for Application Security
• Most Common Application Level Attacks
• Why Applications become Vulnerable to Attacks?
• What Constitutes Comprehensive Application Security?
• Insecure Application: A Software Development Problem
• Software Security Standards, Models and Frameworks

Module 2: Security Requirements Gathering

• Importance of Gathering Security Requirements
• Security Requirement Engineering (SRE)
• Abuse Case and Security Use Case Modelling
• Abuser and Security Stories
• Security Quality Requirements Engineering (SQUARE)
• Operationally Critical Threat, Asset and Vulnerability Evaluation (OCTAVE)

Module 3: Secure Application Design and Architecture

• Relative Cost of Fixing Vulnerabilities at Different Phases of SDLC
• Secure Application Design and Architecture
• Goal of Secure Design Process
• Secure Design Actions
• Secure Design Principles
• Threat Modelling
• Decompose Application
• Secure Application Architecture

Module 4: Secure Coding Practices for Input Validation

• Input Validation
• Why Input Validation?
• Input Validation Specification
• Input Validation Approaches
• Input Filtering
• Secure Coding Practices for Input Validation: Web Forms
• Secure Coding Practices for Input Validation: ASP.NET Core
• Secure Coding Practices for Input Validation: MVC

Module 5: Secure Coding Practices for Authentication and Authorisation

• Authentication and Authorisation
• Common Threats on User Authentication and Authorisation
• Authentication and Authorisation: Web Forms
• Authentication and Authorisation: ASP .NET Core
• Authentication and Authorisation: MVC
• Authentication and Authorisation Defensive Techniques: Web Forms
• Authentication and Authorisation Defensive Techniques: ASP .NET Core
• Authentication and Authorisation Defensive Techniques: MVC

Module 6: Secure Coding Practices for Cryptography

• Cryptographic
• Ciphers
• Block Ciphers Modes
• Symmetric Encryption Keys
• Asymmetric Encryption Keys
• Functions of Cryptography
• Use of Cryptography to Mitigate Common Application Security Threats
• Cryptographic Attacks
• Techniques Attackers Use to Steal Cryptographic Keys
• What should you do to Secure .Net Applications for Cryptographic Attacks?
• .NET Cryptographic Name Spaces
• .NET Cryptographic Class Hierarchy
• Symmetric Encryption
• Symmetric Encryption: Defensive Coding Techniques
• Asymmetric Encryption
• Asymmetric Encryption: Defensive Coding Techniques
• Hashing
• Digital Signatures
• Digital Certificates
• XML Signature
• ASP.NET Core Specific Secure Cryptography Practices

Module 7: Secure Coding Practices for Session Management

• What are Exceptions/Runtime Errors?
• Need for Secure Error/Exception Handling
• Consequences of Detailed Error Message
• Exposing Detailed Error Messages
• Considerations: Designing Secure Error Messages
• Secure Exception Handling
• Handling Exceptions in an Application
• Defensive Coding practices against Information Disclosure
• Defensive Coding practices against Improper Error Handling
• ASP .NET Core: Secure Error Handling Practices
• Secure Auditing and Logging
• Tracing .NET
• Auditing and Logging Security Checklists

Module 8: Static and Dynamic Application Security Testing (SAST and DAST)

• Static Application Security Testing
• Manual Secure Code Review for Most Common Vulnerabilities
• Code Review: Check List Approach
• SAST Finding
• SAST Report
• Dynamic Application Security Testing
• Automated Application Vulnerability Scanning Tools
• Proxy-Based Security Testing Tools
• Choosing between SAST and DAST

Module 9: Secure Deployment and Maintenance

• Secure Deployment
• Prior Deployment Activity
• Deployment Activities: Ensuring Security at Various Levels
• Ensuring Security at Host Level
• Ensuring Security at Network Level
• Ensuring Security at Application Level
• Web Application Firewall (WAF)
• Ensuring Security at IIS Level
• Sites and Virtual Directories
• ISAPI Filters
• Ensuring Security at .NET Level
• Ensuring Security at SQL Server Level
• Security Maintenance and Monitoring

Who should attend this Certified Application Security Engineer Certification Course?

This CASE .NET Training Course is perfectly suited for individuals who are focused on enhancing their abilities in securing .NET applications and understanding the intricacies of application security within the .NET framework. This EC-Council Certification especially beneficial for:

• Software Developers
• Security Engineers
• IT Managers
• IT Directors
• Application Architects
• Cybersecurity Analysts
• System Administrators

Prerequisites of the Certified Application Security Engineer Certification Course

There are no formal prerequisites to attend this CASE .NET Training Course. 

Certified Application Security Engineer Certification Course Overview

A Certified Application Security Engineer (CASE .NET) is an expert dedicated to bolstering the security of .NET applications against a variety of security threats and vulnerabilities. This expertise is paramount for ensuring that sensitive data is protected, and business applications operate reliably. Organisations benefit from this training as it enhances their security measures.

This EC-Council Certification opens doors to new career opportunities, including roles like Security Analysts, Developers, and Application Architects, enhancing their marketability and professional growth. It provides a competitive edge in the job market, showcasing their commitment to maintaining secure software development practices.

The Knowledge Academy’s 3-day Certified Application Security Engineer Certification training helps delegates understand the layers of .NET security, and the knowledge to identify and mitigate vulnerabilities efficiently. The training covers a broad spectrum of topics, from secure coding practices and threat modelling to sophisticated cryptographic techniques.

Course Objectives

• To identify common security vulnerabilities in .NET applications
• To apply best practices in secure coding for authentication and authorisation
• To implement cryptographic techniques in application security
• To perform thorough security testing using SAST and DAST methodologies
• To deploy .NET applications securely and maintain security post-deployment
• To understand .NET frameworks for risk management and mitigation

After attending this Certified Application Security Engineer Certification Training, delegates will be equipped to proactively secure .NET applications from the ground up. They will be able to implement effective security measures throughout the software development lifecycle, from design to deployment.

What’s included in this Certified Application Security Engineer Certification?

• Certified Application Security Engineer Certification Examination
• World-Class Training Sessions from Experienced Instructors
• Certified Application Security Engineer Certificate
• Digital Delegate Pack

Certified Application Security Engineer Certification Exam Information

The CASE .NET exam evaluates a candidate proficiency in application security within the .NET framework. To be eligible for the exam, candidates must complete the CASE .NET Training Course and typically have one to two years of experience in software development, particularly with the .NET framework. The exam format is as follows:

• Type of Questions: Multiple Choice Questions
• Total Questions: 50
• Pass Mark: 70%
• Duration: 2 Hours