Day 1/2

• Cyber security basics
  • What is security?
  • Threat and risk
  • Cyber security threat types – the CIA triad
  • Consequences of insecure software
• The OWASP Top Ten 2021
  • The OWASP Top 10 2021
  • A01 – Broken Access Control
    • Access control basics
    • Failure to restrict URL access
    • Confused deputy
      • Insecure direct object reference (IDOR)
      • Path traversal
      • Lab – Insecure Direct Object Reference
      • Path traversal best practices
      • Authorization bypass through user-controlled keys
      • Case study – Authorization bypass on Facebook
      • Lab – Horizontal authorization
    • File upload
      • Unrestricted file upload
      • Good practices
      • Lab – Unrestricted file upload
    • Cross-site Request Forgery (CSRF)
      • Lab – Cross-site Request Forgery
      • CSRF best practices
      • CSRF defense in depth
      • Lab – CSRF protection with tokens
  • A02 – Cryptographic Failures
    • Information exposure
      • Exposure through extracted data and aggregation
      • Case study – Strava data exposure
    • Cryptography for developers
      • Cryptography basics
      • Cryptography in Python
      • Elementary algorithms
        • Random number generation
          • Pseudo random number generators (PRNGs)
          • Cryptographically strong PRNGs
          • Using virtual random streams
          • Weak PRNGs
          • Using random numbers
          • Lab – Using random numbers in Python
          • Case study – Equifax credit account freeze
        • Hashing
          • Hashing basics
          • Hashing in Python
          • Lab – Hashing in Python
      • Confidentiality protection
        • Symmetric encryption
          • Block ciphers
          • Modes of operation
          • Modes of operation and IV – best practices
          • Symmetric encryption in Python
          • Lab – Symmetric encryption in Python
        • Asymmetric encryption
        • Combining symmetric and asymmetric algorithms 

.

Day 2/3

• The OWASP Top Ten 2021
  • A03 – Injection
    • Injection principles
    • Injection attacks
    • SQL injection
      • SQL injection basics
      • Lab – SQL injection
      • Attack techniques
      • Content-based blind SQL injection
      • Time-based blind SQL injection
    • SQL injection best practices
      • Input validation
      • Parameterized queries
      • Lab – Using prepared statements
      • Additional considerations
      • Case study – Hacking Fortnite accounts
    • Code injection
      • Code injection via input()
      • OS command injection
        • Lab – Command injection
        • OS command injection best practices
        • Avoiding command injection with the right APIs
        • Lab – Command injection best practices
        • Case study – Shellshock
        • Lab – Shellshock
    • HTML injection – Cross-site scripting (XSS)
      • Cross-site scripting basics
      • Cross-site scripting types
        • Persistent cross-site scripting
        • Reflected cross-site scripting
        • Client-side (DOM-based) cross-site scripting
      • Lab – Stored XSS
      • Lab – Reflected XSS
      • Case study – XSS in Fortnite accounts
      • XSS protection best practices
        • Protection principles – escaping
        • XSS protection APIs in Python
        • XSS protection in Jinja2
        • Lab – XSS fix / stored
        • Lab – XSS fix / reflected
        • Additional protection layers – defense in depth
  • A04 – Insecure Design
    • The STRIDE model of threats
    • Secure design principles of Saltzer and Schroeder
      • Economy of mechanism
      • Fail-safe defaults
      • Complete mediation
      • Open design
      • Separation of privilege
      • Least privilege
      • Least common mechanism
      • Psychological acceptability
    • Client-side security
      • Same Origin Policy
        • Simple request
        • Preflight request
        • Cross-Origin Resource Sharing (CORS)
        • Lab – Same-origin policy demo
      • Frame sandboxing
        • Cross-Frame Scripting (XFS) attacks
        • Lab – Clickjacking
        • Clickjacking beyond hijacking a click
        • Clickjacking protection best practices
        • Lab – Using CSP to prevent clickjacking

Day 4/5

• The OWASP Top Ten 2021
  • A05 – Security Misconfiguration
    • Configuration principles
    • Server misconfiguration
    • Python configuration best practices
      • Configuring Flask
    • Cookie security
      • Cookie attributes
    • XML entities
      • DTD and the entities
      • Entity expansion
      • Lab – Billion laughs attack
      • External Entity Attack (XXE)
        • File inclusion with external entities
        • Server-Side Request Forgery with external entities
        • Lab – External entity attack
        • Case study – XXE vulnerability in SAP Store
        • Preventing XXE
        • Lab – Prohibiting DTD
  • A06 – Vulnerable and Outdated Components
    • Using vulnerable components
    • Assessing the environment
    • Hardening
    • Untrusted functionality import
    • Malicious packages in Python
    • Vulnerability management
      • Patch management
      • Vulnerability databases
      • DevOps, the build process and CI / CD
      • Dependency checking in Python
      • Lab – Detecting vulnerable components
  • A07 – Identification and Authentication Failures
    • Authentication
      • Authentication basics
      • Multi-factor authentication
      • Authentication weaknesses
      • Case study – PayPal 2FA bypass
    • Session management
      • Session management essentials
      • Why do we protect session IDs – Session hijacking
      • Session fixation
      • Session ID best practices
      • Session handling in Flask
    • Password management
      • Inbound password management
        • Storing account passwords
        • Password in transit
        • Lab – Is just hashing passwords enough?
        • Dictionary attacks and brute forcing
        • Salting
        • Adaptive hash functions for password storage
        • Password policy
          • NIST authenticator requirements for memorized secrets
        • Case study – The Ashley Madison data breach
          • The dictionary attack
          • The ultimate crack
          • Exploitation and the lessons learned
        • Password database migration
          • (Mis)handling None passwords
  • A08 – Software and Data Integrity Failures
    • Integrity protection
      • Message Authentication Code (MAC)
        • MAC in Python
        • Lab – Calculating MAC in Python
      • Digital signature
    • Subresource integrity
      • Importing JavaScript
      • Lab – Importing JavaScript
      • Case study – The British Airways data breach
  • A10 – Server-Side Request Forgery (SSRF)
    • Server-side Request Forgery (SSRF)
    • Case study – SSRF and the Capital One breach
• Wrap up
  • Secure coding principles
    • Principles of robust programming by Matt Bishop
  • And now what?
    • Software security sources and further reading
    • Python resources