Security Suite: Securing J2EE Web Services

    

Summary:
Designing, implementing, and deploying secure services presents unique challenges. In addition to dealing with all of the vulnerabilities and attacks associated with web applications, web services must address business-oriented concerns such as authentication, authorization, non-repudiation and others. The complicating factor is that all measures must be implemented within the constraints of standards and high-level s of inter-operability. In this course, students thoroughly examine best practices for defensively coding J2EE services, including XML processing. Students will repeatedly attack and then defend various assets associated with fully-functional web services. This hands-on approach drives home the mechanics of how to secure J2EE web services in the most practical of terms.Security experts agree that the least effective approach to security is "penetrate and patch". It is far more effective to "bake" security into an application throughout its lifecycle. After spending significant time trying to defend a poorly designed (from a security perspective) web application, developers are ready to learn how to build secure web applications starting at project inception. The final portion of this course builds on the previously learned mechanics for building defenses by exploring how design and analysis can be used to build stronger applications from the beginning of the software lifecycle.

Duration:
4 Days/Lecture & Lab

Audience:
This is an intermediate -level J2EE / web services programming course, designed for developers who wish to get up and running on developing well defended software applications.

Topics:

• Foundation
• Applying Security to SOA
• Defending XML Processing
• WS-Security
• Top Security Vulnerabilities
• Secure Software Development (SSD)
• Security Testing

Prerequisites:
Familiarity with Java and J2EE is required and real world programming experience is highly recommended. Ideally, students should have approximately 6 months to a year of Java and J2EE working knowledge.

Last Update: May 23, 2012