Recognize Actual and Potential Software Vulnerabilities, Implement and Test Defenses & More
DISA’s Application Security and Development STIG, in conjunction with the associated checklist, provides a comprehensive listing of requirements and needs for improving and maintaining the security of software applications and systems within the Department of Defense. This course fills in the context, background, and best practices for fulfilling those requirements and needs. As with all of our courses, we maintain tight synchronization between the latest DISA releases and our materials. A key component to our coverage of DISA’s Security Technical Implementation Guides (STIGS), this course is a companion course with several developer-oriented courses and seminars
Application Security and Development (STIG) is a lab-intensive, hands-on application security training course essential for developers, designers, architects, QA, Testing, and other personnel who need to deliver secure applications within the DOD. In addition to teaching basic programming skills, this course digs deep into sound processes and practices that apply to the entire software development lifecycle.
In this course, students thoroughly examine best practices for defensively coding web applications, including XML processing, rich interfaces, and both RESTful and SOAP-based web services. Students will repeatedly attack and then defend various assets associated with fully-functional web applications and web services. This hands-on approach drives home the mechanics of how to secure web applications in the most practical of terms.
Students who attend this course will leave armed with the skills required to recognize actual and potential software vulnerabilities, implement defenses for those vulnerabilities, and test those defenses for sufficiency. This course introduces developers to the most common security vulnerabilities faced by web applications today. Each vulnerability is examined from a Java/JEE perspective through a process of describing the threat and attack mechanisms, recognizing associated vulnerabilities, and, finally, designing, implementing, and testing effective defenses.
Multiple practical labs reinforce these concepts with real vulnerabilities and attacks. Students are then challenged to design and implement the layered defenses they will need in defending their own applications.
Working in a dynamic, lab-intensive hands-on coding environment students will learn to:
The course provides a solid foundation in basic terminology and concepts, extended and built upon throughout the engagement. Students will examine various recognized attacks against web applications. Processes and best practices are discussed and illustrated through both discussions and group activities. Attending students will be led through a series of advanced topics comprised of integrated lectures, group discussions and comprehensive demonstrations.
Need different skills or topics? If your team requires different topics or tools, additional skills or custom approach, this course may be further adjusted to accommodate. We offer additional STIG, application security, secure coding, secure software development, hacking, database security, bug hunting and other related topics that may be blended with this course for a track that best suits your needs. Our team will collaborate with you to understand your needs and will target the course to focus on your specific learning objectives and goals.
This is an intermediate -level programming course, designed for experienced Java developers who wish to get up and running on developing well defended software applications using the STIG guidelines. Familiarity with Java and JEE is required and real world programming experience is highly recommended. Ideally students should have approximately 6 months to a year of Java working knowledge.
Take Before: Students should have basic development skills and a working knowledge in the following topics, or attend these courses as a pre-requisite:
Session: Securing Applications Foundation
Lesson: DISA’s Security Technical Implementation Guides (STIGS)
Lesson: Removing Bugs
Lesson: Principles of Information Security
Session: Bug Stomping 101
Lesson: Unvalidated Data
Lesson: A1: Injection
Lesson: A2: Broken Authentication
Lesson: A3: Sensitive Data Exposure
Lesson: A4: XML External Entities (XXE)
Lesson: A5: Broken Access Control
Session: Bug Stomping 102
Lesson: A6: Security Misconfiguration
Lesson: A7: Cross Site Scripting (XSS)
Lesson: A8/9: Deserialization/Vulnerable Components
Lesson: A10: Insufficient Logging and Monitoring
Lesson: Spoofing, CSRF, and Redirects
Session: Moving Forward
Lesson: What Next?
Session: Secure Development Lifecycle (SDL)
Lesson: SDL Process Overview
Session: Taking Action Now
Lesson: Application Security and Development Checklists
Lesson: Asset Analysis
Lesson: Design Review
Lesson: Secure Code Review
Lesson: Making Application Security Real
Additional Tools for the Toolbox
Student Materials: Each student will receive a Student Guide with course notes, code samples, software tutorials, diagrams and related reference materials and links (as applicable). Our courses also include step by step hands-on lab instructions and and solutions, clearly illustrated for users to complete hands-on work in class, and to revisit to review or refresh skills at any time. Students will also receive related (as applicable) project files, code files, data sets and solutions required for the hands-on work.
Classroom Setup Made Simple: Our dedicated tech team will work with you to ensure your classroom and lab environment is setup, tested and ready to go well in advance of the course delivery date, ensuring a smooth start to class and seamless hands-on experience for your students. We offer several flexible student machine setup options including guided manual set up for simple installation directly on student machines, or cloud based / remote hosted lab solutions where students can log in to a complete separate lab environment minus any installations, or we can supply complete turn-key, pre-loaded equipment to bring ready-to-go student machines to your facility. Please inquire for details, options and pricing.
Live scheduled classes are listed below or browse our full course catalog anytime
We regulary offer discounts for individuals, groups and corporate teams. Contact us
Check out custom training solutions planned around your unique needs and skills.
Exclusive materials, ongoing support and a free live course refresh with every class.
Please see the current upcoming available open enrollment course dates posted below. Please feel free to Register Online below, or call 844-475-4559 toll free to connect with our Registrar for assistance. If you need additional date options, please contact us for scheduling.
|STIG Security | Application Security and Development (DISA STIG Training)||5 Days||Jun 5 to Jun 9||10:00 AM to 06:00 PM EST||$2,795.00||Enroll|
|STIG Security | Application Security and Development (DISA STIG Training)||5 Days||Aug 21 to Aug 25||10:00 AM to 06:00 PM EST||$2,795.00||Enroll|
Learning is Twice as Nice!
Buy One Get One Free!
Enroll by March 31 in any TWO public classes in 2023 for the price of ONE!
Limited Offer for most courses.