Workshop A: Web Application Security Testing

---

• Date: 10 May 2010 ( 9am – 5pm)
• Duration: Theory: 4 Hrs.  |  Hands-On : 4 Hrs.
• Workshop fee: 150 KD

Objectives: You will learn to

• Not only acquaint candidates with web security vulnerabilities but also describe how to identify them. Introduce skills and tools required for web security testing.
  • Top web security attacks like
  • Cross-site scripting
  • SQL injection
  • URL Parameter tampering
  • Banner grabbing
  • Buffer overruns
  • Session Hijacking
• Most commonly used tools for attack
  • Netcat
  • TamperData
  • JHijack
  • WebScarab
• Provide candidates an overview of Security Development Process

Take Away: After completion of this course you will be able to

• Use Security testing tools effectively
• Use techniques to explore web application vulnerabilities.

Pre-requisites: What I should know before attending this course

• Well versed with web application basics

Configuration and Tools Requirements:

• Desktop PC with Windows OS
• Firefox
• WebGoat 5.2
• TamperData
• WebScarab
• JHijack
• Netcat (Lab must be connected by network)

Instructor:

Mr. Jayesh Ingale
Practise Head – Testing (India)
Seedinfotech

Mr. Ingale has over 8 years experience in the field of software development and engineering on various high-end technologies in India and abroad. He is working as Practise Head  - Testing and leading a team of testers in SEED infotech Ltd.He headed Information Security Team at SEED infotech Ltd and provides consulting and training to companies like IBM, Microsoft, Cognizant, Zensar, Siemens, i-flex, Principal Finance, Xpansion etc as well as DRDO and government organizations. He has conducted Workshops and Trainings on Web Security Testing, Performance Testing, and Functional Testing.

Workshop B: Secure Application Development

• Date: 10 May 2010 ( 9am – 5pm)
• Workshop fee: 150 KD

The foundations of security of every information system are laid during its development. This 1-day workshop will introduce the fundamentals of secure software development and will touch on diverse areas including:

• Application Security concepts
• Introduction to Application Architecture
• Secure Software Architecture & Design Principles
• Security in the Development Lifecycle
• Web Applications and Web Services Security Fundamentals
• Session Management
• Defending Against Input Attacks
• Authentication
• Authorisation
• Database Security Issues
• Secure Database Connectivity
• Database security best practices
• Secure use of cryptography
• Error handling
• Error Logging
• Attacking & Defending Web Applications
• Code reviewing & testing
• Application Security Auditing Best practices
• Web application Vulnerability Assessment Methodology 

Instructor:

Mr. Dimitrios Petropoulos
MSc InfoSec, CISSP, CISA, ISO27001 LA, MIEE, MBCS
Managing Director
ENCODE Middle East

Mr. Dimitris has a long track record in performing risk analyses, vulnerability assessments, penetrations tests, technical security and compliance audits on large corporate infrastructures of international organizations.