Certified Application Security Engineer (CASE .NET)

Course Overview

The Certified Application Security Engineer (CASE) credential is developed in partnership with large application and software development experts globally.

The CASE credential tests the critical security skills and knowledge required throughout a typical software development life cycle (SDLC), focusing on the importance of the implementation of secure methodologies and practices in today’s insecure operating environment.

 

The CASE certified training program is developed concurrently to prepare software professionals with the necessary capabilities that are expected by employers and academia globally.It is designed to be a hands-on, comprehensive application security course that will help software professionals create secure applications. The training program encompasses security activities involved in all phases of the Software Development Lifecycle (SDLC): planning, creating, testing, and

deploying an application.

 

Unlike other application security trainings, CASE goes beyond just the guidelines on secure coding practices and includes secure requirement gathering, robust application design, and handling security issues in post development phases of application development. This makes CASE one of the most comprehensive certifications on the market today. It is desired by software application engineers, analysts, testers globally, and respected by hiring authorities.

 

2. Course Duration

 

3 Days ( 24 Hours )

 

3. Target Audience

 

Individuals involved in the role of developing, testing, managing, or protecting a wide area of applications or individuals hoping to become application security engineers/analysts/testers

 

4. During this course you should learn:

Understand secure SDLC and secure SDLC models in-depth

Apply the knowledge of OWASP Top 10, threat modelling, SAST and DAST

Capture security requirements of an application in development

Define, maintain and enforce application security best practices

Perform manual and automated code review of application

Conduct application security testing for web applications to assess the vulnerabilities

Drive the development of a holistic application security program

Rate the severity of defects and publishing comprehensive reports detailing associated risks and mitigations

Work in teams to improve security posture

Use Application security scanning technologies such as AppScan,

Fortify, WebInspect, static application security testing (SAST),

dynamic application security testing (DAST), single sign-on, and encryption

Follow secure coding standards that are based on industry-accepted best practices such as OWASP Guide, or CERT Secure Coding to address common coding vulnerabilities.

Create a software source code review process that is a part of the development cycles (SDLC, Agile, CI/CD).

 

5. Course Content

 

Module 1: Understanding Application Security, Threats and Attacks

Lesson 1: What is a Secure Application

Lesson 2: Need for Application Security

Lesson 3: Most Common Application Level Attacks

Lesson 4: Why Applications become Vulnerable to Attacks

Lesson 5: What Consistutes Comprehensive Application Security ?

Lesson 6: Insecure Application: A Software Development Problem

Lesson 7: Software Security Standards, Models and Frameworks

Module 2: Security Requirements Gathering

Lesson 1: Importance of Gathering Security Requirements

Lesson 2: Security Requirement Engineering (SRE)

Lesson 3: Abuse Case and Security Use Case Modeling

Lesson 4: Abuser amd Security Stories

Lesson 5: Security Quality Requirements Engneering (SQUARE)

Lesson 6: Operationally Critical Threat, Asset and Vulnerability Evaluation (OCTAVE)

Module 3: Secure Application Design and Architecture

Lesson 1: Relative Cost of Fixing Vulnerabilities at Different Phases of SDLC

Lesson 2: Secure Application Design and Architecture

Lesson 3: Goal of Secure Design Process

Lesson 4: Secure Design Actions

Lesson 5: Secure Design Principles

Lesson 6: Threat Modeling

Lesson 7: Decompose Application

Lesson 8: Secure Application Architecture

Module 4: Secure Coding Practices for Input Validation

Lesson 1: Input Validation

Lesson 2: Why Input Validation ?

Lesson 3: Input Validation Specification

Lesson 4: Input Validation Approaches

Lesson 5: Input Filtering

Lesson 6: Secure Coding Practices for Input Validation: Web Forms

Lesson 7: Secure Coding Practices for Input Validation: ASP.NET Core

Lesson 8: Secure Coding Practices for Input Validation: MVC

Module 5: Secure Coding Practices for Authentication and Authorization

Lesson 1: Authentication and Authorization

Lesson 2: Common Threats on User Authentication and Authorization

Lesson 3: Authentication and Authorization: Web Forms

Lesson 4: Authentication and Authorization: ASP .NET Core

Lesson 5: Authentication and Authorization: MVC

Lesson 6: Authentication and Authorization Defensive Techniques : Web Forms

Lesson 7: Authentication and Authorization Defensive Techniques : ASP .NET Core

Lesson 8: Authentication and Authorization Defensive Techniques : MVC

Module 6: Secure Coding Practices for Cryptography

Lesson 1: Cryptographic

Lesson 2: Ciphers

Lesson 3: Block Ciphers Modes

Lesson 4: Symmetric Encryption Keys

Lesson 5: Asymmetric Encryption Keys

Lesson 6: Functions of Cryptography

Lesson 7: Use of Cryptography to Mitigate Common Application Security Threats

Lesson 8: Cryptographic Attacks

Lesson 9: Techniques Attackers Use to Steal Cryptographic Keys

Lesson 10: What should you do to Secure .Net Applications for Cryptographic Attacks

Lesson 11:.NET Cryptographic Name Spaces

Lesson 12:.NET Cryptographic Class Hierarchy

Lesson 13: Symmetric Encryption

Lesson 14: Symmetric Encryption: Defensive Coding Techniques

Lesson 15: Asymmetric Encryption

Lesson 16: Asymmetric Encryption: Defensive Coding Techniques

Lesson 17: Hashing

Lesson 18: Digital Signatures

Lesson 19: Digital Certificates

Lesson 20: XML SIgnatures

Lesson 21: ASP.NET Core Specific S