Course Overview

The Certified Application Security Engineer (CASE) credential is developed in partnership with large application and software development experts globally. The CASE credential tests the critical security skills and knowledge required throughout a typical software development life cycle (SDLC), focusing on the importance of the implementation of secure methodologies and practices in today’s insecure operating environment.

The CASE certified training program is developed concurrently to prepare software professionals with the necessary capabilities that are expected by employers and academia globally.It is designed to be a hands-on, comprehensive application security course that will help software professionals create secure applications. The training program encompasses security activities involved in all phases of the Software Development Lifecycle (SDLC): planning, creating, testing, and deploying an application.

Unlike other application security trainings, CASE goes beyond just the guidelines on secure coding practices and includes secure requirement gathering, robust application design, and handling security issues in post development phases of application development. This makes CASE one of the most comprehensive certifications on the market today. It is desired by software application engineers, analysts, testers globally, and respected by hiring authorities. 

Course Duration

3 Days ( 24 Hours )

Target Audience

Individuals involved in the role of developing, testing, managing, or protecting a wide area of applications or individuals hoping to become application security engineers/analysts/testers

During this course you should learn: 

Understand secure SDLC and secure SDLC models in-depth

Apply the knowledge of OWASP Top 10, threat modelling, SAST and DAST

Capture security requirements of an application in development

Define, maintain and enforce application security best practices

Perform manual and automated code review of application

Conduct application security testing for web applications to assess the vulnerabilities

Drive the development of a holistic application security program

Rate the severity of defects and publishing comprehensive reports detailing associated risks and mitigations

Work in teams to improve security posture

Use Application security scanning technologies such as AppScan, Fortify, WebInspect, static application security testing (SAST), dynamic application security testing (DAST), single sign-on, and encryption

Follow secure coding standards that are based on industry-accepted best practices such as OWASP Guide, or CERT Secure Coding to address common coding vulnerabilities.

Create a software source code review process that is a part of the development cycles (SDLC, Agile, CI/CD) .

Course Content

Module 1: Understanding Application Security, Threats and Attacks

Lesson 1: What is a Secure Application

Lesson 2: Need for Application Security

Lesson 3: Most Common Application Level Attacks

Lesson 4: Why Applications become Vulnerable to Attacks

Lesson 5: What Consistutes Comprehensive Application Security ?

Lesson 6: Insecure Application: A Software Development Problem

Lesson 7: Software Security Standards, Models and Frameworks

Module 2: Security Requirements Gathering

Lesson 1: Importance of Gathering Security Requirements

Lesson 2: Security Requirement Engineering (SRE)

Lesson 3: Abuse Case and Security Use Case Modeling

Lesson 4: Abuser amd Security Stories

Lesson 5: Security Quality Requirements Engneering (SQUARE)

Lesson 6: Operationally Critical Threat, Asset and Vulnerability Evaluation (OCTAVE)

Module 3: Secure Application Design and Architecture

Lesson 1: Relative Cost of Fixing Vulnerabilities at Different Phases of SDLC

Lesson 2: Secure Application Design and Architecture

Lesson 3: Goal of Secure Design Process

Lesson 4: Secure Design Actions

Lesson 5: Secure Design Principles

Lesson 6: Threat Modeling

Lesson 7: Decompose Application

Lesson 8: Secure Application Architecture

Module 4: Secure Coding Practices for Input Validation

Lesson 1: Input Validation Pattern

Lesson 2: Validation and Security Issues

Lesson 3: Impact of Invalid Data Input

Lesson 4: Data Validation Techniques

Lesson 5: Input Validation using Frameworks and APIs

Lesson 6: Open Source Validation Framework for Java

Lesson 7: Servlet Filters Validation Filters for Servlet

Lesson 8: Data Validation using OWASP ESAPI

Lesson 9: Data Validation: Struts Framework

Lesson 10: Data Validation: Spring Framework

Lesson 11: Input Validation Errors

Lesson 12: Common Secure Coding Practices

Module 5: Secure Coding Practices for Authentication and Authorization

Lesson 1: Introduction to Authentication

Lesson 2: Types of Authentication

Lesson 3: Authentication Weaknesses and Prevention

Lesson 4: Introduction to Authorization

Lesson 5: Access Control Model

Lesson 6: EJB Authorization

Lesson 7: Java Authentication and Authorization (JAAS)

Lesson 8: Java EE Security

Lesson 9: Authorization Common Mistakes and Countermeasures

Lesson 10: Authentication and Authorization in Spring Security Framework

Lesson 11: Defensive Coding Practices against Broken Authentication and Authorization

Lesson 12: Secure Development Checklists: Broken Authentication and Session Management

Module 6: Secure Coding Practices for Cryptography

Lesson 1: Java Cryptographic

Lesson 2: Encryption and Secret Keys

Lesson 3: Cipher Class

Lesson 4: Digital Signatures

Lesson 5: Secure Socket Layer (SSL)

Lesson 6: Key Management

Lesson 7: Digital Signatures

Lesson 8: Signed Code Sources

Lesson 9: Hashing

Lesson 10: Java Card Cryptography

Lesson 11: Spring Security: Crypto Module

Lesson 12: Do's and Don'ts in Java Cryptography

Lesson 13: Best Practices for Java Cryptography

Module 7: Secure Coding Practices for Session Management

Lesson 1: Session Management

Lesson2: Session Tracking

Lesson 3: Session Management in Spring Security

Lesson 4: Session Vulnerabilities and their Mitigation Techniques

Lesson 5: Best Practices and Guidelines for Secured Sessions Management

Lesson 6: Checklist to Secure Credentials and Session ID's

Lesson 7: Guidelines for Secured Session Management

Module 8: Secure Coding Practices for Error Handling

Lesson 1: Introduction to exceptions

Lesson 2: Erroneous Exceptional Behaviors

Lesson 3: Dos and Don'ts in Error Handling

Lesson 4: Spring MVC Error Handling

Lesson 5: Exception Handling in Struts 2

Lesson 6: Best Practices for Error Handling

Lesson 7: Introduction to Logging

Lesson 8: Logging using Log4j

Lesson 9: Secure Coding in Logging

Module 9: Static and Dynamic Application Security Testing (SAST and DAST)

Lesson 1: Static Application Security Testing

Lesson 2: Manual Secure Code Review for Most Common Vulnerabilities

Lesson 3: Code Review: Check List Approach

Lesson 4: SAST Finding

Lesson 5: SAST Report

Lesson 6: Dynamic Application Security Testing

Lesson 7: Automated Application Vulnerability Scanning Tools

Lesson 8: Proxy-based Security Testing Tools

Lesson 9: Choosing between SAST and DAST

Module 10: Secure Deployment and Maintenance

Lesson 1: Secure Deployment

Lesson 2: Prior Deployment Activity

Lesson 3: Deployment Activities: Ensuring Security at Various Levels

Lesson 4: Ensuring Security at Host Level

Lesson 5: Ensuring Security at Network Level

Lesson 6: Ensuring Security at Application Level

Lesson 7: Ensuring Security at Web Container Level (Tomcat)

Lesson 8: Ensuring Security in Orcale

Lesson 9: Security Maintenance and Monitoring

Prerequisites

To be eligible to apply to sit for the CASE exam the candidate must either:

Attend the official EC-Council CASE training through an accredited EC-Council Partner (Accredited Training Centre/ iWeek/ iLearn) (All candidates are required to pay the USD100 application fee unless your training fee already includes this) or

Be an ECSP (.NET/ Java) member in good standing or

Have a minimum of 2 years working experience in InfoSec/ Software domain or

Have any other industry equivalent certifications such as GSSP .NET/Java

Course Agenda

Technical Requirement

Laptop with minimum 8GB Ram

Connected Monitor for iLabs.

Hi speed Internet Connection as All the labs it will be accessed through EC-Council Cloud

Exam Voucher Validity

It will be valid for 12 month starting from the last day of the course.

Certification Expiry

It will be valid for 3 years.