课程信息

100% 在线

立即开始,按照自己的计划学习。

可灵活调整截止日期

根据您的日程表重置截止日期。

中级

1-2 years of experience with some form of computer programming language like C/C++ or Java.

完成时间大约为12 小时

建议:4 weeks of study, 2-5 hours/week...

英语(English)

字幕:英语(English)

您将获得的技能

CryptographyAuthentication Methodssecure programming

100% 在线

立即开始,按照自己的计划学习。

可灵活调整截止日期

根据您的日程表重置截止日期。

中级

1-2 years of experience with some form of computer programming language like C/C++ or Java.

完成时间大约为12 小时

建议:4 weeks of study, 2-5 hours/week...

英语(English)

字幕:英语(English)

教学大纲 - 您将从这门课程中学到什么

1
完成时间为 5 小时

Foundational Topics in Secure Programming

In this module, you will gain exposure to the ideas of threat modeling and applied cryptography. By the end of the module, you will be able to start to create threat models, and think critically about the threat models created by other people. You will be able to apply the STRIDE Method to your threat model and distinguish the trust boundaries in a given system. You will also gain a basic understanding of applied cryptography, such as encryption and secure hashing.

...
14 个视频 (总计 83 分钟), 3 个阅读材料, 2 个测验
14 个视频
The STRIDE Method Via Example9分钟
STRIDE Threats In More Detail Via Example4分钟
Trust Boundaries2分钟
Cryptography Basics Introduction3分钟
Cryptography Basics: Block Ciphers9分钟
Cryptography Basics: Symmetric and Asymmetric Cryptography5分钟
Cryptography Basics: Hash Functions9分钟
Cryptography Basics: Application to Threat Models4分钟
Lab: Threat Model Activity3分钟
OWASP Top 10 Proactive Controls and Exploits - Part 16分钟
OWASP Top 10 Proactive Controls and Exploits - Part 29分钟
3 个阅读材料
A Note From UC Davis10分钟
Welcome to Peer Review Assignments!10分钟
Reading and Resource20分钟
1 个练习
Module 1 Quiz30分钟
2
完成时间为 3 小时

Injection Problems

By the end of this module, you will have a fundamental understanding of injection problems in web applications. You'll be able to discuss and describe the three most common types of injection problems: SQL injection, cross-site scripting, and command injection. In order to drive home these concepts, you will be able to work on exploiting a SQL injection vulnerability in the WebGoat application. You'll be able to formulate plans to mitigate injection problems in your applications.

...
17 个视频 (总计 87 分钟), 1 个阅读材料, 1 个测验
17 个视频
Mitigating SQL Injection Using Prepared Statements3分钟
Mitigating SQL Injection Using Stored Procedures3分钟
Mitigating SQL Injection Using Whitelisting2分钟
Injection Problems in Real Life5分钟
Solution Screencast for Lab: Exploit Using WebGoat's SQLi Example7分钟
Cross-Site Scripting Introduction3分钟
HTTP and Document Isolation8分钟
DOM, Dynamically Generating Pages, and Cross-Site Scripting7分钟
The 3-Kinds of Cross-Site Scripting Vulnerabilities6分钟
Comparing and Contrasting Cross-Site Scripting Vulnerabilities3分钟
OWASP Prescribed Cross-site Scripting Prevention Rules - Part 16分钟
OWASP Prescribed Cross-site Scripting Prevention Rules - Part 26分钟
Command Injection Problems3分钟
OWASP Proactive Controls Related to Injections4分钟
1 个阅读材料
Resources20分钟
1 个练习
Module 2 Quiz30分钟
3
完成时间为 4 小时

Problems Arising From Broken Authentication

By the end of this module, you will be able to evaluate a system to determine if it follows the generally prescribed secure methods for authentication and session management in web applications. You'll be able to distinguish the relationship between authentication, session management, and access control. You will also be able to exploit WebGoat's authentication and session management vulnerability. As well as be able to evaluate a system to determine if it performs sufficient security logging such that non-repudiation is enforced. This will help drive the concepts that you will learn in this module.

...
11 个视频 (总计 71 分钟), 1 个阅读材料, 1 个测验
11 个视频
Handling Error Messages During Authentication4分钟
Introduction to Session Management7分钟
Enforcing Access Control with Session Management7分钟
Session Management Threat: Bruteforce Session IDs10分钟
Session Management Theat: Session Fixation Vulnerabilities3分钟
Logging and Monitoring3分钟
Solution for Lab #3: WebGoat’s Session Management Vulnerability9分钟
OWASP Proactive Controls Related to Session Management and Authentication6分钟
1 个阅读材料
Resources20分钟
1 个练习
Module 3 Quiz30分钟
4
完成时间为 4 小时

Sensitive Data Exposure Problems

By the end of this module, you will understand how to effectively store password-related information, and NOT to store the actual plaintext passwords. You will also have a hands on coding assignment that will help you to better understand the mechanisms for effectively storing password-related information. Ready?

...
9 个视频 (总计 36 分钟), 1 个阅读材料, 2 个测验
9 个视频
Issue 2: Not Encrypting Sensitive Information2分钟
Issue 3: Improperly Storing Passwords5分钟
Slowing Down Password Bruteforce Attacks7分钟
Issue 4: Using HTTP for Sensitive Client-server4分钟
OWASP Proactive Controls Related to Sensitive Data Exposure3分钟
Course Summary1分钟
1 个阅读材料
Resources20分钟
1 个练习
Module 4 Quiz30分钟

讲师

Avatar

Sandra Escandor-O'Keefe

Offensive Security Engineer at Fastly
Continuing and Professional Education

关于 加州大学戴维斯分校

UC Davis, one of the nation’s top-ranked research universities, is a global leader in agriculture, veterinary medicine, sustainability, environmental and biological sciences, and technology. With four colleges and six professional schools, UC Davis and its students and alumni are known for their academic excellence, meaningful public service and profound international impact....

常见问题

  • 注册以便获得证书后,您将有权访问所有视频、测验和编程作业(如果适用)。只有在您的班次开课之后,才可以提交和审阅同学互评作业。如果您选择在不购买的情况下浏览课程,可能无法访问某些作业。

还有其他问题吗?请访问 学生帮助中心