|
所在平台: Coursera |
课程主页: https://www.coursera.org/learn/identifying-security-vulnerabilities
课程评论：没有评论
课程名称：识别安全漏洞 课程概述：本课程将帮助您建立安全编程的一些基本概念基础。我们将学习威胁建模和密码学的概念，您将能够开始创建威胁模型，并批判性地思考其他人创建的威胁模型。我们将学习应用密码学的基础知识，如加密和安全哈希。您将了解攻击者如何通过不当处理用户控制的数据来利用应用程序漏洞。课程还将帮助您建立对Web应用程序中注入问题的基本理解，包括三种最常见的注入问题：SQL注入、跨站脚本攻击（XSS）和命令注入。 此外，我们还将讨论应用程序身份验证和会话管理，其中身份验证是安全Web应用程序的重要组成部分，而会话管理则是同一硬币的另一面，因为用户请求的认证状态需要被正确处理并运行为一个会话。我们会学习敏感数据泄露问题及其保护客户数据的方法，并讨论如何有效存储与密码相关的信息，而不是存储明文密码。您还将参与编码作业，以帮助您更好地理解有效存储密码相关信息的机制。 在学习的过程中，我们将讨论如何监控和缓解这些问题，并在设计成易受攻击的Web应用程序WebGoat中愉快地利用两种不同的漏洞。 课程大纲： 1. 基础安全编程主题：本模块将让您接触到威胁建模和应用密码学的理念，您将能够创建威胁模型，并批判性地分析他人的威胁模型，应用STRIDE方法并区分系统中的信任边界。 2. 注入问题：您将对Web应用程序中的注入问题有基本了解，包括三种最常见的注入问题：SQL注入、跨站脚本和命令注入。此模块将通过在WebGoat应用程序中利用SQL注入漏洞来强化这些概念。 3. 身份验证问题：您将能够评估一个系统是否遵循一般建议的安全身份验证和会话管理方法，辨别身份验证、会话管理和访问控制之间的关系。您还将能在WebGoat中利用身份验证和会话管理的漏洞。 4. 敏感数据泄露问题：您将理解如何有效存储与密码相关的信息，而不是存储明文密码，并通过动手编码作业深入了解有效存储密码信息的机制。 准备好了吗？
Name:Foundational Topics in Secure Programming
Description:In this module, you will gain exposure to the ideas of threat modeling and applied cryptography. By the end of the module, you will be able to start to create threat models, and think critically about the threat models created by other people. You will be able to apply the STRIDE Method to your threat model and distinguish the trust boundaries in a given system. You will also gain a basic understanding of applied cryptography, such as encryption and secure hashing.
Name:Injection Problems
Description:By the end of this module, you will have a fundamental understanding of injection problems in web applications. You'll be able to discuss and describe the three most common types of injection problems: SQL injection, cross-site scripting, and command injection. In order to drive home these concepts, you will be able to work on exploiting a SQL injection vulnerability in the WebGoat application. You'll be able to formulate plans to mitigate injection problems in your applications.
Name:Problems Arising From Broken Authentication
Description:By the end of this module, you will be able to evaluate a system to determine if it follows the generally prescribed secure methods for authentication and session management in web applications. You'll be able to distinguish the relationship between authentication, session management, and access control. You will also be able to exploit WebGoat's authentication and session management vulnerability. As well as be able to evaluate a system to determine if it performs sufficient security logging such that non-repudiation is enforced. This will help drive the concepts that you will learn in this module.
Name:Sensitive Data Exposure Problems
Description:By the end of this module, you will understand how to effectively store password-related information, and NOT to store the actual plaintext passwords. You will also have a hands on coding assignment that will help you to better understand the mechanisms for effectively storing password-related information. Ready?
This course will help you build a foundation of some of the fundamental concepts in secure programming. We will learn about the concepts of threat modeling and cryptography and you'll be able to start to create threat models, and think critically about the threat models created by other people. We'll learn the basics of applying cryptography, such as encryption and secure hashing. We'll learn how attackers can exploit application vulnerabilities through the improper handling user-controlled data. We'll gain a fundamental understanding of injection problems in web applications, including the three most common types of injection problems: SQL injection, cross-site scripting, and command injection. We'll also cover application authentication and session management where authentication is a major component of a secure web application and session management is the other side of the same coin, since the authenticated state of user requests need to be properly handled and run as one session. We'll learn about sensitive data exposure issues and how you can help protect your customer's data. We'll cover how to effectively store password-related information, and not to store the actual plaintext passwords. We'll participate in coding assignment that will help you to better understand the mechanisms for effectively storing password-related information. Along the way, we’ll discuss ways of watching out for and mitigating these issues and be able have some fun and exploit two different vulnerabilities in a web application that was designed to be vulnerable, called WebGoat.
