8411  Reviews star_rate star_rate star_rate star_rate star_half

Web Application Security Testing for PCI DSS

PCI DSS is a mandatory security standard for all organizations working with systems that handle credit cards. To prevent any breach, developers must follow secure coding guidelines and apply the...

Read More
By Request
Contact Us For Pricing
Duration 3 days
Course Code SEC-134
Available Formats Classroom

Overview

PCI DSS is a mandatory security standard for all organizations working with systems that handle credit cards. To prevent any breach, developers must follow secure coding guidelines and apply the latest best practices. 

This Web Application Security Testing for PCI DSS training course teaches attendees the common web application security issues, including those outlined in the OWASP Top Ten. Students learn how to identify core programming issues and security pitfalls of the Java language and framework.  In addition, participants learn about JSON testing and security testing techniques and tools. References to A1, A2, etc. in the outline reference specific vulnerabilities in the OWASP Top 10.

To ensure ample one-on-one engagement with the instructor, this class is capped at 12 people, overriding Ascendient Learning’s default cap of 15.

Note: This 3-day course can be split into 1 day + 2 days. Day 1 is a broad overview intended for managers and staff.  Days 2 and 3 cover the technical aspects of implementing secure code and are intended for developers.  PCI DSS requirements mandate the annual training of staff. Your organization may take Day 1 during the first year, and then days 2 and 3 the next year, fulfilling the formal compliance requirement for both years with a single course.

Skills Gained

  • Understand essential cybersecurity concepts
  • Gain an understanding of PCI DSS requirements
  • Understand Web application security issues
  • Analyze the OWASP Top Ten elements
  • Put Web application security in the context of any programming language
  • Go beyond the low hanging fruits
  • Understand security testing methodology and approaches
  • Be familiar with common security testing techniques and tools

Prerequisites

This intended audience for this security course is managers and developers working on Web applications in finance. Students must have general web application development and testing experience.

Course Details

Training Materials

All Secure Coding training attendees receive comprehensive courseware.

Software Requirements

Attendees will not need to install any software on their computers for this class. The class will be conducted in a remote environment that Ascendient Learning will provide; students will only need a local computer with a web browser and a stable Internet connection. Any recent version of Microsoft Edge, Mozilla Firefox, or Google Chrome will work well.

Outline

  • Introduction: Day 1
  • Cyber Security Basics
    • What is security?
    • Threat and risk
    • Cyber security threat types
    • Consequences of insecure software
      • Constraints and the market
      • The dark side
    • Categorization of bugs
      • The Seven Pernicious Kingdoms
    • Cyber security in the finance sector
      • Threats and trends in fintech
    • PCI DSS
      • Overview
      • Requirements and secure coding (Requirements 1-5)
      • Requirement 6: Develop and maintain secure systems and applications
      • Requirement 6.5: Address common coding vulnerabilities
      • Requirements and secure coding (Requirements 7-12)
  • OWASP Overview
    • A2: Broken Authentication
      • Authentication basics
      • Authentication weaknesses
      • Case study – Equifax Argentina
      • Spoofing on the Web
      • Case study – PayPal 2FA bypass
      • User interface best practices
      • Case study – Information disclosure in Simple Banking for Android
      • Password management
    • A3: Sensitive Data Exposure
      • Information exposure
      • Exposure through extracted data and aggregation
      • Case study – Strava data exposure
      • System information leakage
      • Information exposure best practices
    • A9: Using Components with Known Vulnerabilities
      • Using vulnerable components
      • Assessing the environment
      • Hardening
      • Untrusted functionality import
      • Importing JavaScript
      • Case study – The British Airways data breach
      • Case study – The Equifax data breach
      • Vulnerability management
    • A10: Insufficient Logging and Monitoring
      • Logging and monitoring principles
      • Insufficient logging
      • Plaintext passwords at Facebook
      • Logging best practices
      • Monitoring best practices
  • Introduction: Days 2 and 3
  • OWASP Top 10 for Developers
    • A1: Injection
      • Injection principles
      • Injection attacks
      • SQL injection
      • SQL injection best practices
      • Parameter manipulation
      • CRLF injection
      • Code injection
      • Injection best practices
    • A2: Broken Authentication
      • Password management
      • Session management
    • A4: XML External Entities (XXE)
      • DTD and the entities
      • Entity expansion
      • Attribute blowup
      • External Entity Attack (XXE)
    • Denial of service
      • Denial of Service
      • Resource exhaustion
      • Cash overflow
      • Flooding
      • Sustained client engagement
      • Infinite loop
      • Algorithm complexity issues
      • Regular expression denial of service (ReDoS)
      • Hashtable collision
    • A5: Broken Access Control
      • Access control basics
      • Failure to restrict URL access
      • Confused deputy
      • File upload
    • A6: Security Misconfiguration
      • Configuration principles
      • Configuration management
      • Server misconfiguration
    • A7: Cross-site Scripting (XSS)
      • Cross-site scripting basics
      • Cross-site scripting types
      • XSS protection best practices
    • A8: Insecure Deserialization
      • Serialization and deserialization challenges
      • Deserializing untrusted streams
      • Deserialization best practices
      • Creating a POP payload
      • Using the POP payload
  • Web Application Security Beyond the Top Ten
    • Client-side security
    • Same Origin Policy
      • Relaxing the Same Origin Policy
      • Relaxing with Cross-Origin Resource Sharing (CORS)
      • Simple request
      • Preflight request
      • Tabnabbing
    • Frame sandboxing
      • Cross-Frame Scripting (XFS) attack
      • Clickjacking beyond hijacking a click
      • Clickjacking protection best practices
  • Some further best practices
    • HTML5 security best practices
    • CSS security best practices
    • Ajax security best practices
  • JSON Security
    • JSON injection
    • Dangers of JSONP
    • JSON/JavaScript hijacking
    • Best practices
    • ReactJS vulnerability in HackerOne
  • Security Testing
    • Security testing techniques and tools
      • Code analysis
      • Dynamic analysis
  • Conclusion
    • Secure coding principles
      • Principles of robust programming by Matt Bishop
      • Secure design principles of Saltzer and Schröder
    • And now what?
      • Software security sources and further reading
Read Less

Schedule

Upcoming Course Dates

There are currently no scheduled dates for this course. If you are interested in this course, contact us with the form below.

Contact Information

FAQ

Does the course schedule include a Lunchbreak?

Classes typically include a 1-hour lunch break around midday. However, the exact break times and duration can vary depending on the specific class. Your instructor will provide detailed information at the start of the course.

What languages are used to deliver training?

Most courses are conducted in English, unless otherwise specified. Some courses will have the word "FRENCH" marked in red beside the scheduled date(s) indicating the language of instruction.

What does GTR stand for?

GTR stands for Guaranteed to Run; if you see a course with this status, it means this event is confirmed to run. View our GTR page to see our full list of Guaranteed to Run courses.

Does Ascendient Learning deliver group training?

Yes, we provide training for groups, individuals and private on sites. View our group training page for more information.

What does vendor-authorized training mean?

As a vendor-authorized training partner, we offer a curriculum that our partners have vetted. We use the same course materials and facilitate the same labs as our vendor-delivered training. These courses are considered the gold standard and, as such, are priced accordingly.

Is the training too basic, or will you go deep into technology?

It depends on your requirements, your role in your company, and your depth of knowledge. The good news about many of our learning paths, you can start from the fundamentals to highly specialized training.

How up-to-date are your courses and support materials?

We continuously work with our vendors to evaluate and refresh course material to reflect the latest training courses and best practices.

Are your instructors seasoned trainers who have deep knowledge of the training topic?

Ascendient Learning instructors have an average of 27 years of practical IT experience and have also served as consultants for an average of 15 years. To stay current, instructors spend at least 25 percent of their time learning new, emerging technologies and courses.

Do you provide hands-on training and exercises in an actual lab environment?

Lab access is dependent on the vendor and the type of training you sign up for. However, many of our top vendors will provide lab access to students to test and practice. The course description will specify lab access.

Will you customize the training for our company’s specific needs and goals?

We will work with you to identify training needs and areas of growth.  We offer a variety of training methods, such as private group training, on-site of your choice, and virtually. We provide courses and certifications that are aligned with your business goals.

How do I get started with certification?

Getting started on a certification pathway depends on your goals and the vendor you choose to get certified in. Many vendors offer entry-level IT certification to advanced IT certification that can boost your career. To get access to certification vouchers and discounts, please contact info@ascendientlearning.com.

Will I get access to content after I complete a course?

You will get access to the PDF of course books and guides, but access to the recording and slides will depend on the vendor and type of training you receive.

How do I request a W9 for Ascendient Learning?

View our filing status and how to request a W9.

Reviews

had a good time with the course, however some topics were left out due to the compact amount of time for training.

The tool provided to practice the course teachings is very functional and easy to use.

I was very pleased with the course setup by ExitCertified and the instructor.

Great company -- easy to sign up and very organized. Loved my teacher and class overall.

it was good and very informative. Instructure covered everything in detail.