Removing Bugs Open Web Application Security Project (OWASP) OWASP Top Ten Overview Web Application Security Consortium CERT Secure Coding Standards Bug Hunting Mistakes to Avoid Tools and Resources

Principles of Information Security Security Is a Lifecycle Issue Minimize Attack Surface Area Layers of Defense: Tenacious D Compartmentalize Consider All Application States Do NOT Trust the Untrusted Tutorial: Working with Eclipse (JEE Version) and Apache TomEE 7x Tutorial: Working with the HSQL Database Lab: Case Study Setup and Review

Unvalidated Data Buffer Overflows Integer Arithmetic Vulnerabilities Unvalidated Data: Crossing Trust Boundaries Defending Trust Boundaries Whitelisting vs Blacklisting Lab: Defending Trust Boundaries A1: Injection Injection Flaws SQL Injection Attacks Evolve Drill Down on Stored Procedures Other Forms of Injection Minimizing Injection Flaws Lab: Defending Against SQL Injection A2: Broken Authentication Quality and Protection of Authentication Data Handling Passwords on Server Side SessionID Risk Reduction HttpOnly and Security Headers Lab: Defending Authentication A3: Sensitive Data Exposure Protecting Data Can Mitigate Impact In-Memory Data Handling Secure Pipes Failures in TLS/SSL Framework Lab: Defending Sensitive Data A4: XML External Entities (XXE) XML Parser Coercion XML Attacks: Structure XML Attacks: Injection