Why Hunt Bugs? Security and Insecurity Dangerous Assumptions Attack Vectors Lab: Case Study in Failure Safe and Appropriate Bug Hunting/Hacking Working Ethically Respecting Privacy Bug/Defect Notification Bug Bounty Programs

Removing Bugs Open Web Application Security Project (OWASP) OWASP Top Ten Overview Web Application Security Consortium CERT Secure Coding Standards Bug Hunting Mistakes to Avoid Tools and Resources

Principles of Information Security Security Is a Lifecycle Issue Minimize Attack Surface Area Layers of Defense: Tenacious D Compartmentalize Consider All Application States Do NOT Trust the Untrusted

Unvalidated Data Buffer Overflows Integer Arithmetic Vulnerabilities Unvalidated Data: Crossing Trust Boundaries Defending Trust Boundaries Whitelisting vs Blacklisting A1: Injection Injection Flaws SQL Injection Attacks Evolve Drill Down on Stored Procedures Other Forms of Injection Minimizing Injection Flaws A2: Broken Authentication Quality and Protection of Authentication Data Handling Passwords on Server Side SessionID Risk Reduction HttpOnly and Security Headers A3: Sensitive Data Exposure Protecting Data Can Mitigate Impact In-Memory Data Handling Secure Pipes Failures in TLS/SSL Framework A4: XML External Entities (XXE) XML Parser Coercion XML Attacks: Structure XML Attacks: Injection Safe XML Processing A5: Broken Access Control Access Control Issues Excessive Privileges Insufficient Flow Control Unprotected URL/Resource Access Examples of Shabby Access Control Sessions and Session Management Lab: Spotlight: Verizon

Applications: What Next? Common Vulnerabilities and Exposures CWE/SANS Top 25 Most Dangerous SW Errors Strength Training: Project Teams/Developers Strength Training: IT Organizations Leveraging Common AppSec Practices and Control Lab: Recent Incidents Lab: Spotlight: Capital One Making Application Security Real Cost of Continually Reinventing Paralysis by Analysis Actional Application Security Additional Tools for the Toolbox

Cryptography Overview Strong Encryption Message Digests Encryption/Decryption Keys and Key Management NIST Recommendations Scanning Applications Overview Scanning Beyond the Applications Fingerprinting Vulnerability Scanning: Hunting for Bugs Reconnaissance Goals Data Collection Techniques Fingerprinting the Environment Enumerating the Web Application