This course will help you build a foundation of some of the fundamental concepts in secure programming. We will learn about the concepts of threat modeling and cryptography and you'll be able to start to create threat models, and think critically about the threat models created by other people. We'll learn the basics of applying cryptography, such as encryption and secure hashing. We'll learn how attackers can exploit application vulnerabilities through the improper handling user-controlled data. We'll gain a fundamental understanding of injection problems in web applications, including the three most common types of injection problems: SQL injection, cross-site scripting, and command injection.
Ce cours fait partie de la Spécialisation Secure Coding Practices
Offert par
Spécialisation Secure Coding PracticesUniversité de Californie à DavisÀ propos de ce cours
38,621 consultations récentes
Certificat partageable
Obtenez un Certificat lorsque vous terminez
100 % en ligne
Commencez dès maintenant et apprenez aux horaires qui vous conviennent.
Cours 2 sur 4 dans le
Dates limites flexibles
Réinitialisez les dates limites selon votre disponibilité.
Niveau intermédiaire
1-2 years of experience with some form of computer programming language like C/C++ or Java.
Approx. 15 heures pour terminer
Anglais
Sous-titres : Anglais
Compétences que vous acquerrez
CryptographyAuthentication Methodssecure programming
Certificat partageable
Obtenez un Certificat lorsque vous terminez
100 % en ligne
Commencez dès maintenant et apprenez aux horaires qui vous conviennent.
Cours 2 sur 4 dans le
Dates limites flexibles
Réinitialisez les dates limites selon votre disponibilité.
Niveau intermédiaire
1-2 years of experience with some form of computer programming language like C/C++ or Java.
Approx. 15 heures pour terminer
Anglais
Sous-titres : Anglais
Offert par
Université de Californie à Davis
UC Davis, one of the nation’s top-ranked research universities, is a global leader in agriculture, veterinary medicine, sustainability, environmental and biological sciences, and technology. With four colleges and six professional schools, UC Davis and its students and alumni are known for their academic excellence, meaningful public service and profound international impact.
Programme du cours : ce que vous apprendrez dans ce cours
5 heures pour terminer
Foundational Topics in Secure Programming
In this module, you will gain exposure to the ideas of threat modeling and applied cryptography. By the end of the module, you will be able to start to create threat models, and think critically about the threat models created by other people. You will be able to apply the STRIDE Method to your threat model and distinguish the trust boundaries in a given system. You will also gain a basic understanding of applied cryptography, such as encryption and secure hashing.
5 heures pour terminer
14 vidéos (Total 83 min), 3 lectures, 2 quiz
14 vidéos
Course Introduction3 min
Module 1 Introduction1 min
Fundamental Concepts in Security8 min
The STRIDE Method Via Example9 min
STRIDE Threats In More Detail Via Example4 min
Trust Boundaries2 min
Cryptography Basics Introduction3 min
Cryptography Basics: Block Ciphers9 min
Cryptography Basics: Symmetric and Asymmetric Cryptography5 min
Cryptography Basics: Hash Functions9 min
Cryptography Basics: Application to Threat Models4 min
Lab: Threat Model Activity3 min
OWASP Top 10 Proactive Controls and Exploits - Part 16 min
OWASP Top 10 Proactive Controls and Exploits - Part 29 min
3 lectures
A Note From UC Davis10 min
Welcome to Peer Review Assignments!10 min
Reading and Resource20 min
1 exercice pour s'entraîner
Module 1 Quiz30 min
3 heures pour terminer
Injection Problems
By the end of this module, you will have a fundamental understanding of injection problems in web applications. You'll be able to discuss and describe the three most common types of injection problems: SQL injection, cross-site scripting, and command injection. In order to drive home these concepts, you will be able to work on exploiting a SQL injection vulnerability in the WebGoat application. You'll be able to formulate plans to mitigate injection problems in your applications.
3 heures pour terminer
17 vidéos (Total 87 min), 1 lecture, 1 quiz
17 vidéos
General Concepts: Injection Problems4 min
SQL Injection Problems8 min
Mitigating SQL Injection Using Prepared Statements3 min
Mitigating SQL Injection Using Stored Procedures3 min
Mitigating SQL Injection Using Whitelisting2 min
Injection Problems in Real Life5 min
Solution Screencast for Lab: Exploit Using WebGoat's SQLi Example7 min
Cross-Site Scripting Introduction3 min
HTTP and Document Isolation8 min
DOM, Dynamically Generating Pages, and Cross-Site Scripting7 min
The 3-Kinds of Cross-Site Scripting Vulnerabilities6 min
Comparing and Contrasting Cross-Site Scripting Vulnerabilities3 min
OWASP Prescribed Cross-site Scripting Prevention Rules - Part 16 min
OWASP Prescribed Cross-site Scripting Prevention Rules - Part 26 min
Command Injection Problems3 min
OWASP Proactive Controls Related to Injections4 min
1 lecture
Resources20 min
1 exercice pour s'entraîner
Module 2 Quiz30 min
4 heures pour terminer
Problems Arising From Broken Authentication
By the end of this module, you will be able to evaluate a system to determine if it follows the generally prescribed secure methods for authentication and session management in web applications. You'll be able to distinguish the relationship between authentication, session management, and access control. You will also be able to exploit WebGoat's authentication and session management vulnerability. As well as be able to evaluate a system to determine if it performs sufficient security logging such that non-repudiation is enforced. This will help drive the concepts that you will learn in this module.
4 heures pour terminer
11 vidéos (Total 71 min), 1 lecture, 1 quiz
11 vidéos
Overview of HTTP Protocol7 min
Introduction to Authentication10 min
Handling Error Messages During Authentication4 min
Introduction to Session Management7 min
Enforcing Access Control with Session Management7 min
Session Management Threat: Bruteforce Session IDs10 min
Session Management Theat: Session Fixation Vulnerabilities3 min
Logging and Monitoring3 min
Solution for Lab #3: WebGoat’s Session Management Vulnerability9 min
OWASP Proactive Controls Related to Session Management and Authentication6 min
1 lecture
Resources20 min
1 exercice pour s'entraîner
Module 3 Quiz30 min
4 heures pour terminer
Sensitive Data Exposure Problems
By the end of this module, you will understand how to effectively store password-related information, and NOT to store the actual plaintext passwords. You will also have a hands on coding assignment that will help you to better understand the mechanisms for effectively storing password-related information. Ready?
4 heures pour terminer
9 vidéos (Total 36 min), 1 lecture, 2 quiz
9 vidéos
Introduction to Sensitive Data Exposure Problems5 min
Issue 1: Using PII to Compose Session IDs3 min
Issue 2: Not Encrypting Sensitive Information2 min
Issue 3: Improperly Storing Passwords5 min
Slowing Down Password Bruteforce Attacks7 min
Issue 4: Using HTTP for Sensitive Client-server4 min
OWASP Proactive Controls Related to Sensitive Data Exposure3 min
Course Summary1 min
1 lecture
Resources20 min
1 exercice pour s'entraîner
Module 4 Quiz30 min
Avis
Meilleurs avis pour IDENTIFYING SECURITY VULNERABILITIES
par HT15 mai 2020
The course is really great and got to learn new & interesting concepts except that the webgoat installation tutorial/document is not up to date.
par SJ22 oct. 2019
Threat Modeling and Week 4 code submission was very fruitful. Overall good content to learn for developers and Application Engineers.
par DJ20 mai 2020
KINDLY PROVIDE HANDS ON .THERE WAS NO HANDS ON ALL THEORY NO T MUCH USE IF STUDENTS GET ZERO PRACTICAL
par DB9 déc. 2019
Its a good learning and got to know about security and Vulnerabilities in an ellaborate way. Thanks
À propos du Spécialisation Secure Coding Practices
This Specialization is intended for software developers of any level who are not yet fluent with secure coding and programming techniques.Through four courses, you will cover the principles of secure coding, concepts of threat modeling and cryptography and exploit vulnerabilities in both C/C++ and Java languages, which will prepare you to think like a hacker and protect your organizations information. The courses provide ample practice activities including exploiting WebGoat, an OWASP project designed to teach penetration testing.
Foire Aux Questions
Quand aurai-je accès aux vidéos de cours et aux devoirs ?
Access to lectures and assignments depends on your type of enrollment. If you take a course in audit mode, you will be able to see most course materials for free. To access graded assignments and to earn a Certificate, you will need to purchase the Certificate experience, during or after your audit. If you don't see the audit option:
- The course may not offer an audit option. You can try a Free Trial instead, or apply for Financial Aid.
- The course may offer 'Full Course, No Certificate' instead. This option lets you see all course materials, submit required assessments, and get a final grade. This also means that you will not be able to purchase a Certificate experience.
À quoi ai-je droit si je m'abonne à cette Spécialisation ?
Lorsque vous vous inscrivez au cours, vous bénéficiez d'un accès à tous les cours de la Spécialisation, et vous obtenez un Certificat lorsque vous avez réussi. Votre Certificat électronique est alors ajouté à votre page Accomplissements. À partir de cette page, vous pouvez imprimer votre Certificat ou l'ajouter à votre profil LinkedIn. Si vous souhaitez seulement lire et visualiser le contenu du cours, vous pouvez accéder gratuitement au cours en tant qu'auditeur libre.
Quelle est la politique de remboursement ?
Si vous vous abonnez, vous bénéficiez d'une période d'essai gratuite de 7 jours, durant laquelle vous pouvez annuler votre abonnement sans pénalité. Ensuite, nous n'accordons plus de remboursements, mais vous pouvez annuler votre abonnement à tout instant. Consultez notre politique de remboursement complète.
Une aide financière est-elle possible ?
Oui, Coursera offre une Aide Financière aux étudiants qui n'ont pas les moyens d'acquitter les frais. Demandez-la en cliquant sur le lien Aide Financière sous le bouton S'inscrire situé à gauche. Vous devrez remplir un formulaire de demande et vous serez averti(e) si elle est acceptée. Vous devrez répéter cette procédure pour chaque cours de la Spécialisation, y compris pour le Projet Final. En savoir plus.
Puis-je obtenir des crédits universitaires si je réussis le Cours ?
Ce Cours n'est pas associé à des crédits universitaires, mais certaines universités peuvent décider d'accepter des Certificats de Cours pour des crédits. Vérifiez-le auprès de votre établissement pour en savoir plus. Les Diplômes en ligne et les Certificats Mastertrack™ sur Coursera apportent la possibilité d'obtenir des crédits universitaires.
D'autres questions ? Visitez le Centre d'Aide pour les Etudiants.
