< Back to catalog

Web application security for PCI DSS 4.0 compliance

CYDPCIDSSMs
2-5-days
On-site or online
Hands-on
Banking and finance
PCI DSS
Developer
Instructor-led
Pricing Inquiry Download PDF
labs

38 Labs

case_study

28 Case Studies

Platform

Web

Audience

Managers and developers working on Web applications in banking and finance

Preparedness

General development

Standards and references

OWASP, SEI CERT, CWE and Fortify Taxonomy

Group size

12 participants

Outline

  • Cyber security basics
  • PCI DSS 4.0 introduction
  • Requirement 1
  • Requirement 2
  • Requirement 3 and 4
  • Requirement 5
  • Requirement 6
  • Requirement 7
  • Requirement 8
  • Requirement 9
  • Requirement 10
  • Requirement 11
  • Requirement 12
  • Wrap up

What you will learn

  • Getting familiar with essential cyber security concepts
  • Having essential understanding of PCI DSS requirements
  • Understanding how cryptography supports security
  • Managing vulnerabilities in third party components
  • Input validation approaches and principles
  • Access control design and implementation guidelines
  • Understanding security testing methodology and approaches
  • Getting familiar with security testing techniques and tools

Description

The course aligns PCI DSS Requirements 4.0 with foundational concepts of secure coding, and thus natively serves the compliance with secure coding training requirement (6.2.2).

The comprehensive journey starts with laying down the basics of security, cybersecurity and secure coding, as well as PCI DSS itself. Participants then delve deep into secure configuration, cryptography and protection against malicious software, aligned to the Requirements.

Requirement 6 specifically focuses on development and maintenance of secure systems and software, and the corresponding chapter is therefore the broadest one. Topics include bug categorization, secure design and implementation principles. Approaches to input validation are followed up by some specific issues, like integer handling, injection or XSS. We also discuss common software security weaknesses, like error handling or code quality, as well as security of some commonly used data structures like XML or JSON.

The curriculum continues with a thorough examination of authentication, authorization and accountability challenges, and concludes with security testing methodology and specific testing techniques.

The course goes beyond theory, providing hands-on labs and real-world case studies from the financial sector. Participants emerge with a heightened understanding of secure coding best practices, ensuring the development of applications that safeguard sensitive payment card data and comply with the stringent requirements of PCI DSS 4.0 on a yearly basis.

Note:

Note: This course is customized for PCI DSS Requirement 6.2.2 compliance, concerning both the content and the delivery structure. The table of contents reflects the Java version, but the course can also come with C#, Python and Node content.

Aligned to the compliance requirements, the delivery of the training days can be done separately, breaking the course into separate events that can span across year boundaries, aligned to your long-term compliance plans.

Please contact us to customize the course to your technology stack and compliance needs.

They said about us

”

Great! Just great!

Nothing was missing here, the whole thing was great! Made me interested in a security testing session too.

Employee at a Financial Services company , April, 2020

Austin, TX, USA

Table of contents

  • Cyber security basics
  • PCI DSS 4.0 introduction
    • Overview
    • Data elements
    • Control objectives and requirements
      • Build and Maintain a Secure Network and Systems
      • Protect Account Data
      • Maintain a Vulnerability Management Program
      • Implement Strong Access Control Measures
      • Regularly Monitor and Test Networks
      • Support Information Security with Organizational Policies and Programs
  • Requirement 1
    • Requirement 1: Install and Maintain Network Security Controls
  • Requirement 2
    • Requirement 2: Apply Secure Configurations to All System Components
    • Configuration principles
    • Server misconfiguration
    • Cookie security
      • Cookie security best practices
      • Cookie attributes
    • XML parsing
      • DTD and the entities
      • Entity expansion
      • External Entity Attack (XXE)
        • File inclusion with external entities
        • Server-Side Request Forgery with external entities
        • Lab – External entity attack
        • Preventing XXE
        • Lab – Prohibiting DTD
        • Case study – XXE vulnerability in Ivanti products
  • Requirement 3 and 4
    • Requirement 3: Protect Stored Account Data
    • Requirement 4: Protect Cardholder Data with Strong Cryptography …
    • Information exposure
      • Exposure through extracted data and aggregation
      • Case study – Strava data exposure
      • System information leakage
        • Leaking system information
      • Information exposure best practices
    • Cryptography for developers
      • Cryptography basics
      • Java Cryptographic Architecture (JCA) in brief
      • Elementary algorithms
        • Hashing
          • Hashing basics
          • Common hashing mistakes
          • Hashing in Java
          • Lab – Hashing in JCA
      • Confidentiality protection
        • Symmetric encryption
          • Block ciphers
          • Modes of operation
          • Modes of operation and IV – best practices
          • Symmetric encryption in Java
          • Symmetric encryption in Java with streams
          • Lab – Symmetric encryption in JCA
        • Asymmetric encryption
          • The RSA algorithm
            • Using RSA – best practices
            • RSA in Java
            • Case study – RSA attacks: Bleichenbacher, ROBOT, and Marvin
        • Combining symmetric and asymmetric algorithms
        • Key exchange and agreement
          • Key exchange
          • Diffie-Hellman key agreement algorithm
          • Key exchange pitfalls and best practices
  • Requirement 3 and 4
    • Cryptography for developers
      • Elementary algorithms
        • Random number generation
          • Pseudo random number generators (PRNGs)
          • Cryptographically secure PRNGs
          • Seeding
          • Using virtual random streams
          • Weak and strong PRNGs in Java
          • Lab – Using random numbers in Java
          • True random number generators (TRNG)
          • Assessing PRNG strength
          • Case study – Equifax credit account freeze
      • Integrity protection
        • Message Authentication Code (MAC)
          • Calculating MAC in Java
          • Lab – Calculating MAC in JCA
        • Digital signature
          • Digital signature with RSA
          • Elliptic Curve Cryptography
            • ECC basics
            • Digital signature with ECC
          • Digital signature in Java
            • Lab – Digital signature with ECDSA in JCA
      • Public Key Infrastructure (PKI)
        • Key management challenges
        • Certificates
          • Certificates and PKI
          • X.509 certificates
          • Chain of trust
          • PKI actors and procedures
          • Certificate revocation
  • Requirement 5
    • Requirement 5: Protect All Systems and Networks from Malicious Software
  • Requirement 6
    • Requirement 6: Develop and Maintain Secure Systems and Software
    • Security in the Software Development Lifecycle
      • Securing the SDLC
      • OWASP Software Assurance Maturity Model (SAMM)
      • Microsoft Security Development Lifecycle (MS SDL)
      • Build Security In Maturity Model (BSIMM)
    • Categorization of bugs
      • The Seven Pernicious Kingdoms
      • Common Weakness Enumeration (CWE)
      • CWE Top 25 Most Dangerous Software Weaknesses
      • SEI CERT
      • SEI CERT Coding Standards
      • Rules and recommendations
    • Security by design
      • The STRIDE model of threats
      • Secure design principles of Saltzer and Schroeder
        • Economy of mechanism
        • Fail-safe defaults
        • Complete mediation
        • Open design
        • Separation of privilege
        • Least privilege
        • Least common mechanism
        • Psychological acceptability
    • Vulnerable components
      • Using vulnerable components
      • Case study – The Equifax data breach
      • Assessing the environment
      • Hardening
      • Untrusted functionality import
      • Case study – The Polyfill.io supply chain attack
      • Vulnerability management
    • Input validation
      • Input validation principles
      • Denylists and allowlists
      • Case study – Missing input validation in Upserve
      • What to validate – the attack surface
      • Where to validate – defense in depth
      • When to validate – validation vs transformations
      • Validation with regex
  • Requirement 6
    • Input validation
      • Integer handling problems
        • Representing signed numbers
        • Integer visualization
        • Integer overflow
        • Lab – Integer overflow
        • Signed / unsigned confusion in Java
        • Case study – The Stockholm Stock Exchange
        • Integer truncation
        • Case study – WannaCry
        • Best practices
          • Precondition testing
          • Postcondition testing
          • Integer handling in Java
          • Lab – Integer handling
      • Files and streams
        • Path traversal
        • Lab – Path traversal
        • Additional challenges in Windows
        • Case study – File spoofing in WinRAR
        • Path traversal best practices
        • Lab – Path canonicalization
      • Unsafe reflection
        • Reflection without validation
        • Lab – Unsafe reflection
    • Injection
      • Injection principles
      • Injection attacks
      • SQL injection
        • SQL injection basics
        • Lab – SQL injection
        • Attack techniques
        • Content-based blind SQL injection
        • Time-based blind SQL injection
        • SQL injection best practices
          • Input validation
          • Parameterized queries
          • Lab – Using prepared statements
          • Case study – Hacking Fortnite accounts
      • Code injection
        • OS command injection
          • OS command injection best practices
          • Using Runtime.exec()
          • Case study – Shellshock
          • Lab – Shellshock
          • Case study – Command injection in AVTECH IP cameras
    • Cross-site scripting (XSS)
      • Cross-site scripting basics
      • Cross-site scripting types
        • Persistent cross-site scripting
        • Reflected cross-site scripting
        • Client-side (DOM-based) cross-site scripting
      • Lab – Stored XSS
      • Lab – Reflected XSS
      • Case study – XSS in Fortnite accounts
      • XSS protection best practices
        • Protection principles – escaping
        • Lab – XSS fix / stored
        • Lab – XSS fix / reflected
    • XML security
      • XML validation
      • XML injection
    • JSON security
      • Best practices
      • Case study – ReactJS vulnerability in HackerOne
    • Server-side Request Forgery (SSRF)
      • Case study – SSRF and the Capital One breach
  • Requirement 6
    • Code quality
      • Code quality and security
      • Data handling
        • Initialization and cleanup
          • Constructors and destructors
          • Class initialization cycles
          • Lab – Initialization cycles
        • Unreleased resource
          • The finalize() method – best practices
      • Object oriented programming pitfalls
        • Accessibility modifiers
          • Are accessibility modifiers a security feature?
          • Accessibility modifiers – best practices
          • Overriding and accessibility modifiers
        • Inheritance and overriding
        • Mutability
          • Lab – Mutable object
        • Cloning
    • Errors
      • Error and exception handling principles
      • Error handling
        • Returning a misleading status code
        • Reachable assertion
        • Information exposure through error reporting
          • Information leakage via error pages
          • Case study – Information leakage via errors in Apache Superset
      • Exception handling
        • In the catch block. And now what?
        • Catching NullPointerException
        • Empty catch block
        • Overly broad throws
        • Improper completing of the finally block
        • Throwing undeclared checked exceptions
        • Swallowed ThreadDeath
        • Throwing RuntimeException or Throwable
        • Lab – Exception handling mess
  • Requirement 7
    • Requirement 7: Restrict Access to System Components and Cardholder Data…
    • Authorization
      • Access control basics
      • Failure to restrict URL access
      • Confused deputy
        • Insecure direct object reference (IDOR)
        • Lab – Insecure Direct Object Reference
        • Authorization bypass through user-controlled keys
        • Case study – Remote takeover of Nexx garage doors and alarms
        • Lab – Horizontal authorization
      • File upload
        • Unrestricted file upload
        • Good practices
        • Lab – Unrestricted file upload
  • Requirement 8
    • Requirement 8: Identify Users and Authenticate Access to System Components
    • Authentication
      • Authentication basics
      • Multi-factor authentication (MFA)
      • Case study – The InfinityGauntlet attack
      • Time-based One Time Passwords (TOTP)
      • Passwordless solutions
      • Authentication weaknesses
      • Case study – Equifax Argentina
      • Spoofing on the Web
      • User interface best practices
      • Lab – On-line password brute forcing
      • Session management
        • Session management essentials
        • Why do we protect session IDs – Session hijacking
        • Session fixation
        • Session invalidation
        • Session ID best practices
        • Cross-site Request Forgery (CSRF)
          • Lab – Cross-site Request Forgery
          • CSRF best practices
          • CSRF defense in depth
          • Lab – CSRF protection with tokens
  • Requirement 8
    • Authentication
      • Password management
        • Inbound password management
          • Storing account passwords
          • Password in transit
          • Lab – Is just hashing passwords enough?
          • Dictionary attacks and brute forcing
          • Salting
          • Adaptive hash functions for password storage
          • Lab – Using adaptive hash functions in JCA
          • Password policy
            • NIST authenticator requirements for memorized secrets
            • Password hardening
            • Using passphrases
            • Password change
            • Password recovery issues
            • Password recovery best practices
            • Lab – Password reset weakness
            • Case study – Facebook account takeover via recovery code
            • Case study – GitLab account takeover
            • Password database migration
            • (Mis)handling null passwords
        • Outbound password management
          • Hard coded passwords
          • Best practices
          • Lab – Hardcoded password
          • Protecting sensitive information in memory
          • Challenges in protecting memory
            • Case study – Microsoft secret key theft via dump files
            • Storing sensitive data in memory
            • Lab – Using secret-handling classes in Java
  • Requirement 9
    • Requirement 9: Restrict Physical Access to Cardholder Data
  • Requirement 10
    • Requirement 10: Log and Monitor All Access to System Components and Cardholder Data
    • Logging and Monitoring
      • Logging and monitoring principles
      • Insufficient logging
      • Case study – Plaintext passwords at Facebook
      • Log forging
      • Web log forging
      • Log forging – best practices
      • Case study – Log interpolation in log4j
      • Case study – The Log4Shell vulnerability (CVE-2021-44228)
      • Case study – Log4Shell follow-ups (CVE-2021-45046, CVE-2021-45105)
      • Lab – Log4Shell
      • Logging best practices
      • Testing for logging issues
      • Monitoring best practices
  • Requirement 11
    • Requirement 11: Test Security of Systems and Networks Regularly
    • Security testing methodology
      • Security testing – goals and methodologies
      • Overview of security testing processes
      • Identifying assets
      • Assigning security requirements
      • Lab – Identifying and rating assets
      • Threat modeling
        • Attacker profiling
        • SDL threat modeling
        • Mapping STRIDE to DFD
        • DFD example
        • Lab – SDL threat modelling with OWASP Threat Dragon
        • Attack trees
        • Attack tree example
        • Risk analysis
    • Security testing techniques and tools
      • Fuzzing
  • Requirement 12
    • Requirement 12: Support Information Security with Organizational Policies and Programs
  • Wrap up
    • Secure coding principles
      • Principles of robust programming by Matt Bishop
    • And now what?
      • Software security sources and further reading
      • Java resources

Pricing

2-5-days Session Price

3750 EUR / person

  • Live, instructor led classroom training
  • Discussion and insight into the hacker’s mindset
  • Hands-on practice using case studies based on high-profile hacks and live lab exercises
Inquiry
Customized course

Tailor a course to your preferences

  • Send us a brief description of your business’s training needs
  • Include your contact information
  • One of our colleagues will be in touch to schedule a free consultation about training requirements
Inquiry

Inquiry

Interested in the trainings but still have some questions? Curious about how you can customize a training for your team? Send us a message and a team member will be in touch within 24 hours.

This field is required

This field is required

Send us your phone number if you prefer to discuss further on a call

This field is required

This field is required

This field is required

This field is required